Messages that leave no trace.
Encrypted on your phone with the Signal protocol, carried by a relay that keeps nothing, and gone from everywhere once delivered. No phone number, no email, no history.
YOUR SAFETY AND PRIVACY HAVE NO PRICE
── how it works ──
Two phones hold the keys. Nothing else ever does.
── who knows what ──
The honest version, party by party.
| party | knows | can never know |
|---|---|---|
| the relay | a hash of your username, your public keys, encrypted messages while they wait, and that several of them left your phone at the same moment (which is how a group looks from outside) | what you wrote, who you are, group names or member lists, anything after delivery |
| us | that a payment happened | which user it paid for: access keys are blind-signed, so a payment and an identity can't be linked |
| Cloudflare | that you visited this website or downloaded the app. It is not in the path to the relay: your phone connects to the relay directly and the encrypted connection ends on the relay itself | anything about your messages, contacts or when you talk |
| Apple / Google | that a content-free wake ping was sent | sender, text, or how many messages |
| whoever holds your phone | that an app is installed | anything without the password. A wrong password looks like an empty app; a duress PIN shreds everything. |
── on your phone ──
The same app on iPhone and Android, word for word.
── built in ──
Everything a careful person would ask for, nothing they wouldn't.
- self-destruct
- Per-message or per-chat timers that start when the recipient reads, and burn on both phones together.
- screenshot shield
- Screenshots and recordings of the app come out black. If a peer tries, you're told, and the thread can burn.
- delete for both
- Retract a message from both phones. It happens once the other side is reachable, never silently for you alone.
- duress PIN
- A second password that wipes everything and presents a fresh, empty app.
- dead-man switch
- Not opened for 7, 30 or 90 days? The app wipes itself.
- safety numbers
- Verify a contact in person, or scan each other's code to add and verify in one step. Key changes are flagged.
- Tor and proxies
- Every connection through a SOCKS5 proxy if you want. If the proxy is down, the app stays offline rather than leak your address.
- encrypted backup
- Move phones with a passphrase-protected file. Nothing is ever backed up to us.
- ten phosphor themes
- Ember green, amber, ice, plasma, ultraviolet, solar, mint, cobalt, paper and ghost. One colour each, identical on iPhone and Android.
- what it sends
- Text, emoji, voice notes, images and files. No video, no calls, by design.
- group channels
- Up to 20 people, every member in their own colour. Each message is encrypted separately to every member; the relay never learns that a group exists. Everyone is told who took a screenshot, and the creator can burn the whole channel on every phone.
- system notices
- Maintenance windows and new versions arrive as a <pyrochat> channel straight from the relay. Nobody can reply to it, nothing per-user is kept, and you can hide it.
- source code
- Both apps will be published under the AGPL so anyone can read exactly what they do with your keys. Not published yet: the repository goes public with the App Store release.
── desktop link ──
Read and reply from a browser. Your phone keeps the keys.
- Open pyrochat.ca/link in a browser.
- On your phone: [cfg] → LINK DESKTOP.
- Scan the code. The same six digits appear on both screens.
The browser never holds keys. Your phone decrypts and mirrors the conversation over its own encrypted channel that the relay can't read. Self-destructing messages never reach the browser, your contacts are told when you link one, and closing the app kills the link.
── access ──
One key, thirty days, nothing about you on file.
$100USD · 30 days of relay access
Crypto: 300+ coins including BTC, ETH, USDT, USDC, XMR and LTC, paid right here, no account needed.
Pay, receive a single-use access key, scan or type it into the app. No account is created; we keep only a hash of the key, and the card or crypto processor keeps its own payment record. Keys are per person: the people you talk to need their own.
On your phone the key becomes anonymous daily tokens. The relay can check that a token is valid, but not whose it is, and a token and a payment can never be matched up.
── get the app ──
Two platforms, one protocol. They talk to each other.
iPhone
In closed beta on TestFlight while the App Store review is under way. Write for an invite.
[ request an invite ]Android
Android 10 or newer. Direct download, signed with our release key, checksum on the page. Google Play listing to follow.
[ download for android ]