PrivChat

PrivChat is an encrypted messenger that works without servers.

There is no account to create. No phone number, no email, no name. And there is no server your conversations pass through: messages travel straight from your device to the other person's.

HOW IT WORKS

Each device publishes its own address on the Tor network and listens on it. When you write to someone, the message is encrypted on your phone and travels over that network to theirs, where it is decrypted. Along the way nobody can read it: not your internet provider, not the relays it passes through, not us.

To talk to someone you need their invitation, and they need yours. You exchange them by scanning a QR code or passing along a piece of text. There is no user directory: nobody can find you unless you have given them your invitation.

WHAT IS INSIDE

• End-to-end encryption with a Double Ratchet, and post-quantum cryptography: the key agreement (ML-KEM-768) keeps today's recorded traffic unreadable to a future quantum computer, and the signatures are post-quantum too (ML-DSA-65).
• Sealed sender: not even who is writing to you travels in the clear.
• Fingerprint verification: by comparing a code in person you know you are talking to who you think.
• Photos, voice notes and video messages, encrypted like everything else. Every image is re-compressed before it leaves, stripping the hidden metadata it carries (GPS, model, date).
• Small serverless groups: each message goes encrypted from your phone to each member, and the member list is signed by the admin.
• Broadcast channels: a channel has its own address and its own signing key, unlinked from your identity, and the publisher cannot tell who reads. With photos and voice notes with captions.
• Disappearing messages with a duration you choose: 1 hour, 24 hours or 7 days.
• Links warn before opening; there are never link previews.
• Database encrypted with SQLCipher; keys protected by the device keystore.
• Optional PIN: with it, not even the phone itself can open the store without you. Plus a panic PIN that wipes everything when typed, for when you are forced to unlock.
• Optional screenshot blocking.
• Cover traffic: empty packets now and then, so watching when traffic happens does not reveal when you talk.
• Tor bridges included, with transports that disguise the traffic, for where Tor is blocked.
• Secure erase: deleting your identity destroys the keys and overwrites the files.

WHAT IS NOT INSIDE

• No server of ours. No account, no sign-up.
• No analytics, telemetry or advertising.
• No access to your contact list, no location permission.

The camera is used to read QR codes and, if you choose, to take photos or record video messages from the chat. The microphone, only when you press record. Nothing leaves the device except encrypted to your contact.

WHAT YOU SHOULD KNOW BEFORE USING IT

• With no server storing messages, if the other phone is off the message waits on yours and is retried. It is not instant like an app with push.
• Receiving with the app closed requires a background service, with its permanent notification.
• With a PIN set, after a phone restart you must open the app and type it before messages can arrive.
• If Android restricts the app to save battery it may stop receiving: set it to "unrestricted".
• Your identity lives on this device. You can move it to a new phone with an encrypted file that only you can open (passphrase plus PIN); there is no multi-device.
• The Tor network takes a little while to start the first time.

These are direct consequences of having no servers. If that trade is worth it to you, this app is for you.

PrivChat is built on open-source libraries: Tor (arti, from the Tor Project itself), BouncyCastle, SQLCipher and ZXing. Its cryptography is standard and public: X25519, ML-KEM-768, Ed25519, ML-DSA-65, ChaCha20-Poly1305, HKDF-SHA256 and Argon2id.

Project PGP key fingerprint:
BC8D E53F D8D1 6F63 AD8A 33EA 10EC 8069 37D6 8502