Versions understand each other.

• LoRa mesh with MeshCore nodes: fixed messages getting lost when the node had a copy of the PrivChat channel somewhere else. The app removes it automatically when connecting.
• More stable when turning the mesh off while it is transmitting.

• LoRa mesh: fixed radio messages arriving in only one direction when a phone fell behind in the key change with its contact.
• Own mesh: the link to accept it no longer goes out through the new mesh (which the other can't hear yet); everyone's mesh is used until the other one uses it.
• Android: changing the firmware of an already paired node no longer requires unpairing it.

• LoRa mesh with MeshCore nodes: fixed messages getting lost when the node had a copy of the PrivChat channel somewhere else. The app removes it automatically when connecting.
• More stable when turning the mesh off while it is transmitting.

• LoRa mesh: fixed radio messages arriving in only one direction when a phone fell behind in the key change with its contact.
• Own mesh: the link to accept it no longer goes out through the new mesh (which the other can't hear yet); everyone's mesh is used until the other one uses it.

• LoRa mesh: now also with MeshCore nodes, besides Meshtastic. The app recognises the node you connect (Bluetooth or cable) and uses its network; your messages stay encrypted the same way.
• Own meshes work on both networks.
• Settings → Mesh shows whether the node is MeshCore, with its radio. Note: by radio you only reach people on the same network.

• Scan documents: in the chat's attach menu, "Scan document". The page is detected on its own, captured automatically when it holds still (or with the button), you adjust the corners and get a PDF of up to 300 pages.
• Color, grayscale or black and white; reorder, rotate and remove pages, and name the file.
• Everything happens on the phone, without Google services: the PDF carries no metadata and travels encrypted like any file.

• LoRa mesh: "Own meshes" shows whether each contact already uses the mesh, and warns you if you have been sending through it for a while and nothing from them arrives (for example, because they have not accepted it yet).
• In the chat, "Own mesh with this contact" shows the mesh you already share: resend the link, copy it or stop using it.
• In Chinese, "Use this mesh with…" now appears when long-pressing the link.

• LoRa mesh: now also with MeshCore nodes, besides Meshtastic. The app recognises the node you connect (Bluetooth or cable) and uses its network; your messages stay encrypted the same way.
• Own meshes work on both networks.
• Settings → Mesh shows whether the node is MeshCore, with its radio. Note: by radio you only reach people on the same network.

• PDF from images: in the chat's attach menu, pick several photos of papers; the page is detected on its own, you adjust the corners and get a PDF of up to 300 pages (on iPhone, "Scan document" with the camera).
• Color, grayscale or black and white; reorder, rotate and remove pages, and name the file.
• Everything happens on this device: the PDF carries no metadata and travels encrypted like any file.

• LoRa mesh: "Own meshes" shows whether each contact already uses the mesh, and warns you if you have been sending through it for a while and nothing from them arrives (for example, because they have not accepted it yet).
• In the chat, "Own mesh with this contact" shows the mesh you already share: resend the link, copy it or stop using it.
• In Chinese, "Use this mesh with…" now appears when long-pressing the link.

• LoRa mesh: own meshes are now listed in Settings → Mesh: which contacts use each one, copy its link to share it with another contact, and remove it (deleted from the node; its contacts go back to everyone's mesh).
• The "By radio with" list shows which mesh each contact uses.

• LoRa mesh: own meshes are now listed in Settings → Mesh: which contacts use each one, copy its link to share it with another contact, and remove it (deleted from the node; its contacts go back to everyone's mesh).
• The "By radio with" list shows which mesh each contact uses.

• LoRa mesh: messages that waited in the queue went out with an expired seal and the other phone discarded them, so one direction never arrived. Fixed.
• By radio only to the contacts ticked in Settings → Mesh; they are ticked by themselves when heard. Before, texts went to everyone and wasted air time.
• "Air used" no longer counts repeats the node skips while the channel is busy.

• LoRa mesh: a message is no longer re-sent over the radio every few seconds; the node used to run out of air time and go silent. "Air used" now also counts what your node repeats from others.
• The "cannot read what they send" notice no longer appears just because a radio message takes time to be confirmed.

• If you forget your PIN you can now start over from the PIN screen itself: everything on this phone is erased, after confirmation, and the app starts afresh.

• LoRa mesh: your Mailbox at home with a node acts as a gateway: away and offline, you leave it what you have by radio and collect what was left for you.
• Own meshes with a contact: a channel with its own name and key (private over everyone's mesh, or a separate mesh), shared by an encrypted message; "Use this mesh with…" from the message.
• Fixed: "Use a neutral name" for the node did nothing.
• Built-in Tor bridges renewed.

