Everything this cannot do, in one place.
This used to be a paragraph repeated in the footer of twenty-five pages. A caveat printed twenty-five times is a caveat nobody reads, so it is one page now, argued rather than recited — and it is the page we would read first if we were you.
Avano is pre-release software. These are the six things that costs you.
Nobody independent has reviewed our code.
libsignal — the cryptography we build on — is published and has been formally analysed by independent researchers. Our own additions are not, and that is where every distinctive claim on this site lives. An external audit is on the roadmap; until it happens we will not imply an assurance we do not have. "Built on analysed cryptography" is not the same sentence as "audited".
The source is not published.
The repository is private. A LICENSE file carrying the full AGPL-3.0 text was added on 29 July 2026; until that day the licence existed only as a metadata field in thirty-five build manifests, which grants a reader nothing at all. That is fixed, and it does not make the source public — the two are separate, and only the second one matters to you. Until the repository is public, every architectural claim we make is one you take on our word, including the ones we are proudest of. The app's own trust screen reads Open-source · PLANNED and this site agrees with it. Publishing is the single change that would move most of the proof page at once.
One open licensing question, since we found it ourselves and it is not resolved. We declare AGPL-3.0. libsignal, which supplies every piece of our message cryptography and is not optional, declares AGPL-3.0-only. The or-later half is a grant we may not be entitled to make over a combined work that links it, which would mean our own declaration claims more than we hold. Which position is correct is a question for counsel rather than for an engineer, and it is on the register of things counsel has not answered.
This is our weakest link, and we know exactly why.
The build is hand-made, signed with a development key, delivered by hand, with no published hash and no public log. We are not in an app store, there is no update channel, and there is no way to revoke a bad build — including ours. Every comparable service that was broken was broken here: one through a pushed update, one through its distributor, one through the administrator's own software updates. Not one went through the cryptography.
One relay runs. A second is planned, not deployed.
Relay one is in Germany. A second relay ran in Iceland — a different company, network and jurisdiction — and was deliberately allowed to lapse in early August 2026. The app never dialled it: it pins a single relay. A diverse-jurisdiction second relay, sited outside Europe, is planned but not deployed. A liveness claim in the present tense is exactly the shape that goes stale without anything failing — this very page used to say "two relays exist" after one had already lapsed, which is the mistake it now warns about.
The routing that splits the two sides of a conversation across two relays is written and is not switched on, so today one legal order reaches one operator and that is sufficient. When you pair with someone, both Android and iOS tell you whether the split protects that conversation (today: one relay) rather than letting you assume it, and the Shield shows the relay count.
Anonymity is a property of a crowd, and ours is small.
This is the one weakness on the page that no engineering closes. A large, boring population to hide inside is worth more than most mechanisms, and the largest messengers have one. We do not, yet. Growth is the only fix and we are not going to pretend it is a feature.
The interface is rendered by the system web view, not written in native code.
A web view is a wider attack surface than a native UI, and against an adversary who already runs code on the device — commercial spyware of the Pegasus and Predator families — that is a real cost of how the app is built today. Under that adversary every messenger reads the plaintext after decryption anyway, so it changes the price rather than the outcome. It does change the price.
What the phone gives up, and what it does not.
The honest answer has two halves and the second one is not comfortable.
If the app was locked
Message bodies, identities, session state, the contact list and group membership are sealed and stay sealed. The seal key is an Argon2id entanglement of a device-bound key (the Android keystore; on iPhone a this-device-only Keychain item) and your passphrase, so extracting the device key on its own yields nothing.
What it still gets
The whole-file encryption our own specification mandates is not in use — the vendored build fails on our target — so per-column sealing is what protects the contents and it can never protect the container. A lab reads the schema, the table names, the indices and the row counts. Row counts are not nothing: they say how many contacts you have and how many messages you exchanged. Beyond that, a small list stays readable by design, because the code needs to compare or sweep on it: your account public key, prekey identifiers, a per-contact device identifier, message sequence numbers, and expiry timestamps quantized to fifteen minutes; and, for the vault, when each item was created (to fifteen minutes) and how many items of each unnamed kind it holds.
So the accurate sentence is: the contents of the database are sealed; the shape and volume of it are not.
