Frequently asked questions
Short answers about how Aphotic works, what it costs, and what it goes out of its way not to know about you.
Buying & licenses
Why does Aphotic cost money?
"Free" messengers are paid for with your data, and we'd rather be paid by you. License sales are our only income, so we can earn more only by making private messaging better. Charging also puts a price on every account, which keeps out spam and the thousands of throwaway fake accounts that come with it.
See plans and the business model →Doesn't paying identify me?
Not the identity you chat under. When you redeem a license, the shop signs a token without being able to see it, rather like signing across a sealed envelope. The chat server then accepts that token as valid without learning which license it came from. Our own database cannot connect a purchase to a chat identity, because that connection was never stored. Pay with Monero and the money side stays private too.
The blind-signature flow, step by step →How many devices does one license cover?
A license comes with a few seats, usually three, so a household or one person with several phones can share a key. A key you buy later stacks on top of the license you already have and extends it.
I lost my license key. Now what?
Look it up yourself with the order ID and access code from your purchase. You don't need an account or an old email, and nobody at support has to get involved.
Retrieve your license →Can I give a license as a gift?
Yes. A key belongs to nobody until it's activated on a phone, so buy one and hand it over however you like, printed or written in a card. Checkout also does bulk orders if you're kitting out a group in one go.
What about refunds?
Delivery is instant, and at checkout you explicitly agree to get the key straight away. Under German law that agreement ends the 14-day right of withdrawal for digital goods. Crypto payments can't be reversed either. If you're unsure, start with the smallest plan.
Read the withdrawal policy →Is Aphotic on the Google Play Store?
Not yet. A listing is planned as a second option for people who don't want to install a file by hand. Play is convenient, and in return Google records that your account installed Aphotic. The direct download stays the main, private route either way.
Install the private way →How do I check that my download came from you?
Two checks, one command each. Compare the file's fingerprint with the one we publish, and check the signature against the signing key we publish. Either one failing means the file isn't ours. The download page walks you through both.
Verify your download →Privacy & security
Do I need a phone number or email address?
No. Aphotic has no accounts at all. You are a random ID made on your own phone, which you share with contacts by QR code or as a short line of text. Nothing about it points to you, and there's no directory for anyone to search.
What does the server learn about me?
Almost nothing, and we list all of it: an ID derived from your keys, some public keys, group memberships, and scrambled message data. Direct messages wait in the queue for at most 7 days; a Community with saved history keeps its messages longer. It never sees what you write, your IP address or your phone number, and sealed sender keeps the sender off direct text messages. It can't keep signup or last-seen times either, because the database has no columns for them. Everything that could ever be handed over is listed on its own page.
What a subpoena gets →Will Aphotic still be safe once quantum computers exist?
It was built for that, at both layers. Conversations are set up with two independent kinds of encryption at once, one of them quantum-resistant, and the keys that protect your running conversation get a fresh quantum-resistant secret mixed in at every step. Recording your traffic today and hoping to crack it in twenty years does not work here.
The full crypto design →Why no fingerprint or face unlock?
Because a finger can be pressed onto a sensor and a face can be held up to a camera, whether you agree or not. A PIN only exists in your head. Aphotic is PIN-only on purpose, and five wrong attempts erase the vault.
What is the panic PIN?
A second PIN you set up in advance. Type it in when someone is standing over you and it wipes the vault instantly and silently, while behaving exactly like a normal unlock. There's nothing on screen for anyone watching to notice.
Why Tor only, and how slow does that make it?
Tor hides the server from the world and hides you from the server, and there is no ordinary web address to fall back on. You pay for it in speed: once the connection is warm, things take a second or two, and a cold start takes longer while Tor gets going. Sending still feels instant, because the message goes out in the background while you carry on.
How Tor works →Using Aphotic
How do backups and switching phones work?
A backup is one encrypted file you export when you want it, locked with a passphrase that's deliberately slow and memory-hungry to guess at. Moving to a new phone is a direct handover between the two devices: the new phone takes over your identity and the old one gives it up. No copy is ever put in a cloud.
Does Aphotic have push notifications?
Yes. You get notified about new messages while the app is closed, though it works differently from most apps. With normal push, the sender's server asks Google's or Apple's push service to wake your phone, so a third party learns where our server is and gets a timestamped log of every message you receive. Aphotic runs its own small background process: it keeps a connection open over Tor, checks for new messages on a schedule you control (every 30 seconds up to every 5 minutes, under Settings, Network), and raises the notification on the phone itself. All of it stays inside Tor with no push token, so Google and Apple are never involved. A longer interval saves battery and delays the notification by at most that interval. Open chats are instant either way.
Where are read receipts and typing indicators?
Aphotic has neither, on purpose. We never built a way to send them, so nobody can see when you read a message, or that you started typing and then thought better of it. Delivery ticks only confirm that the message reached the other phone.
How big can a group get?
An everyday group holds up to 20 people, with every message encrypted separately for each member. Communities go up to 5,000 using a group encryption standard where the keys change every time somebody joins or leaves. They're text-only for now.
How 5,000 people share one secret →Can I use Aphotic on iPhone or on a computer?
No. Aphotic is Android only, and we're not promising an iPhone or desktop version. The plan is to do one platform properly and keep your identity on exactly one device. The roadmap shows what is coming.
The roadmap →Can I run Aphotic for my own community?
Yes, that's the relay operator programme. You run your own server on your own hardware, we issue the licenses, and your server shows up in a signed directory the app can check. Not to be confused with Communities, which are the large group chats inside the app.
Run your own relay →How do I reach a human?
By email. There is one inbox, and the people who build the app read it. The contact page has the address, what to put in your message and what never to send.
Contact →