Messaging

Screenshot pending — see prompt sync-sf-ios-screenshot-capture.md.

Starting a private message

To send a message to another member:

1. Tap the compose button in the conversation list.
2. Select a member from your organisation’s approved member list.
3. Type your message in the input field at the bottom of the conversation.
4. Tap Send.

Your message is encrypted on your device before it leaves. The recipient decrypts it on their device.

Group messages

Group threads appear in your conversation list like private threads. To send a message to a group:

1. Open the group conversation.
2. Type your message.
3. Tap Send.

Each member device receives its own encrypted copy of the group message. SemaFore does not use a shared group key for group threads.

File sharing

To attach and send a file:

1. Tap the attachment icon in the message input area.
2. Select a file from your device.
3. The file is encrypted on your device before upload.
4. Complete the send action to deliver the file.

Encrypted draft and pending-send continuity

SemaFore stores unfinished message text and attachment drafts encrypted on your iPhone. Attachment bytes, filenames, and file types are protected with the draft rather than left as readable continuity files. These records are excluded from device backup.

Drafts survive ordinary session renewal and same-subject reauthentication, so an expired access session does not discard work in progress. A pending encrypted send can also resume after the app reconnects.

Drafts are removed when you clear or successfully send them. Pending-send records are removed after completion. Both are deleted during current-device retirement or confirmed different-subject recovery; they cannot be restored from the server after that destructive reset.

Broadcasts

Broadcasts appear in your conversation list, marked as broadcasts. Broadcasts are read-only. Organisation administrators send them to all approved members, and members cannot reply inside the broadcast thread.

For the portal workflow that sends broadcasts, see Broadcast. For the delivery model behind them, see Broadcast Messages.

Delivery and read state

SemaFore shows message delivery state in private threads. Delivery and read receipts are metadata-only events; they do not change the end-to-end encryption model or expose message content to the server.

If your iPhone was offline when the recipient read a message, reopening SemaFore reconciles the saved receipt state and advances the tick automatically.

Notifications and quick reply

You can open a thread by tapping its notification. Where iOS supports it, you can also send a quick reply directly from the notification surface.

If a notification belongs to a different organisation from the one you are currently viewing, SemaFore switches into the correct organisation before opening the thread.

Thread actions

You can mute a thread if you do not want visible notifications for it. You can also pull to refresh the conversation list or a thread view to force a sync if you suspect you are missing recent activity.

What the server can see

The server receives only encrypted messages and the routing metadata needed to deliver them. Your message content and file attachments are encrypted on your device using the Signal Protocol. The server cannot decrypt or read your conversations.

Multi-device behaviour

A single account can be active on multiple devices. Each recipient device receives its own encrypted copy of every message.

This means:

• adding a second device does not decrypt older content from your first device onto the new one
• revoking one device does not revoke the entire account
• delivery state is tracked per device copy, not through a shared plaintext mailbox

Message expiry

If your organisation has a message-retention policy, expired content is replaced in the conversation view with a placeholder:

• [Content removed] for expired message text
• [Attachment removed] for expired files

Message storage