Later,
together.
Relay is a group time capsule with a promise you can check. Everyone seals their piece now. BOT Chain records who agreed, to which date and rule, and exactly when it opened.
The media never touches the chain. Only hashes, consent and the rule do.
Sealed capsule · Class of '26
Example1,826 days
Opens 12 Jun 2031 · chain time 1938988800
- 0x3f2a…a91cSealed ✉
- 0x8b10…04deSealed ✉
- 0xc7e4…77f1Consented ✓
2 of 3 contributions · unanimous consent · 2-of-3 release receipts
How a Circle works
Write the rule first
Pick the open date, how many contributions it needs, and whose consent counts — before inviting anyone.
Everyone consents on-chain
Each member signs the exact rule hash. Once someone else consents, the creator can't change a digit.
Encrypt, then commit
Letters, photos, voice memos, video: encrypted on your device. Only a 32-byte hash reaches BOT Chain.
The contract decides
On the date, anyone can ask. The contract checks its stored rule and either rejects or records eligibility.
Receipts, then the reveal
Relayers deliver key shares only after eligibility is on-chain, and each records a receipt. Enough receipts, and it opens.
The line between chain and you
On BOT Chain, readable by anyone
- The rule: dates, contribution count, consent mode, relayer quorum
- Member addresses, and who consented to which rule hash
- A 32-byte hash per contribution — never the contribution
- Release eligibility and every relayer receipt
- Public-key fingerprints
Never on-chain
- Messages, photos, audio, video
- File names, captions, the Circle's name and description
- Encryption keys and key shares
- Contact details and notification settings
- Anything you show the Memory Steward
Proof, at the rung it has reached
Full claim ledger →Every public claim has a status and the evidence behind it. Nothing below says more than its evidence does.
Mainnet deployment exists
Deployed on BOT Chain mainnet at 0xb565bd5875ae429f2ebca9e69e202407021c6d62 (block 24607284), source verified on scan.botchain.ai. Deployed under an owner override: testnet gates T3 and T6 and the independent security review were not complete.
Evidence →Release policy is immutable after consent
Tested locally: once another member consents, the contract rejects any change to the rule.
Evidence →An ineligible release is rejected
Observed on BOT Chain testnet: early release attempts reverted on-chain — while contributions were open and after sealing but before the release date — and the verifier trace shows release was recorded only after the rule was true.
Evidence →The capsule lifecycle is independently replayable
Verified on BOT Chain testnet: the open-source verifier replayed every capsule on the deployed registry from the public RPC — all VALID, bytecode matching the audited build — without Relay's servers.
Evidence →Member payload is absent from contract events
The protocol does not store plaintext payload on-chain: contract events carry only ids, addresses, counts, timestamps and 32-byte hashes, and the BOT Chain testnet proof run found no plaintext in any registry event.
Evidence →Testnet deployment exists
Deployed on BOT Chain testnet at 0x6f6e2c0fb44016d621e133612c61069de15cd710 (block 24389826), source verified on BOTScan.
Evidence →Built for the moment, measured by the chain
Consent you can point to
Who agreed, to which rule, and when — as events anyone can read, not a screenshot.
Encrypted before upload
AES-256-GCM on your device. Storage holds ciphertext; the chain holds its hash.
Threshold release
Each content key is split k-of-n across relayers. No single relayer can open a capsule.
Independent verifier
Open-source replay of every event from any RPC. It needs nothing from Relay's servers.
Memory Steward, opt-in
Prompt ideas and reminders from your theme — never your content, never your keys. Off by default.
Honest about delivery
Eligible but short a receipt? It says exactly how many are missing, and doesn't call it released.
What Relay does not promise
Relay makes a promise measurable: the rule, the consent and the release are on a public record that can't be edited later. It cannot stop someone who kept their own plaintext, and a threshold of relayers acting together could reconstruct a key before the date. Today every relayer is run by the Relay project, so they are labelled PROJECT_BASELINE — not independent. We print this here so nobody has to find it.
Seal something for later.
Two people and a date are enough. You'll see the exact rule before anyone signs it.
Start a Circle →