Media handling: metadata, originals, and what comes next Some technical notes on what we have been building. Metadata stripping is live. Every image published to the public archive is now served from a derivative with EXIF, IPTC and XMP removed. That matters because phone photos routinely carry GPS coordinates, camera serial numbers and timestamps. Consenting to publish your words is not consenting to publish your home coordinates. We audited all 57 captured files before building it and found no EXIF anywhere, because the SimpleX client re-encodes images before sending. That is somebody else's client behaviour, it can change in any release, and it was never a guarantee we were in a position to make. So we built the control regardless. The gate fails closed: if a file cannot be stripped, it is withheld rather than published unstripped. Four videos currently fall into that category because container-level stripping needs tooling we have not installed yet, and they are recorded as unstripped rather than assumed clean. Public media URLs are opaque identifiers, not filenames. Original filenames never appear in a URL, a page, a feed, a sitemap or structured data. Next: encrypted originals and hash-based screening. This is the harder part, and it is worth explaining why. We plan to screen every received image against databases of known child abuse material. The important detail is what that is not. No human reviews content, and no general-purpose AI analyses it. The only operation is a cryptographic comparison against hashes of known material, which returns a match or no match without anything being looked at. The complication is what happens on a match. The correct response is not deletion. A hash match is a signal, not evidence, and investigators need the unmodified original file to act on it. So the platform has to retain material it is not permitted to examine. That means originals held encrypted at rest, segregated, unreachable in normal operation, and released only through a defined legal process. That custody requirement, rather than the detection itself, is why this is uncommon among small providers. The large messaging platforms have run this for years. Direct access to the established hash-matching services has historically been out of reach for operators our size, though intermediaries have since made it accessible. Screening runs on every received image regardless of consent, because security and publication are separate questions. A file that is never published is still a file we received. Publication remains consent-gated as it always has been. To be clear about the current state: the storage architecture is being built now, no detection provider is connected, and nothing is transmitted anywhere. Hash matching also detects known material only, not new material. We will say it is active when it is active, and not before.