End-to-end encrypted
Only the two endpoints can read content. No server, ISP, or relay operator can.
01
What it is
Two phones, an opaque relay between them, no plaintext anywhere off-device. You add a contact by scanning their QR in person — that’s the only step where you decide who to trust.
The relay only sees a per-install routing token and a padded envelope of a fixed size bucket. It does not know who you are, who you talk to, or what you say.
Text, photos and voice notes all flow through the same sealed envelope. Saved photos and your own albums stay inside the app under the same key — there is no “export to Photos” button by design.
02
Security properties
Your phone
Plaintext lives here. Keys live here.
Relay
Padded ciphertext + a routing token. No sender, no recipient handle, no content.
Their phone
Plaintext appears here. Keys live here.
The two endpoints know everything. The relay knows nothing it didn’t need to route the bytes.
Forward secrecy
Compromise of long-term keys does not compromise past messages.
Post-compromise security
A future compromise heals — messages sent after recovery are protected again.
Post-quantum hybrid
Handshake and ratchet combine classical X25519 with ML-KEM. Recorded ciphertext can’t be decrypted by a future quantum computer.
Sealed sender
The relay sees only a per-install token and a size-bucket — not the sender, recipient handle, or content.
Metadata minimisation
No directory linking handles to anything. No long-term registry of identities, recipient tokens, or device tokens.
Hardware-backed keys
Identity secrets are wrapped under the Secure Enclave and require Face ID / Touch ID to unwrap.
Per-bucket padding
Every wire envelope is padded to one of a small fixed set of size buckets — a network observer learns nothing from length.
Mnemonic root of trust
A 24-word recovery phrase you transcribe is the only path back to your identity. No escrow, no operator-mediated recovery.
Single active device
One identity, one device. Device migration is a sequential, end-to-end-encrypted handoff between your phones.
Biometric on every open
Face ID / Touch ID is required every time you open the app. A five-second grace from backgrounding allows silent re-entry; cold start always prompts.
Tor by default
The iOS app speaks to the relay over a hidden service via embedded Tor. Your IP never reaches the operator.
Activity status
Contacts see an “inactive” tag when you’ve been away for a week. The relay records the day you last fetched — no finer, no online/offline timeline.
The summary above is the visual précis. For the threat model, cryptographic primitives, the exact bytes the relay sees, and the honest list of known gaps, read the full security model →
03
Roadmap
Headlines only — later milestones layer features on top without weakening V1’s security model.
Availability. iOS is in public TestFlight with V1–V10 shipped. Android has the same V1–V10 shipped and is in internal testing — including in-app photos, voice notes, gallery, encrypted cloud backup, and cross-platform BLE proximity pairing. Want to help shake out the Android build before a public test track opens? Email to be added to the internal track.
-
Two phones, one trusted contact each. End-to-end encrypted text under the full security model — PQ-hybrid handshake, sealed sender, ratchet, padding.
-
A display name and avatar shared with already-verified contacts. End-to-end encrypted to the recipient set; the relay never sees them in cleartext.
-
Photo and voice messages captured and encoded in-app. Built-in gallery with custom albums; nothing ever leaves the device unencrypted.
-
Opt-in. Sealed on-device under a mnemonic-derived key; the cloud provider sees only ciphertext. Pick any folder — iCloud Drive, Dropbox, Google Drive, OneDrive — and restore on a new phone by pointing owned at the same file.
-
✓ delivered to relay, ✓✓ delivered to device. Contacts silent on the relay for over a week show as “inactive” with a confirmation before media uploads. Relay records the day, not the time.
-
Add a contact by holding the two phones together. Same trust gate as a QR scan: a mandatory mutual safety-code comparison after handshake.
-
Same single BLE GATT service spoken on iPhone and Android — iPhone↔iPhone, Android↔Android, and iPhone↔Android all pair via the same wire shape. Same mandatory mutual safety-code comparison as V6.
-
Long-press a message to mark it as the target of a reply. The next outgoing message carries a structured reference (by stable message id, not a content snapshot) so the recipient renders the quoted original inline above the new bubble. Deleting the original on either side cleanly breaks the back-link.
-
A dedicated in-app camera — photos and video — that writes straight into the encrypted local gallery, bypassing the system Photos library. Each item is sealed in its own file under a mnemonic-derived key, and gallery media can be sent into a chat without ever touching the system Photos library. Keepsakes that never leave the encrypted store, even when they aren’t being sent to anyone.
-
Short-lived photo and short-video posts shared only with the user’s verified contacts. End-to-end encrypted under the same sealed-sender envelope shape and per-recipient encryption as V2 profile-shares. 24-hour expiry on every recipient device and any transient relay state.
-
React to a message with a single emoji as a quick answer — a checkmark to confirm, a question mark to query — or insert emoji into typed text. The emoji set is bundled in the app and rendered on-device: picking or sending a reaction makes no network request and contacts no third party, so it carries no tracking.
-
Send animated GIFs and short clips. owned embeds no third-party search SDK and hosts no catalogue — you import a clip straight from a file on your device, or paste a link and owned fetches it for you over Tor so the source site never sees you. Clips are sent end-to-end encrypted and kept in an encrypted on-device library.
-
Extends V8’s message reply so the reply itself can be a photo or a voice message, not only text. Reuses V3’s media payloads and V8’s by-stable-id reference — no new envelope shape.
-
Open more than one chat with the same contact, each with its own user-chosen topic label. Each topic chat is an independent end-to-end-encrypted session — its own PQXDH bootstrap, its own ratchet state. Free for both sides.
-
One-off in-app payment using unlinkable tokens — the relay can verify “this caller paid” without learning who they are. Establishes the payment infrastructure that V16 and V17 reuse.
Paid milestone
-
Up to 20 members. End-to-end encrypted under a group-suitable PQ ciphersuite; the relay can’t tell a group send from a 1:1.
Paid milestone
-
Video on the 1:1 channel (and groups, once V16 has shipped). Captured and encoded in-app, sealed-sender envelope shape.
Paid milestone
04
Public relay stats
Aggregate user-content message counts (text + photo + voice) plus total bytes in/out. No recipient, sender, or per-kind breakdown is exposed publicly.
Messages
—
last 30 days
Bytes in
—
last 30 days
Bytes out
—
last 30 days
Per-day breakdown
| date | messages | bytes in | bytes out |
|---|