One-to-one and groups
Text, photos and voice notes, on your own or with everybody. Mention someone and they'll hear about it even if they've muted the group — which is usually the point of mentioning them.
Messages
Chats, calls and groups — sealed on your phone.
The ordinary things you'd expect from a messenger, built so the server in the middle can't read any of it. No phone number to hand over, no ads, and a server you can run yourself if you'd rather not trust ours.
The everyday parts
What you'll actually use.
All of it encrypted, all of it on by default. There is no plain mode to accidentally end up in.
Voice calls
Ring someone directly. The audio is encrypted between the two phones, and the check that you're talking to the right person rides inside the conversation you already trust.
Stories
Post a picture, a few words or a link, for as long as you choose — an hour, or a week. Only your contacts see it, and the server is never told how long it's meant to last.
Chats that clear themselves
Set a conversation to tidy up after an hour, a day or a week. It applies to both phones, and the server isn't told a conversation is timed, let alone for how long.
No phone number
Sign up with a username and an email. People find you by the name they already call you, and your number stays out of it entirely.
You'll know if a key changes
If someone's phone is replaced — or somebody tries to stand in for them — the app stops and tells you, with one thing you can do about it. There's no way to wave it away, because there shouldn't be.
Fix the typo
Change a message after you've sent it. It turns up on the other phone as the same message, marked edited — not as a second one nobody can tell apart from the first.
Find what you said
Search across every conversation you have. It happens on your phone, because the server has never been able to read a word of it — which is also why nobody can search it but you.
Write now, send later
Say it while you're thinking of it and let it arrive at a decent hour. The message waits on your phone, not on the server — until it goes, there's nothing anywhere for anyone to hold.
Nudge yourself, quiet a thread
Ask to be reminded to reply, or put a conversation to sleep for the afternoon. Both are kept on your phone — the server has no idea a thread is snoozed, and no idea you meant to write back.
Link previews, made at your end
When you share a link, your phone builds the little card — so the site never hears from the person you sent it to. It does hear from you, which is why there's a switch to turn it off.
Photos don't say where you were
Pictures and video you send from the photo button are rebuilt on the way out, so the coordinates your camera wrote in don't travel with them — in a chat, in a group, in a story. Sending something as a file is the exception: a file goes exactly as it is, which is rather the point of a file, so check what's in it first.
Lock it behind your face
Your phone is the one place your messages are readable, so it's the one place worth locking. Face, fingerprint or your usual PIN, and it asks again a minute after you set the phone down. It's there for the handset somebody picks up — not for anyone taking the storage apart.
Where it lives
Your name is yours, not the server's.
Your address comes from your passphrase rather than from whoever's hosting you. So you can keep a mailbox on more than one server, and if one of them disappears you've lost a mailbox — not your identity, and not the people who know how to reach you.
Servers can pass messages to each other too, so you and the person you're writing to don't have to be on the same one. That's worth knowing both ways round: it means more choice, and it also means one more server has seen that a message went by. We'd rather set that out than let you discover it.