Four phases, as gates and not dates.
A roadmap with dates is a promise about the future; a roadmap with gates is a statement about the present. Each phase below starts when the previous one is measured working, on real phones, with real people. What is built toward each is written with its status, and nothing here is presented as shipping that is not.
The messenger, launched, with a front door for the first minute.
Everything an ordinary messenger has, on the foundation that keeps nothing, plus the three things that make the first minute possible for someone who has never heard of Tor: a Simple posture that connects directly when chosen, private discovery by email and phone, and a backup you can restore with a handle and a passphrase. Then the things only the company's founder can do: the name, the company, the stores, the audit, the signed release.
Text, voice, calls, video, groups, files, search, disappearing messages and the rest, on both platforms; pre-release.
The Simple posture, private discovery, the handle-and-passphrase backup: built in the apps and the engine; the services behind two of them are not deployed.
The company, the store listings, the signed release, the external audit.
Where uncensorable is the product, then the communities that follow.
The first users come from where the large messengers are blocked or watched, and from communities that move together rather than people who move alone. The things this phase needs that are already built: channels and communities, Business and Teams on the operator kit, the first on-device intelligence that needs no model. The things it needs that are decisions: the desktop client, and a text model on the device, which was measured and found not yet good enough to ship.
Bots, cards, identity as an API, and the second operator.
A contact can be a program; a program can send cards; an account can prove itself to any service from the bytes; the protocol is pinned by vectors a second implementation checks. What waits: mini-apps that run their own code (a decision about capabilities, written down), developer tiers on the token rail (a pricing decision), the second operator (the longest lead time in the company), and the web client (a decision about where a browser's keys live).
Built; see developers and the protocol.
Designed; each waits on a decision named in the record.
The kit is written and the mechanism built; the keys and the operator are not ours to conjure.
Federation, sovereign deployments, the protocol as a standard.
Several operators under one directory; organisations and institutions running their own networks from one profile file; the protocol submitted as a standard with others' implementations checked against the vectors; the research programme, formal models and key attestation; and the stages against a global passive adversary that remain a target and not a claim until measured.
Written and built; a standards submission comes after launch and audit.
A target, never a claim, until a stage is built and measured.
Three things that do not move whatever the phase.
Privacy is never sold: cover traffic and every protection stay free for everyone, because a privacy lane you have to buy marks the people who bought it. The company never learns who paid: billing, when it exists, rides the same blind tokens the relays meter with. And nothing on this site says more than the source does: the limits page, the refusals page and the status page are kept to the day, and we would rather be judged on them.