Sending a message later

Where the deployment allows it, you can write a message now and have it sent at a time you choose — the next working morning, after a deadline, at the start of a shift.

What the server learns

The release time, who you are, which conversation it is going to, and how big it is. That is the same four facts it learns from any message you send, plus the time.

The message itself is sealed before it leaves your device, exactly as a message sent now is, and the server holds those sealed bytes without any way to open them. When the time comes it stores and forwards them, still sealed. Nothing about this needs the server to be trusted with the contents, and nothing about it gives the server a key it did not have.

What is checked, and when

Twice: when you schedule it, and again when it goes.

The second check is the one that matters. Two weeks is long enough for you to have left the room, for a policy boundary to have gone up, or for the conversation to have been marked above your clearance — and a message written under one set of rules must not arrive under another. So the whole gate is run again at release, and a message that is no longer permitted is dropped rather than delivered, and you are told why.

Canceling

A scheduled message can be canceled any time before it goes. The list is in the composer, and it is your own: nobody else can see what you have waiting, including an administrator. What they could see is the metadata — that you have something scheduled for a conversation at a time — and nothing more, because there is nothing more.

Last changed 2026-10-06