And “locked” has three states, not two
This is the half people miss. Once you turn on message alerts, which ship off, Avano can ring you while it sits in your pocket (the setting that does this, “Ring me when Avano is in my pocket”, is on by default), provided Stay connected, which also ships off, is on too; and it shows who is calling only once Android lets it take the screen. To do that it has to be able to open your messages at that moment — so while Avano is merely backgrounded, the key to your messages is in memory, for up to 24 hours before it is dropped and the next open asks for your passphrase.
What that changes, precisely:
- Phone off, or not unlocked since it was switched on: nothing. Unchanged.
- Screen locked, Avano not running: nothing without your passphrase. Unchanged.
- Avano open on screen, then idle for two minutes: the key is dropped. Unchanged.
- Avano merely in your pocket, with message alerts on: the key is in memory, for up to 24 hours. A lab that can read a running phone’s memory — which needs only a phone that is switched on and has been unlocked once since it last started, even with its screen locked now, not one that has been off or restarted since — gets the store: messages, contacts, session state.
You can switch this off. It is the “Ring me when Avano is in my pocket” row in Shield, and turning it off means your phone will not ring at all while Avano is closed — not a quieter ring, no ring. That is the trade, and it is yours to make rather than ours to make quietly.
This is the same trade written out in docs/RINGING.md §8, which is the internal record of the decision. It is repeated here because a decision about what a phone in someone else's hands gives up belongs where the person carrying the phone can read it, not only where the people who built it can.
The engine contains a duress passphrase that wipes and opens an empty decoy, and a wipe-after-N-attempts counter, and the app arms neither: you cannot set one, and a wrong passphrase is met with a growing wait, never a wipe. Neither is ready to be trusted under pressure. Both are gated on an unauthenticated sidecar file, so deleting that file disables the defence and nothing records that duress was ever armed. Worse, the decoy is distinguishable: the sidecar vanishes, and because the duress path skips the attempt counter the decoy database's modification time is far newer than its own key header, which never happens on a genuinely fresh account. A detectable decoy under pressure is worse than none, which is why this paragraph exists instead of a feature bullet.
And nothing here protects you from being made to unlock it. No app can do that. The passphrase lock protects a phone that was put down; it does not protect you from a person, a border officer or a court. Once code runs on the device with the app's privileges or above, it reads the message after decryption — the same way it would read any messenger, or photograph a notebook.
If somebody subpoenas your backup instead of your phone
This is the same data reached from the other end, and until 12 August 2026 the answer on iPhone was worse than the answer for the phone itself. The store file sat in a directory iOS includes in iCloud backups by default, so a copy went to Apple. It is now excluded, and so is the Tor state beside it. On Android nothing was going to Google — but the separate lever that governs phone-to-phone transfer had never been pulled, and it has been now.
What a copy of a backup would have yielded, stated at its real size. Not your messages: the key that opens the store is bound to the device (the Android keystore; on iPhone a this-device-only Keychain item) and is in no backup, so a backed-up store is ciphertext nobody can open, us included. What it did yield needs no key — that Avano was installed and used, how big the store was, and that Tor was running on that handset. For some people the last of those is the dangerous one, which is why it is written here rather than counted as a detail.
The part no setting can fix. Your app store knows you installed it. That record is in your Apple or Google account, not on your phone, and no choice inside Avano reaches it. If the fact that this app exists on your phone is itself the risk, read what the phone gives up and then the app's own If you are in danger screen — the answer there is about the phone, not about a checkbox.
A RAM image captures the present. A disk image captures the past.
That sentence is why our relays write nothing to a disk, and it is also the honest statement of what that buys and what it does not. A warrant for the disk returns nothing and a subpoena for backups returns nothing, because there is nothing there. A copy of the running machine's memory is a different question. It yields the queues that exist at that instant: sealed, identical-size blocks under random codes, with no sender field, no account and no link between two queues — but it is a real capture and we are not going to describe it as an empty one.
What a relay can still work out over time, without decrypting a byte, is the honest residue of the design. It sees roughly an eighth of your inbound queues on each of your eight connections, and because connection co-occurrence only accumulates, it learns each leg's whole membership within a few polling intervals — no amount of timing work undoes that. It gets the complete set back at every lock and unlock boundary, which is now the largest single piece. And a relay that is also watching a burst of file chunks arrive back-to-back can group them and estimate the file's size, even though nothing it stores says which pieces belong together.
