Talk to anyone.
No server keeps the list.
Your friends, your family, your colleagues, the person you are only just getting to know. Say what you actually think, to whoever you actually trust — without a company somewhere building a map of who matters to you.
Messaging built to leave no record of who you talk to.
Do not take our word for it. This is the live wire — type into it, send, and try to find your own message.
Your message rides out on the next pulse — lit here, because you know which one it is.
Type furiously or sit still: while the app is open the wire looks identical either way. What it does not hide is that you opened it — a phone that is asleep, locked or offline emits nothing, and no amount of cover makes a stopped stream look like a running one. We would rather show you the limit inside the demo than underneath it.
Not an illustration of cover traffic — the behaviour. One fixed-size block leaves per slot whether you are mid-conversation or reading in silence, and a real message pre-empts a decoy rather than adding to the stream.
Six records this product declines to create.
Not settings you switch on and not promises about our intentions. Each one is a thing that does not exist, which is the only kind of assurance that survives a court order, an acquisition or a change of ownership.
No green tick you can't check.
Every messenger shows you a padlock. Ours reports what it actually measured — and where it has not measured something, it says so instead of painting a badge. A status you cannot verify is decoration, and decoration is what gets people hurt.
Tor is not a setting here
There is no switch, no advanced mode and no clearnet fallback in a shipped build. The relay is published only as an onion service, so a client that is not already on a circuit cannot even resolve the address — which is why a successful connection is itself evidence the circuit carried the traffic.
Every screenshot on this site is a real capture of the running build. A screenshot is a claim, and it goes through the same check as a sentence. The full record of what is built, what is being built, and what we refuse to build is on limits.
What a lab actually gets.
Here are two of the store's central tables (there are more), annotated with what survives seizure. We are not showing you a doctored screenshot of an empty file — this is the structure an examiner reads, and it is deliberately the unflattering version.
CREATE TABLE contacts (
contact_key BLOB PRIMARY KEY -- keyed blind index, not a name
name BLOB NOT NULL -- sealed
device_id INTEGER NOT NULL -- readable
);
CREATE TABLE messages (
seq INTEGER PRIMARY KEY -- readable
conversation_key BLOB NOT NULL -- keyed blind index
body BLOB NOT NULL -- sealed
expire_at INTEGER -- readable, the exact expiry time
);
-- also readable: every table name above, every index, and every
-- row count. sqlite_master is not encrypted.
The app marks its own duress unlock not active yet on the Shield screen, where a user can find it, rather than listing it among the protections. A decoy that can be spotted under coercion is worse than none.
The contents are sealed; the container is not. Whole-file encryption is specified and is not in use, so per-column sealing can never protect the schema, the indices or the row counts — and row counts say how many contacts you have and how many messages you exchanged. What is sealed is sealed behind an Argon2id entanglement of a hardware-held key and your passphrase, so extracting the device key alone yields nothing. None of it protects you from being made to unlock the phone. The full inventory, including the duress features we tell you not to trust →
Three things we decided not to build.
Every other company puts a customer quote here. Here is something a competitor cannot copy instead: the record of what we turned down, and why.
A spool that would have let a locked app receive mail.
Filling it meant caching the credentials that drain your queues outside the sealed store. Refused in one sentence: anything that keeps polling while locked has not locked. The cost is reach: Avano alerts you the instant mail lands while it is running, but nothing reaches you once iOS has terminated the app, or while an Android phone is locked and sealed. (An optional "Stay connected" service keeps an unlocked, backgrounded Android receiving — the locked case is the one this refusal is about.)
A durable disk spool on the relay.
It would have survived restarts and made delivery more reliable. Refused because a RAM image captures the present; a disk image captures the past. The relay now refuses to start if its spool is on a real disk.
Cloud backup, link previews, public channels, a search index, a second live device.
Each has an argument written down and each is one you are entitled to disagree with. A link preview fetched by your phone lets the sender choose which server learns your address and the second you read your messages. Calls used to sit on this list and no longer do — voice calling is built, routed through a relay so neither party learns the other's address; the relay itself sees your IP, which is the honest cost, stated in full on the page that describes calls. Video is not built yet.
Leave one trace: your email.
One line in one list, and it is the only record we deliberately keep about anybody — no tracking, no analytics, nothing else. The full engineering record, including what is not built yet, is on limits.