Z has no accounts, so there is nothing to log into and nothing for a server to hold. Everything below happens on the two devices in a conversation; the relay is a dumb, forgetful post box in between.
When you first open Z it generates two key pairs on the device: one for signing, one for key agreement. They are written into an encrypted vault whose key lives in your operating system's keystore. Nothing is registered anywhere. Your address on the relay is a hash of your public key — a mailbox ID, not a name, not a number.
Each envelope arrives sealed: an anonymous outer layer addressed to the recipient's mailbox, with the sender's identity inside the encrypted payload. The relay cannot tell who sent it. Envelopes are padded to fixed size buckets, so their length says little about their contents. Queued mail is held in memory only, dropped the moment the recipient confirms it, and expires within 72 hours regardless.
The relay never writes to disk — its code is tested to contain no disk-write calls. Queued mail lives in memory: the relay's own, or, where a deployment runs more than one copy behind one address, a shared store the host also keeps in memory with saving switched off. Restarting that memory erases everything it held.
A group has no group key. Each message is encrypted separately to each member over the same one-to-one sessions, so group traffic inherits the same forward secrecy and each envelope is indistinguishable from direct traffic at the relay. The burst of them is not: every member's mailbox receives its copy within a fraction of a second, every time, and a relay that keeps timestamps can work out which mailboxes belong together — we measured it, and the threat model says so (R18). Files and voice notes are encrypted once under a random per-file key that travels inside the conversation, then relayed as fixed-size chunks.
A compromised device. If someone controls your phone, encryption in transit is beside the point — they can read what you can read. Disappearing messages and the encrypted vault protect a lost or seized device, not one running someone else's software. Timing. The relay never learns who sent an envelope, but it sees when each mailbox is busy, and mailboxes that are always busy together — a group's members, one person's phone and laptop — are groupable from that alone. We state the limits plainly on the security page.