A court can order an operator to start logging. It cannot order us to produce what was never written down, but it can order the next version to write it down. That is a real limit of any hosted design and the intended mitigation is structural rather than promissory: two relays under two companies in two jurisdictions, so one order reaches only one of them. That mitigation is not in force today — one relay runs and the app dials it, and the second is not deployed; see the split row above. We do not run a warrant canary, deliberately, and the reasoning is published.
And there is a second relay, for calls, which is worse
Everything above is about the relay that carries your messages, and it is the one we are proud of. Calls use a different machine and it does not have those properties. Voice and video travel as ordinary internet traffic to one relay, so while a call is up that relay sees both people’s IP addresses at the same time, knows they belong to the same call, and can work out how long it lasted. Not from a log — it writes none — but from the way the call is put together, which is not something a retention policy can change.
It cannot hear anything. The audio and video are encrypted end to end and that relay holds no key, so what it has is who spoke to whom, when, and for how long. For some people that is the part that matters, and it is the one place where this product does the thing it otherwise refuses to do.
There is also something a relay is not needed for at all: the counter in each packet’s header is not secret — the standard says so — and it counts up as the call runs. Anyone who captures a single packet anywhere along the way can tell how long you have been talking, without touching our machine.
What we would have to do to fix it, so you can judge whether we are likely to. The call would need two relays run by two different companies, one for each side, so that neither one ever holds both addresses — two boxes rented by us are one company and one court order, and would not count. We have designed it, we have not built it, and it needs a second operator we do not yet have. Until then this paragraph is the honest answer. If it matters for a particular conversation, send a voice note instead of calling — voice notes go over Tor like your messages, so no machine of ours ever sees your address.
The attack that defeats every deployed messenger, including this one.
An opponent who can observe the network at both ends of a conversation confirms it by timing alone, without reading a byte and without breaking anything. They watch your link, they watch the other person's link, and they correlate. Tor does not stop it, cover traffic does not stop it inside a session, and no messenger that has ever shipped stops it.
We say this here rather than let you discover it, because the people this product is for are exactly the people who might have such an opponent. Avano minimizes metadata by design. It cannot make anyone anonymous against every adversary, and we will never call it untraceable, invisible or anonymous — those words are false, and every operator who marketed one was prosecuted for the posture rather than the code.
An overstated security claim is worse than no claim, because a user acts on it.The rule this codebase's engineering documentation is organised around
Built, tested, documented — and called by nobody.
This is our characteristic failure and we would rather name it than have it discovered. A defence gets designed, implemented, documented and covered by a passing test — and nothing in the shipping app ever calls it. The tests pass because the tests call it. On one day in July a single review found eighteen instances.
There is now a guard that fails the build when a security module has no production caller, and it has itself been corrected three times by findings from outside it, because a check is not self-validating. Here is what is currently in that state and reachable by no app:
Each contact already reaches you on a different private queue, so no relay sees one address that is you. Those queues now rotate. After every sixty-fourth message a contact’s queue is retired and replaced, on the same rule in every install — a per-account cadence would itself be a distinguisher for a relay watching queue lifetimes, so it is not a setting you can change. It runs off the drain that already happens, so it costs one extra block on the wire and no new pattern.
Stated exactly: this ran on Android only until 2026-08-28, and this page said it ran nowhere — which was wrong in the direction that understates the app. It is on both phones now. The predecessor key is kept for one rotation so a peer’s in-flight mail still opens, and while it is held physical access still opens what was recorded under it; that is why the rule is not faster.
Written, machine-checked, and not switched on. The app hardcodes one relay and no signed directory is published, so relay selection degrades to the pinned relay on every open — honestly, and by design, but it degrades.
An authoriser can now remove a member, and every other device stops addressing them — a removed member's queue gets nothing. But there is no group key to rotate, so this is roster agreement, not cryptographic post-compromise security. Separately, the membership graph leaks over time: repeated deposits into stable queue ids within milliseconds recover group size and membership over a few hundred messages. With cover traffic on, the default, a group message leaves one member block per thirty-second slot rather than as a burst; with cover off or cooling down, and for the pieces of a file, deposits still burst, and giving each recipient a separate connection is not built.
