Capability-based participation
A Host creates a Channel and distributes signed invitation material to intended participants. Invitation material acts as a capability and should be protected accordingly.
Product
A communication compartment, not another global account.
M2 gives a defined group its own encrypted Channel, local context, membership, and lifetime—without requiring ordinary participants to register a phone number or email address.
What M2 does
Encrypted exchange
Text and supported files are encrypted at the endpoint and routed through the M2 Onion service using embedded Tor.
Local encrypted history
Communication history is kept locally under the app’s protected storage model, giving each device its own Channel context.
Protected files
Verified file controls support viewing inside the intended experience and reduce accidental export. Authorized recipients, screenshots, external cameras, or compromised endpoints remain outside that boundary.
M2 Code
An M2 Code carries the authority needed for the supported Channel operation. It is sensitive operational material, not a public user name.
Android-first
The current owner-authorized product release supports Android 13 and later. A direct-download macOS edition is being engineered and will not be labeled current until its native security path, signing, and distribution verification pass.
Channel lifecycle
Active
Members coordinate inside the current Channel lifetime and capacity.
Expired / read-only
When time expires, current verified behavior preserves the local context in a restricted state rather than presenting it as active.
Reactivated
A supported reactivation retains the existing Channel capacity and begins a new calendar-month period.
Deleted
Deleting a Channel removes its local context according to the current app behavior. Content already seen or copied by a recipient cannot be recalled cryptographically.
Trusted updates before entry
M2 checks a separately hosted, trusted release manifest. When a newer compatible release is mandatory, the app verifies the package identity, monotonic version, immutable APK hash, and production signer before asking Android PackageInstaller for confirmation. Installation is never silent.
What M2 does not attempt to be
M2 is not a public social network, permanent identity directory, or organizational system of record. It is deliberately narrower: a private, temporary path for coordination that should not be mixed with routine communication.
Create the right boundary for the work.
Start with the signed Android release or review the security model in more depth.