How it works
Last updated 15 August 2026
Every claim below is either true of the software today or listed at the bottom as something that is not. We would rather be dull than be caught.
The server cannot read your messages
Text, formatting, photos, videos and files are encrypted on the device that sends them and decrypted on the devices that receive them, using MLS — RFC 9420, the same standard the IETF settled on for group messaging. The keys are made on your phone and never leave it. What sits in our database is a run of bytes; there is no key anywhere on the server that turns it back into a sentence, and nothing we could be compelled to hand over would.
What the server does see, because delivering a message requires it: that an account sent something to another account, when, how large it was, and the names and phone numbers accounts registered with. Encryption hides what you said. It does not hide that you spoke, and anyone who tells you otherwise is selling something.
The notification carries nothing
A push tells your phone that something arrived and how many are unread. Not the text, not who sent it — the server could not put them in even if it wanted to, because it cannot read either. Your device decrypts the message and writes the notification itself.
Nobody can look you up
There is no directory, no search for people, no suggested contacts, and no way to discover an account by wandering. You get in on an invitation, and afterwards you are reachable by a number somebody already has. We send no SMS and ask for no e-mail: a code from us is minted by hand and given to one person.
The way back is yours alone
When your account is made, the device makes six words and shows them to you once. They are the only way back if the phone is lost. The server is told a one-way derivation of them and nothing else — enough to recognise you when you type them, useless for signing in as you, and useless for reading anything. We could not give you the words back if you asked, which is the point of holding them this way.
No advertising, no analytics, no third parties
No profile of you is assembled and nothing is sold to anyone. The app carries no analytics and no crash telemetry. The only outside parties in the path are Apple and Google, who deliver the push that wakes the app — and what they deliver says nothing.
You can check all of this
The clients are forks of the Telegram apps and the server is our own, all of it open. Every sentence on this page is a claim about code somebody else can read. That is deliberate: a private messenger whose workings are secret is asking for exactly the trust it says you should not have to give.
What is not true yet
These three are the work between here and a first release, and none of them is finished. They are listed because a page that only says the good half is a page that has to be rewritten the first time somebody asks a hard question.
- Your own server. Today the address is compiled into the app and points at ours, which makes us a single point everybody has to trust. It will be typed in on first launch instead, with ours offered as the default, and the server itself will go up on any Linux machine with one command.
- A message will leave the server once it has arrived. Today a delivered message stays in the database until somebody deletes it or the account goes. That is the ordinary behaviour of every messenger and it is not what this one is for. It is a lifecycle rather than a delete — the copy goes when every authorised device has acknowledged it — and it changes what a newly signed-in device can expect to find, which we will say plainly in the app when it lands.
- Guessing the phrase will cost time. Six words from a list of 2048 is about 266 combinations, which no person will ever type through. A machine does not type. So the server will allow a small number of attempts per account per hour, the wait will grow with each failure instead of resetting, and the count will survive a restart of the server, so it cannot be cleared by knocking it over.