Every message carries a franking commitment the recipient re-checks, which binds honest senders using the stock client. It does not bind a malicious one: a modified sender that simply omits the commitment is accepted as unfranked. Closing that needs franking to be mandatory once the fleet has moved.
iOS compiles, builds, installs and runs — it has since 24 July 2026. iOS was last compiled on 7 September 2026; the Mac it builds on is stopped, so the iPhone changes made since (the vault and sharing, receive-side shaping, being asked before joining a group) are written and not yet compiled. A nightly build on our own server checks the Rust engine; nothing checks iOS in between, and iOS is verified by hand, on a rented Mac, per session, with nothing re-checking it in between. Read any iOS claim as verified on request, not as continuously verified.
What works today, and what does not.
| Capability | Android | iOS | State |
|---|---|---|---|
| One-to-one messaging over the network | Runs | Runs | Live |
| Pairing by one-time sealed link | Runs | Runs | Live |
| Post-quantum handshake and ratchet | Runs | Runs | Live |
| Tor for every message (calls excepted) | Runs | Runs | Live |
| Cover traffic, free, on by default | Runs | Runs | Live: constant-rate polling and constant-rate sending with decoys; receive-side shaping (how much arrives per poll) is built on both phones behind a switch that is off by default, and relay-1 has served it since 23 September, and since 26 September with both corrections deployed: a check of one queue is no longer shaped by mistake, and the acknowledgement after a shaped check is the same whether or not mail arrived |
| Sealed store, passphrase lock, auto-lock | Runs | Runs | Live |
| Recovery helpers (identity and contacts, never messages) | Runs | Runs | Live; the whole day ran on a device on 2026-08-31 |
| Move to a new phone (local network, a typed code) | Runs | Runs | Live; driven between two Android systems on 2026-08-29 |
| Disappearing messages | Runs | Runs | Live |
| Long messages | Runs | Runs | Live since 28 October 2026: every message is padded to one fixed size, so its length says nothing, and one message carries about 1,800 bytes of text (about 900 characters of Romanian with diacritics); a longer text goes as several messages, in order, cut between paragraphs. Before that day a longer text was refused. A message sent later, a message to a broadcast list and an edit are each one message and cannot be cut, so past that size Avano says so before anything is sent and you shorten it; before that day they failed later, in technical words. Run on an Android emulator; on an iPhone the same page does it, not yet compiled there |
| Small groups (max 32) | Runs | Runs | Live; add / remove / rename / transfer, and someone added is asked before they join (on iPhone that question is written and not yet compiled) |
| Files and photos | Runs | Runs | Live; photos and videos are cleaned of location, camera details, recording time and other metadata (a video's recording time since 25 October; before that it kept it), other files are sent as they are. Since 25 October a photo or a video leaves under its kind (photo.jpg, video.mp4), not under the name the gallery gave it, which often says when it was taken; a document or a sound keeps the name you see, so a name you wrote into it is sent as you wrote it. A video over 25 MB (8 MB to a group) is offered a smaller copy made on the phone, 720p or lower, from the picker or from a gallery's Share, on Android since 25 October, and a video too long for even the smallest copy is offered the longest part that fits, which you move along it or make shorter, and a shorter part can go sharper; on iPhone such a video is still refused. Since 25 October on Android a photo or a video carries a small blurred placeholder of itself (some thirty characters, worked out on the sender's phone from her own copy), to one person, to a group (every member's copy) and in an album: the other phone draws its shape and colours from those characters before anything is fetched or opened, and decodes nothing of the sender's to do it. Not yet from an iPhone, and never on a phone with hardened media on. Since 26 October on Android you choose a picked video's cover before it is sent: what travels is the second you chose, never a picture, and the other phone makes its preview from that frame when it opens the video |
| Camera inside the app | Runs | Runs | Live; the photo is stripped like any attachment |
| Voice notes | Runs | Runs | Live; no real phone has recorded one on iOS |
