You give them a code, once.

The first time you open the app it generates your identity and stores it encrypted on the phone. Nothing is sent anywhere and nothing is asked of you — there is nobody to register with.

The list starts empty. Your contacts live here, and so do the groups and channels you join. The tabs at the top filter the list — All, Unread, Contacts, Groups, Channels — and you can create your own folders holding any mix of chats: long-press a chat and choose Tabs…, or use the + at the end of the row. Like everything else, folders live only on your phone, encrypted. The New button creates a contact, group or channel; everything else happens from My identity, at the top right.

An invitation is a code you give to one specific person. You give it a name — that name stays on your phone and never travels inside the code — and the app uses it to know who is writing the first time they do.

Each invitation works once. As soon as the person it was for has used it, anyone else presenting the same code is refused. That is why there is one per contact instead of a single code you hand around.

The code is a single, ordinary QR. It does not carry your keys — with post-quantum signatures they would not fit in a hundred codes — but a fingerprint of them and your address. The other phone scans it, fetches the keys from your phone through Tor and checks them against that fingerprint before it trusts anything. Until then the contact shows as «fetching keys»; it takes a few seconds, sometimes a minute.

If you would rather send it through another app, Copy as text gives you the complete invitation as text — keys included, so it works even if your phone is off when they paste it. Since 2.2 that text is valid for 28 days, and whoever pastes it needs 2.2 as well; on 2.1, ask them to scan the QR instead.

Bear in mind what the code contains: your Tor address. Anyone who sees it can reach you, so show it only to the person it is for.

Your identity has a verification fingerprint: a row of digits, shown here. Your contact has one too. It is what you compare to be sure nobody slipped in between you — the next step.

The peer ID and the fingerprint are covered up in this screenshot on purpose: they identify a specific phone, and this page is public.

Until you check that a contact is really who they say, the chat shows a reminder. Tap Compare now: the app shows their fingerprint, the same row of digits they see on their phone. Read them to each other, or compare over another channel.

If they match, tap It matches. The chat header then reads Fingerprint verified and the reminder is gone. This is the one thing the app cannot do for you, and it takes ten seconds.

Under each message you sent there is a state, and it means something precise because there is no server keeping your messages:

• queued — the other phone is not reachable right now. The message is waiting on your phone and keeps retrying.
• sent, unconfirmed — it went out, but their phone has not acknowledged it yet.
• delivered — their phone confirmed it. Nobody else could have.

A message that stays queued does not mean anything is broken: it means they are offline. There is no inbox in the sky to leave it in.

A group holds up to two hundred people, run by whoever created it. There is still no server: a group message leaves your phone once per member, over the same encrypted one-to-one sessions as everything else — which is why groups are text-only, and why the app states the data cost before you create or join one. With more than sixteen members, everyone needs version 2.15 or later; the app tells you who is missing.

The member list is signed by the group's admin, so nobody can be slipped in unnoticed. Members who did not know each other are introduced through the group securely, without anyone forwarding invitations by hand. One thing to know before accepting: the members of a group can learn your Tor address — the app tells you exactly that on the invitation screen.

A channel is a one-way broadcast: one person publishes, any number of people read. A channel you create gets its own Tor address and its own signing key, with no link to your messaging identity — publishing does not reveal who you are or how to message you.

Readers join with an invitation (QR or text) and fetch new posts over an anonymous circuit. The publisher cannot see who reads — only that the channel was polled, never by whom. Every post is signed by the channel and chained to the previous one, so history cannot be rewritten without readers noticing. By default the channel only updates when you tap refresh; a per-channel switch adds periodic background checks if you want them.

The app is free and has no ads. The donation screen shows an address and, next to it, a short fingerprint.

Compare that fingerprint with the one on this site before sending anything. If someone rebuilt the app with their own address, that is how you find out. It is the same gesture as verifying a contact.

From My identity → Tor bridges → Set up. Most people never need this. Where Tor itself is blocked, the middle option, Get around the block, comes ready to use: it goes in through relays that are not on the public list and disguises the traffic so it does not look like Tor.

If those are blocked too, Use my own bridges takes lines from the Tor Project. Fetch more bridges asks for a fresh set over your existing connection.

Under Network, Test the onion circuit sends a packet to your own address through Tor and waits for it to come back. If it does, your phone is publishing and reachable end to end — "published" and "reachable" are two different things, and this checks the second.

Setting a PIN means the encryption key needs two halves: your PIN and a secret held by the phone. Neither is enough alone, so a copy of your data is useless to anyone without you. There is no recovery — nobody can reset it, and that is the point. Write it down where you keep your house key, not on the phone.

With a PIN set, the app also asks for it again after a minute in the background, so someone who picks up your unlocked phone cannot simply open it.

