Everything you need, and nothing that watches you
Aphotic does what you expect a messenger to do, and each part is built so the server learns as little as it possibly can.
Messaging
Private conversations, private envelopes
Text, reactions and replies are encrypted on your phone and can only be unscrambled on the phone you sent them to. The keys change constantly as you chat, so stealing one doesn't open the rest of the conversation. Direct messages also travel with no sender written on the outside, which means the server never learns who sent them.
- Self-deleting messages, anywhere from 30 seconds to 7 days. The timer is sealed inside the message, so the server can't see it and can't override it
- Search runs on your phone alone. The search index never leaves your encrypted vault
- Messages land in the same order for both of you, even on a slow or flaky connection
Contacts
Nobody reaches you without consent
There's no directory you can be looked up in. A new contact shows up as a request, and until you accept it a stranger cannot put a single message into your chats.
- Share your ID as a QR code or a short line of text. There's no phone number and no username database anyone could search
- Accept, decline or block a request before any conversation exists
- Blocking, muting and removing happen on your phone. The other person is never told
Groups
Groups for your circle, Communities for your crowd
An everyday group holds up to 20 people. Each message is encrypted separately for each member, so there's no single shared key sitting on the server waiting to be taken. Communities go up to 5,000 people using a group encryption standard called MLS, where every join and every departure changes the keys. Either way the group's name is encrypted too, and the server holds nothing but scrambled data.
- Invite links can be killed. Two separate switches let the group shut a leaked link down
- The key travels inside the invite link itself, so the server never gets to hold it
- Roles decide who can invite, rename or post
- Communities are invite-only and admission is deliberate. Someone removed can't read anything sent after they go. Community chat is text-only for the moment
Media
Attachments and voice, encrypted end to end
Files up to 25 MB get their own fresh random key and are encrypted on your phone before anything is uploaded. Voice messages record straight into an encrypted file, with a waveform you can drag to skip around.
- Voice notes are recorded at a fixed data rate, so the size of the file gives away nothing about what you said
- You can disguise your voice before sending, pitch-shifted and re-shaped on your own phone. Nothing is sent away to be processed
- Media is only ever unscrambled on the recipient's phone. The server holds files it cannot open
Notifications
Push without push servers
You still get notifications, and none of them pass through Google or Apple. Normal apps get woken by a push service, which hands the server's address and your message timing to a third party. Aphotic's own background process keeps the Tor connection open, checks for new messages on an interval you set, and raises the notification on the phone itself.
- The app strips the content from lock-screen previews itself, so hiding it doesn't depend on an Android setting
- There's no push token or third-party wake-up channel, so nothing records who is online and when
Backups
Your data moves only when you move it
A backup is one encrypted file you create when you want it and keep wherever you like. Moving to a new phone is a direct handover between the two devices. No copy is ever put in a cloud.
- Backup files are locked with a passphrase that is made slow to guess, even with serious hardware
- A transfer moves your identity to the new phone, and the old phone stops being connected to it
What we left out
Some things are missing on purpose, because each one would create the kind of record this design exists to avoid.
Read receipts & typing indicators
Aphotic was built with no way to send them. Nobody can see when you read a message, when you hesitated, or when you rewrote it.
Voice & video calls
A live call over Tor is too slow today, and making it fast enough would mean giving up some of the anonymity. Voice messages cover the rest.
Cloud backup
A copy on our server would outlive the 7-day queue and turn into the first thing anyone asks us for. Backups stay with you.
Store-only distribution
A store account leaves a record of who installed what, and gives someone a single lever to pull the app down. A Play listing is coming for convenience, but the signed file you can check yourself stays the main way to get Aphotic.
See how it's built
The security page walks through the encryption, the vault and the Tor setup behind all of this.