| Video notes (twenty seconds; recorded in memory on Android, and on iPhone into a protected temporary file deleted as soon as it is read) | Runs | Runs | Live; measured between two emulators on 2026-09-06. Since 25 October on Android a note is recorded square and plays in its circle inside the conversation, a video's card shows a frame of it, and a video of 8 MB or less plays in its card, without handing it to another app, and where a time in its caption (1:23) is a mark that plays it from that second; a larger video still opens in the phone's own player. On iPhone the player is written and not yet compiled |
| Location, one approximate fix, only on request | Runs | Runs | Live; sent once as a sealed message, never to us |
| The vault (documents, own passphrase) | Runs | Written | Live on Android; on iPhone written and not yet compiled; created, shared and imported into on an Android emulator on 2026-09-23 and 24 |
| Several accounts on one phone | Runs | Not yet | Live on Android since 25 October: add an account with its own words, passphrase and contacts; the lock stays one passphrase box and the passphrase you type opens its account; one account is open at a time, so two are never on the relay together, and alerts come for the account opened last. No screen says how many accounts there are; someone who reads the phone's storage can count them. Each account can be erased alone with its passphrase, and "Erase everything" erases them all; the two rows read the same in every account. Run on an emulator over a test relay |
| Document scanner (pages to one PDF) | Runs | Not yet | Live on Android since 2026-10-25: four corners per page, straightened on the phone, one PDF with no record of the phone, the place or the time (checked with qpdf, pdfinfo and exiftool on the PDF a second phone received, on an emulator over a test relay); on iPhone not built yet |
| Languages other than English | Not yet | Not yet | Every build is in English: no translation exists yet. Since 25 October the Android app can draw its screens in the language it runs in, the phone's, or one chosen in Avano's own settings (kept sealed with its other settings, so the lock screen stays in the phone's language and says nothing of the choice), from a list of sentences the app carries, none downloaded, and it has been run that way on an emulator with a test language that brackets every sentence. So far the sentences of the page's own layout, every short notice and error it shows, and nearly all of the rows, buttons and fields its code builds go through it, more than nine in ten of the sentences its code writes, the option lists it builds as it starts included (most of the rest are words the other phone reads inside a message, which stay English on purpose), and the sentences that change with a count (1 chat, 5 chats) take the plural form a language asks for, four in Russian, six in Arabic, rather than English's two; the rest are next, and the app has been run in the test language on an emulator, pairing and messaging as before. A language ships when every screen it reaches has been converted and someone who reads it has read it, and a right-to-left one has its layout mirrored for it already |
| Per-conversation split indicator (a banner when you pair) | Runs | Runs | Live; today it always says one relay |
| Two-relay routing | Runs | Runs | Built, dormant: it chooses and follows a second relay per contact once a signed directory verifies on the phone; until then every conversation rides the one relay, and the banner says so |
| Channels and communities | Runs | Runs | Built on both phones and driven end to end with two headless clients against a metered relay; the relay serving today refuses the channel verbs until it is redeployed (infrastructure) |
| Finding people by email, phone or username | Runs | Runs | Built: the verifier, the blinded lookup and the backup card, tested in process; the directory daemon is not deployed, so no phone can reach it yet (infrastructure) |
| Teams: a company seat on the Shield screen | Runs | Written | Built; run end to end on two Android phones on 2026-10-20 against a relay built from the source over a plain connection (a code redeemed, a seat pasted, both inboxes bought after the token age clock, a message delivered), and as a scripted smoke with the headless client; not sold (infrastructure) |
| The App Review companion (the account a store reviewer pairs with) | — | — | Built; ran for the first time on 2026-10-20 on the rented machine: one Android phone paired with it over a plain connection, wrote, and read its fixed answer. Running it for a submission is an operations step not yet taken |
| The protocol specification and its known-answer vectors | — | — | Published in the source: the specification, and sixteen vector files computed by the shipping code and held equal to it by a test, for a second implementation to check its bytes against |