If you are with a contact in the same place and there is no internet, open the conversation, tap More and choose Talk in person. Its screen opens: you choose how you find each other — Automatic (both at once), Wi‑Fi or Bluetooth — and how long it stays on (15 minutes, 1 hour or 4 hours), and tap Turn on. You both have to turn it on, each for the other. Over the same Wi‑Fi, even one with no way out to the internet, it is faster: a photo takes seconds. Bluetooth (between Android phones) reaches a few metres with no router, but a photo can take a minute. If there is no Wi‑Fi, on Android you can tap Create a network here: your phone becomes the network and the other person joins it with the name and password shown. While it is on, an icon in the conversation header shows how long is left; tap it to go back to the screen, switch route or turn it off. The default duration is set in Settings.

What changes while it is on: anyone nearby with a scanner can tell that someone is using PrivChat, and see when and how much you talk, though not what or with whom. Over Tor that is not visible. The app never looks for anyone and never relays anything through third parties.

If you are not in the same place, Carry messages saves what is pending for that contact in a file that only they can open and that does not even say which app it comes from. Carry it on a USB stick, send it any way you like or give it to someone who will see them; they open it with Import a package and the messages appear as if they had arrived over the internet. While the package travels, those messages are not sent over the internet; if in the meantime you talk several times by another route, they go out on their own and the package stops being valid, without anything being lost.

On the computer, In person works over the local network. On the iPhone, the package comes with its next version.

A Mailbox is PrivChat with no screen on a device of yours at home — a Raspberry Pi or a computer that stays on — running the PrivChat bot with privchat-bot --buzon run. When you are out, a contact who comes by your Wi‑Fi leaves it what they have for you and picks up what you left for them; when you get back, your phone collects it by itself. You pair it in Settings → My Mailbox: paste the invitation from privchat-bot buzon invitar, and the first phone that uses it becomes its owner.

With With internet turned on (optional; off by default), your contacts can also leave you messages over Tor while your phone is off, and you pick them up from anywhere.

It only keeps what is yours, sealed: it cannot read it, and it never holds your identity. You choose who can leave you messages (by default, contacts verified in person; they need 2.10.2 or later). If it is stolen, it reads nothing and within about 48 hours it no longer recognises anyone; you unpair it from your phone. On the computer it is in Settings too. How to set up the bot: the bots guide.

A small LoRa radio — a Meshtastic or MeshCore node (PrivChat recognises which when you connect it; by radio you only reach people on the same network), such as the Seeed XIAO ESP32S3 with Wio‑SX1262 we use ourselves — next to the phone, linked by Bluetooth. In Settings → Mesh: Find node, the node's PIN, and the Use the mesh switch (off by default). It is the last resort, after Tor and "In person": when neither delivers, the text goes out over the radio in pieces and other nodes repeat it for kilometres. Only with the contacts you tick on that screen ("By radio with"; they are ticked by themselves when heard by radio, and each one needs a node too), and only text and confirmations: photos and video wait for another route. The content stays sealed by PrivChat; the radio never sees it.

What to expect: the message shows "by radio", and "delivered" only when the other side's confirmation arrives, which also comes back over the radio: minutes, not seconds. A text is about 17 seconds of air time. In the US (902–928 MHz, up to 30 dBm) there is no legal limit on air time, but PrivChat keeps itself to 10 % of each hour anyway, so one app never hogs a mesh that belongs to everyone: about ten messages with their confirmation per hour. (In Europe and the UK the 868 MHz band makes that 10 % a legal limit, and the node itself enforces it.) The mesh screen shows the air used, counting also what your node repeats from others. When it runs out, messages wait and go out when their turn comes: do not re-send them by hand.

Your Mailbox with a node acts as a gateway: away and offline, you leave it what you have by radio and it delivers over Tor, and you collect what was left for you. With a contact you can open an own mesh: a channel with its own name and key, shared by an encrypted message. What a listener sees: that your node transmits, when, how much and roughly from where (a transmission can be located); never the content or the recipient. On the desktop the node connects over USB.

My notes, the chat with yourself, has two tabs since 2.12.0: Notes, the usual chat, and Calendar. Write a note and tap the calendar next to "Send": pick the day and time (or one of the quick options), whether it is a task with a checkbox, whether it repeats (daily, weekly, monthly, yearly or your own way), when to remind you (up to three reminders: at the time, or minutes, hours or days before) and a colour label. From any other chat, Remind me and Forward → My notes do the same with a message you care about.

The Calendar tab sorts it by day — overdue, today, tomorrow, this week, later, no date — or in a month view. Tap an entry to mark it done, snooze it ten minutes, an hour or until tomorrow, skip just this time or change its date. A note whose lines start with [ ] becomes a checklist; the list button in the composer writes them for you.

Everything stays on your phone: the calendar does not use the system calendar, has no widget and does not sync anywhere. So that a reminder can go off even if the phone has closed the app, the system is only given the time of the next reminder, never the text; with a PIN set and the app closed, the notification says you have a reminder, but not which one, until you unlock. On the computer, reminders notify you while PrivChat is open; on the iPhone, with the app closed they also only say there is a reminder.