The manual
nobody ships.

Each device holds two private keys that never leave it: a P-256 key and an ML-KEM-768 seed. For a new direct message, a fresh ML-KEM contribution is encapsulated to both participants and mixed with a P-256 ECDH secret through HKDF-SHA-256.

The result encrypts the message with AES-256-GCM and adds an HMAC-SHA-256 check. Attachments are encrypted before they are uploaded, not after they arrive.

The server still stores the sealed box, who it is addressed to, and when it was sent. That is how your second device catches up, and it is also the honest edge of the design.

Your P-256 private key and ML-KEM seed are bundled and sealed on your device with a random 256-bit recovery key, HKDF-SHA-512 and AES-256-GCM, then uploaded already encrypted. Restoring needs that recovery key. A correct password on its own will not do it.

Backup format v5 binds its version and cipher suite into the authenticated data. Older hybrid v4 backups still restore, and are upgraded once they do.

You can compare public-key fingerprints with the person you are talking to, over some other channel, to catch a key that changed when it should not have.

Lose the device and the phrase together and the old direct-chat ciphertext stays closed. No support ticket reverses this. That is the actual price of a server that cannot read your messages.