| A second network from one profile file (sovereign deployments) | — | — | Built: every pinned address and key in one file, generated into both apps, the engine and the page, held by a guard; a deployment on another organisation's relays and keys is a second file. No such deployment exists |
| Prove this account is yours (identity attestation for a site or an app) | Runs | Written | Built on both apps' bridges and the page: a statement signed with your own keys for one party and one challenge, checked by that party from the bytes alone; a library and a published vector for anyone who verifies. No party has integrated it yet |
| Cards from a bot (buttons, fields; no third-party code) | Runs | Written | Built on the page both apps share: a program sends a card as text, the app draws it, a tap sends one message back. Scripted mini-apps are not built and need a decision |
| Headless client and bots | — | — | Built: the same engine from a command line, over Tor or to a local relay; an echo bot and an external-command bot (infrastructure) |
| Address rotation (per contact) | Runs | Runs | Live; every 64 messages, off the drain |
| QR pairing and code scanning | Runs | Runs | Live; no real phone has scanned one yet |
| Message search | Runs | Runs | Live; searches by decrypting, keeps no index |
| Voice calls (one-to-one, relayed) | Runs | Built | Live on Android: measured between two emulators through the deployed relay; since 2026-10-27 the phone is put in its call mode for a call (until that day Android refused it in silence, so calls ran in the media mode), and with message alerts on a call is still heard when the screen goes off or you switch apps (until that day Android silenced the microphone then; measured between two emulators); with message alerts off, which is the default, Avano locks when it leaves the screen and the lock ends a call in progress; and with a headset connected the Speaker button lists the phone, wired headphones and Bluetooth by kind, never by a device's name (the headset half is not yet measured on a device); iOS compiled and not yet heard on a device |
| Video calls (one-to-one, relayed, constant rate) | Runs | Written | Live on Android since 2026-09-24: measured between two emulators through the deployed relay, both pictures decoded; since 2026-10-26 a voice call turns to video in place, the same call, after one person asks and the other agrees (the relay sees a video leg start), also measured between two emulators; since the same day an ask that went unanswered for its 30 seconds can no longer turn the other person's later ask into an open of the camera, and a call whose video ended (Audio only, or the other phone's video gone) is a voice call again that can turn to video again, both measured between two emulators; since 2026-10-27 a video call can be minimised to the chats with your camera off and brought back to the same screen, and its screen has its own audio button, measured between two emulators; the same day the voice call screen was pressed by touch on two emulators, which found the way back to a minimised call hidden under the Tor status line and a Mute that could wait up to four seconds behind other work, both fixed, and the other person's ask to turn video on is drawn over the call screen and answered by a touch, also measured between two emulators (until that day it was drawn under it, so it never showed and could not be answered); on iPhone not built yet (the engine carries the video flag; an iPhone answers with sound only) |
| Push service · backup · public channels | — | — | Refused |
| Build signing key | Debug key | — | Pre-release only |
| Independent security audit | — | — | None yet |
| Published source | — | — | Not yet |
| App store distribution | — | — | Not yet |
Three sentences this table exists to keep true. A capability is only Live if a shipping app reaches it — an engine that can do a thing and an app that calls it are different claims, and confusing them is this project's signature defect. Refused and Not yet are different columns, and the difference is on refusals. Nothing moves up a bucket without something outside the module confirming it.
How fast it is, how often it is there, and who can use it.
Service quality
- No service level is promised. Avano is pre-release, one relay carries every message, and it can be interrupted; the terms say so.
- How long a message takes. Measured on 2026-08-29 between two Android emulators over the deployed relay through Tor: about 13 seconds before cover traffic was armed, and 50, 125 and 174 seconds with it armed. The difference is the message waiting on the cover lane for its slot, about 30 seconds on average; the relay-to-phone leg was about 3 seconds. Cover traffic is on by default, so expect the second figure.
