A lot of what makes messaging feel human isn’t the messages. It’s the small acknowledgements around them: the tick that says it arrived, the little heart on a photo, the unread badge that quietly updates while you’re looking at it. We’ve added all three, and the interesting part is that each one had to obey the same rules as everything else.
Reactions are messages too
When you react to a message with an emoji, that reaction is encrypted with the conversation’s key, just like the message it’s attached to. It isn’t a flag we store in the clear on our side; it’s content, and we treat it as content. The same goes for replies and edits — a reply carries an encrypted reference to what it’s answering, and an edit replaces the ciphertext rather than logging your earlier wording somewhere we can read.
That sounds almost pedantic for a thumbs-up. But the moment you make an exception “just for reactions,” you’ve built a second, weaker path through the system, and weaker paths are exactly where things leak.
Read receipts, between recipients
Read receipts in Shoal are per message, and they live between the people in the conversation — the same place admin oversight already sits. When a recipient’s device has seen a message, it records that against the message for the others to see. There’s no separate surveillance channel; it’s the recipients telling each other, cryptographically, what they’ve read.
Counts that update while you watch
Unread counts used to need a refresh to be right. Now each device keeps a quiet background connection open, so when a message arrives in a conversation you’re not looking at, the badge updates in real time, the conversation list re-sorts to put the freshest thread on top, and the timestamps tick over on their own. It’s a small thing that removes a small, constant friction.
Some honest limits
Read receipts are a shared social contract — they tell the people you’re talking to that you’ve seen them. They’re not designed as a one-way mirror, and a family that finds them stressful can simply not lean on them. Reactions are deliberately a short, fixed set rather than an open field; it keeps the feature calm and keeps the ciphertext small.
How this fits with everything else
Because reactions and receipts are ordinary content, admin oversight sees them the way it sees messages, push notifications can carry them, and they survive going offline along with the rest of the cached conversation. The security page covers what’s held encrypted and where.
Try Shoal, and tell us what feels off at [email protected].