Authentication & passcode
Signing in uses Firebase Authentication — this is your real account. The 6-digit passcode is an
additional local lock: it's hashed with SHA-256 in your browser before being checked, but hashing
alone does not make it a substitute for account authentication. Set it the first time you sign in,
and change or reset it any time from Settings.
Profile & Unique Search Code
Your profile has a display name, optional photo, and a Unique Search Code others use to find you.
Edit any of these from Settings → Profile. Your code stays constant unless you regenerate it.
Private chats
Search for someone by their code, open their card, and start a private chat. Only the two of you
can read it — enforced by Firestore Security Rules, not just the interface.
Groups
Create a group, name it, add members by their code, and manage roles. The creator is Owner.
Owners and admins can rename the group, change its photo, add or remove members, and promote or
demote admins. If an owner leaves, ownership must transfer first — a group is never left without one.
Reactions & forwarding
Long-press or right-click a message to react with an emoji or forward it to another private chat,
group, or Global Chat. A forwarded copy is authorized independently by its destination.
Presence, typing & disappearing messages
Online status and "last seen" are approximate, based on periodic heartbeats — not a perfectly
live signal. Typing indicators clear automatically after a short pause. Disappearing messages hide
content in the interface after the chosen duration; genuine deletion depends on server-side cleanup
(such as a Firestore TTL policy), not just hiding it on your screen.
AI Assistant
@AI_Assistant is a persistent, private thread — your history is saved per account and reloaded
when you reopen it. In production, your message is sent to a server-side function that holds the AI
provider's key; it's never placed directly in this app's frontend code.
Privacy & security limitations
Threadline uses client-side encryption where practical, Firestore/Storage authorization rules,
and hashed local passcodes. It is a demonstration architecture, not an audited end-to-end encrypted
system — group key distribution in particular is simplified. See Settings → Security for specifics
before treating this as suitable for sensitive communication.