- Something sent just before the app was killed. What you send waits on the cover lane for its slot, and locking the app sends what waits. A crash or a force-stop before that used to lose it. A message to one person has been marked not sent, with a Resend button, since 28 September 2026. A file, a message sent into a group, a delete for everyone and an edit were lost without a word on either phone. Since 26 October 2026 those are sent again the next time Avano opens, under the same id, and the other phone keeps one copy: one in each slot of the cover lane, or, since 27 October, one every thirty seconds if you have turned cover traffic off; for up to seven days. An edit goes again with the words your phone holds then. A file to one person and into a group, a message sent into a group, a delete for everyone and an edit (to one person and in a group) were measured in the engine’s tests and on an Android emulator; the rest in the engine’s tests. A group message sent again this way is not counted in “read by” for the member who got it late. A reaction to one person is sent again the same way, measured on an Android emulator too. Since 27 October 2026 the same holds for a group’s own changes: the invitations a new group sends, adding or removing someone, handing the group on, and a new name, description, rules, topics or photo. Before, the change was made on your phone and the others were never told: the people a new group asked never got the question, and nothing could ask them again. Measured in the engine’s tests, and the invitations and a removal on an Android emulator. What a new member is shown of the group’s past is not sent again this way: that would mean keeping your past messages on the phone for up to a week. Since the same day, taking a whole conversation back for everyone, giving someone your profile photo or taking it back, and giving them your profile card are sent again the same way; measured in the engine’s tests, and taking a whole conversation back on an Android emulator too. So are a poll vote, closing a poll or suggesting an answer, a checklist tick, a pin and the name you go by in a group, in a chat and in a group, in the order you made them; measured in the engine’s tests, and a poll vote on an Android emulator too. One exception to “one copy”: if the phone dies in the instant after the relay took a vote and before the phone noted it, the vote is sent again and counted twice, because nobody’s phone keeps who voted what. So is an ask to join a group or to add someone to one, and a recovery packet you give a helper (a newer one for the same helper replaces an older one still waiting); measured in the engine’s tests. A reaction in a group, or a read receipt, can be lost this way too: a group reaction is never stored on the phone, on purpose, so there is nothing to send again from.
- No network. Since 27 October 2026 Avano opens with no network and shows what it holds, and a message you write with no network waits and is sent by itself, once, when the network is back; both measured on an Android emulator in airplane mode, over the test relay rather than Tor. Until that day Avano would not open without reaching its relay, and a message written offline was marked not sent after about ninety seconds until you tapped Resend. A message the relay refused, rather than one that never reached it, is still left for you to resend.
- When the relay cannot be reached. Since 28 October 2026 Avano says so in words (“the relay could not be reached. Check your connection”) where it used to show the network’s own error text, when sending, when receiving in a chat and in an open group, and for files and photos; and the words of a message that was not sent go back to the chat they were written in, never into the one you have opened since. Before that day a refusal that came after you had opened another chat put its words in that chat’s message box, one tap from going to the wrong person, and an open group with no connection said nothing at all. Measured on an Android emulator with the test relay’s port closed, not over Tor; on an iPhone the same page does it, not yet compiled there.
- A Tor connection that comes up and then reaches nothing. Twice on a test emulator the built-in Tor connected and then could not reach the relay for minutes, until Avano was restarted. Since 26 October 2026, when this happens while you unlock, the unlock screen offers “Reconnect to the anonymity network”, which restarts it; measured on an Android emulator. Since the same day, if it happens while Avano is already open, Avano says so after a few minutes without reaching its relay and offers the same reconnect; measured on two Android emulators with one of them cut from the network. Until you reconnect, messages may not arrive.
- Calls go through a separate call relay, not over Tor, and were measured end to end between two emulators; no call quality is promised.
- Outages. There is no public status page yet, and no availability figure has been measured over a long period. We will not publish one we have not measured.
