Protecting message content is the easy part; every product does it. The difference is what remains after that.
End-to-end encrypted
Sealed on your device, opened on theirs. The relay holds no key material at any point, so there is nothing to hand over and nothing to compel.
No sender to record
Deposits carry no sender field — not stripped, never present. Sending spends a token the relay signed blind: it verifies a real account without learning which.
Post-quantum today
Key exchange combines X25519 with ML-KEM-768. Traffic recorded now stays private against an adversary who builds a quantum computer later — it fails only if both halves fail.
No identity to surrender
No phone number, no email, no name. You choose an identifier and share it directly — there is no directory to be found in and no contact list uploaded anywhere.
Self-hosted by design
Runs on your hardware, on your network, under your control. A single static binary with no interpreter and no plugin loader to audit.
Forward secret
Keys advance with every message and every membership change. A device compromised today does not expose last month's traffic, and removing someone is permanent.
Anonymous transport
Reach the relay over Tor, built into the app with nothing else to install. The network sees Tor rather than a distinctive server, and no exit node is involved — the connection never leaves the onion.
Verified, not just encrypted
Encryption alone cannot stop a hostile relay from swapping a key. Every contact is bound to the identity it registered, and a short safety number lets two people confirm it in person before they trust it.