Lost or stolen device

What to do, what it fixes, and what it does not.

Do this now, from another device you still have: open Pollis, go to Security in the sidebar, find the missing device under Devices, and press Revoke. You will be asked to type the device's name to confirm.

This removes the device from every conversation you are in and rotates the encryption keys, so it cannot read anything sent afterwards. From its next request, our servers also refuse to talk to it.

While you are there, check Devices for anything you don't recognise and revoke it too. Someone holding your device unlocked who also knows its PIN can link a new device to your account by QR code, without your email; the link shows up in Devices and in your security events.

If that was your only device, skip to "If it was your only device". The answer there is more drastic.

What revoking actually does

Four things happen:

It is removed from every conversation's encryption group. Your device issues a removal for each group and DM, and each removal rotates the group keys. The removed device cannot derive the new keys, so it can never read messages sent after the removal lands.
It can no longer authenticate. Every request to our Delivery Service is signed by the device, and the server checks for a revocation before accepting the signature. Its cached key is evicted at revocation, so this applies from the next request, not after a timeout.
Its leftover credentials are deleted. Its unclaimed key material and its delivery cursor are removed in the same transaction, so it cannot be silently re-added to a group by material it published earlier.
Other members enforce it too. If your removal never lands (say you go offline mid-revocation), every other member's app re-checks the roster on launch and reconnect and performs the removal itself.

You cannot revoke the device you are using; log out instead. This is why a second device matters.

What someone holding the device can still get

Your existing history on that device: yes, if they get past the PIN

Revocation only affects the future. It cannot delete anything on a machine you no longer hold. There is no remote wipe, and even a cooperative device's sign-out leaves local data in place.

Messages on the device sit in a database encrypted with AES-256. Its key is sealed under a key derived from your PIN with a deliberately slow function (Argon2id), and the sealed blob is kept in the operating system's keychain. So the question is whether an attacker can read that keychain.

If they can (they know your login password, or found the computer unlocked), every four-digit PIN can be tried in under an hour. The app's ten-attempt limit stops someone typing at the screen, not someone working offline on a copy of the disk. If they cannot read the keychain, the database is just ciphertext and the history is safe.

So change your computer's login password and make sure full-disk encryption is on.

New messages: no

Once the removal commit lands, the device is outside the group and the keys have moved on. Until each member's app processes the removal, the device still holds the previous keys and can read anything sent under them. Online members close that window in seconds; an offline member closes it when they next open the app.

Encrypted traffic: a revoked device stops being served at all

After revocation the device cannot fetch anything, messages or metadata. Every Delivery Service request, reads included, is signed by the device’s key, and a revoked device’s signature is refused. The app holds no database credential to fall back on.

It keeps whatever it had already downloaded, in its local encrypted database.

Revocation does not notify your contacts

Safety numbers in Pollis identify a person, not a device: every device chains to one account identity, so you verify someone once rather than once per device. Revoking a device leaves that identity unchanged, so no safety number changes and nobody sees a key-change warning. If you want your contacts to know, tell them.

Your own security log does record it

Revoking a device writes a Device revoked entry to Settings → Security, alongside the enrollments and rejections already logged there, with the device name and time. That is how you confirm the revocation took effect, and it does not depend on the revoked device ever coming back online.

If it was your only device

There is no way to revoke a device from itself, and no second device to do it from. The only remaining path is a full identity reset from a new device, via the sign-in screen link "I've lost my Secret Key — reset my account". You confirm by typing your email address.

This is destructive:

Every other device is removed, including the lost one.
You leave every group and DM. Admins can invite you back; you do not rejoin automatically.
Your message history does not come with you. There is no key backup and no server-side copy of your history, so a new device starts empty. This is a deliberate limit: we never hold a key that could restore it.
Your account identity changes, so your contacts will see a key-change warning. Expect to re-verify with anyone who checks safety numbers.

The reset is gated on a one-time code sent to your email, so whoever controls your mailbox can trigger it. Securing that mailbox matters more than any setting inside Pollis.

If you think someone read your messages

Revoking handles the device. If you suspect someone had your account, not just your hardware, the reset above rotates your account identity. It is the stronger move, at the cost of your memberships and history.

If you have found a weakness in Pollis itself rather than lost a laptop, please report it privately through a GitHub security advisory; the machine-readable policy is at /.well-known/security.txt.