Accessibility
- Screen readers. Controls carry text labels, switches report whether they are on or off, and status changes (a message sending, a pairing that is not finished) are announced through a live region. On 27 October 2026 we read what an Android phone gives TalkBack, on an emulator with TalkBack on: on the four tabs and in a conversation with a message in it, every control you can tap has a name. The readings found three gaps, all fixed: the copy button beside an invite link, five text fields named only by the grey hint inside them, and the dimmed space behind every sheet, which the phone offered as a nameless control the size of the screen. (That day’s readings also tried to open each control by touch and to read what opens; with TalkBack on, a touch only moves the reader to the control, so what the controls open was not read until the next day, and this sentence used to claim it.) On 28 October 2026 the reading was done again with each control opened through the app itself and the screen that opens read too, on the four tabs, a conversation and a group conversation with a line in it: 134 screens, every control named; 36 controls open a further screen and 27 change their state in place, all read; 2 the reading could not reach by their text that day (two rows of the chat list), a limit of the reading and not a finding, and reached later the same day once the reading learned to compare a row’s spoken name rather than its printed text: on the chat list alone, 12 of its 12 controls open, every one reached. It found one more gap, fixed the same day: the emoji and sticker panel, when closed, was slid below the screen but still in the tree a screen reader walks, so TalkBack could land on a sticker that was not on screen and put it into the message; a closed panel is out of that tree now, and the reading on the fixed build gives a conversation at rest its seven controls and no sticker. The same day the screens on the way in were read as a screen reader is given them (the welcome screen, the recovery phrase, the passphrase, and the unlock screen on a later launch): every control named, and one more gap, fixed the same day: under the phrase, passphrase and unlock screens the welcome screen’s two buttons stayed reachable to a screen reader, which activates a control without touching it; a native screen now hides the page beneath it, measured on the fixed build (the phrase screen offers one control, the unlock screen two) against the old one. And a call, on two phones the same evening: the incoming-call screen gives a screen reader Answer and Decline and nothing of the page beneath; the screen during the call gave it, beside the call’s own controls, the chat’s message bar on one phone and the chat list on the other, fixed the same day: during a call a screen reader is given the seven call controls and nothing else, measured on both phones against the old build. A video call was read the same way, on both phones: the incoming-call screen says it is a video call and offers Answer and Decline, and the screen during the video call gives a screen reader its eight controls (mute, camera, flip, audio only, react, the audio output, minimise, end) and nothing else; its red End button is spoken as “End call” since that reading, which was one word too short beside the others. The pop-up panels the app lays over the whole screen — a warning that a pairing looks unclear, a notice that someone may hold your recovery words, an invitation to a group — now hide the screen behind them from a screen reader, so a swipe cannot wander out of the panel into the page it covers; before 29 October 2026 it could, and that was fixed after reading what the phone gives the reader with each panel open, on 29 October 2026. That is what the phone hands a screen reader, not a test by someone who uses one.
- Keyboard. Buttons and switches can be reached with the keyboard and activated with Enter or Space. Each message has its own “Message actions” control (react, reply, delete), reached with Tab and opened with Enter or Space.
- Motion. The system's reduce-motion setting is honoured.
- Not yet. A Higher contrast switch is in Settings since 26 October 2026: every text colour reads over 7:1 against the background in the dark look and the light one (checked in a browser), and Android’s own high-contrast-text setting does not reach the page, so on Android the switch is the way to it; the phone's text size is followed, measured on Android on the first screen at 1, 1.5 and 2 times (the text grows by exactly that, nothing runs off the side, the main button stays on screen), and on 27 October 2026 on the screens that make an account, at Android's sizes up to 2 times: at the two largest the button under your recovery words had gone below the bottom of the screen, so nobody reading with large text could make an account, which is fixed (everything those screens say now scrolls and the button stays on screen); the same day, at 2 times, every control on the four tabs, in a conversation and in its attach menu was checked to be on screen and not covered, which found the attach menu running off the top of the screen, also fixed (and four of the app's own dialogs, among them the pairing warnings, also ran off the screen at 2 times, fixed; and on a small phone at 2 times the first screen's "I already have an account" was below the bottom with nothing scrolling, fixed), and the unlock button out of sight above the keyboard with the keyboard's own key doing nothing, so the key now unlocks; and on the video call screen at 2 times, where the reactions row lay over the call's buttons and ran off the screen, also fixed; on 28 October the camera's and the document scanner's top lines were found under the phone's status bar and the scanner's buttons half under its navigation bar, at every text size, also fixed, and the line saying Avano travels over Tor, and the app's own warning lines at the top, sat under the status bar's clock and icons on Android, also fixed; on 29 October 2026 every screen the reading with a screen reader reaches (136 of them: the four tabs, a conversation, a group, and everything their controls open) was measured at 2 times, 697 controls, and none was covered where a finger lands, out of reach, or cut by an edge; not yet measured on an iPhone; and the app has not been tested with TalkBack or VoiceOver on a real phone, or by people who rely on them. If something does not work for you, tell us and a person will read it.
If you found this page convincing, the next one is the test.
Anyone can publish a list of their own weaknesses. The harder question is which of the strengths you can confirm without taking our word for anything.