What only you and your friends can see
Your posts, photos, boops, and messages are locked on your phone before anything is uploaded. What lands on our servers is ciphertext: scrambled data we don't have the keys to. The keys live on your phone, not ours.
- Posts and photos: readable only by the friends you sent them to.
- Boops: same, and they don't linger. An unopened boop expires after 24 hours, and the content of an opened one is erased from our servers within a day or two of being seen.
- Messages: private to you and your friend. We can't read them. Your history stays until you delete it, and if you restore on a new phone with your recovery phrase, your conversations come back.
- Logbook: your private journal. Not even your friends can read it. Just you.
- What you read in News: the briefing is identical for every reader, and nothing about what you read, tap, or open ever reaches us. If you hide News in Settings, that choice stays on your phone too.
- Your profile: locked the same way.
- Your friend list: how you organize, label, and sort your friends is scrambled before it reaches us, and so are your block and mute lists; we can't read any of it. To deliver posts, our servers do need to know which accounts are connected (that's the routing below), but those accounts are anonymous IDs with no names, profiles, or identities we can see.
What we can see
We're not going to pretend it's magic. To deliver posts and messages we keep some metadata: things like who posted at what time, who pulled which post, and that a message went from you to a friend at a certain moment. That's the routing information that makes the app work. So yes: we can see that you messaged someone, and when. We can never see what you said, or any other content, even if someone hands us a subpoena; there's nothing on our side to decrypt. And News runs the other way entirely: we can't see what you read, because nothing about your reading is ever sent to us.
The app on your phone sends us no analytics, crash reports, or telemetry. On our side, we keep standard server logs (which contain no content and no IP addresses) and aggregate service counts, like how many accounts signed up this week, so we know the service is healthy. That's the whole list.
What we don't do
- No ads, ever.
- No analytics on your content.
- No selling or sharing your data.
- No uploading your contacts, and no tracking you across other apps.
Even your notifications
Push notifications carry only a routing ID, never the message. Your phone composes the text ("Sarah sent you a boop") after everything arrives and unlocks locally. A message notification is quieter still: the banner just says "New message", with no text and no sender's name. Apple and Google pass the ping along but can't read what's inside it.
"Only you and your friends can see what you share." That isn't a promise to behave. It's how the app is built. We can't read your content because we never hold the keys. You can read more about the approach on our Security page.