• LoRa mesh: messages that waited more than 10 minutes in the queue went out with an expired seal and the other phone discarded them, so one direction never arrived. The seal is now applied at transmission time.
• "Air used" no longer counts repeats the node does not make while the channel is busy.
• By radio only to the contacts ticked in Settings → Mesh ("By radio with"): they are ticked by themselves when heard by radio. Before, texts went out by radio to every contact, including those without a node, wasting air time.

• LoRa mesh: a message is no longer re-sent over the radio every few seconds; the node used to run out of air time and go silent. "Air used" now also counts what your node repeats from others.
• The "cannot read what they send" notice no longer appears just because a radio message takes time to be confirmed.

• macOS: the video player now carries its libraries inside the app, signed; they are no longer extracted to a separate folder where the system could block them.

• If you don't have the phrase (or don't remember the PIN), you can start from scratch right from the login screen: everything is erased from this device, with confirmation, and the app starts again.
• On macOS and iPhone: "See a demonstration" on the entry screen, with example contacts and conversations, without touching your profile.

• LoRa mesh: the Mailbox at home with a node acts as a radio gateway for its owner; own meshes with a contact ("Own mesh with this contact" in the chat menu and "Use this mesh with…" from their message).
• Fixed: "Use a neutral name" for the node did nothing.
• Built-in Tor bridges renewed.

• LoRa mesh: pairing the node no longer gets stuck on "Connecting…" after entering the PIN.
• The mesh screen now shows the node's region, battery, name and air time used.
• If the PIN dialog expires (30 s), the app says so and lets you retry.
• The mesh also reaches the desktop (Windows, Linux, macOS), the iPhone and the bot: your contacts can use it from any of them.

• LoRa mesh (Meshtastic): text messages by radio when there is no internet and no one nearby.
• Pair a Meshtastic node over Bluetooth in Settings → Network → Mesh; the app proposes your country's region, warns if the node broadcasts its position and offers a neutral name.
• Off by default: it is the last resort, after Tor and In person.
• Messages sent this way show "by radio" until the contact confirms them. Content stays encrypted by PrivChat.

• LoRa mesh: "Connect" to the node by USB or network now works (it did nothing in 1.8.0).

• LoRa mesh: text messages by radio through a Meshtastic node when there is no internet and no one nearby. In Settings → Mesh: the node by USB (COM4, /dev/ttyACM0) or by network (host:4403) on the PC; by Bluetooth on the iPhone.
• The app proposes your country's region, warns if the node broadcasts its position and offers a neutral name; each change with its own button.
• Off by default: it is the last resort, after Tor and In person. Messages sent this way show "by radio" until the contact confirms them.

• Groups of up to 200 people. A group with more than 16 members requires everyone to be on this version; the app tells you who is missing.
• Optional visible name (Settings): your contacts see it with a ~ in front. Leave it empty and nothing is sent.
• "Group members" tab for people you know through a group and have not talked to privately. Anyone you have not renamed shows the group name after theirs ("Member ab12cd34 · Work"), also in the chat header.
• The group shows "connected with n of m" while someone is missing, and warns if a message from someone may be missing (it completes on its own).
• Group sends go out in parallel and no longer wait for members who are offline.

• Groups of up to 200 people. With more than 16, everyone needs this version; the app tells you who is missing.
• Optional visible name (nobody checks it): your contacts see it with a ~ in front.
• "Group members" tab; anyone you have not renamed shows their group name after theirs.
• The group shows "connected with n of m" while someone is missing and warns if a message may be missing (it completes on its own).
• Group sends go out in parallel and no longer wait for offline members.

• The theme follows the system by default: if your phone is in light mode, PrivChat is light; if it is dark, PrivChat is dark. If you had already chosen a theme, it is kept. Change it any time in "My identity".
• Nothing else changes here: the rest of this release is for the desktop and the iPhone.

• Fixed: the chosen chat background was not shown; it is now drawn behind the messages, as on Android.
• Fixed: photos published in a channel were not shown on the PC (readers on the phone did see them).

• Fixed: choosing a chat background pattern showed "Invalid color value" on the PC and closed the app on the iPhone.
• Fixed (PC): "Channels", "Archived" and the "+" to create folders were out of sight in the tab row; they now wrap to the next line.
• The theme follows the system by default. If you had already chosen one, it is kept; change it in Settings.

• Terms of use: accepted once when you open the app. No tolerance for objectionable content or abuse.
• "Report" in the menu of a contact, a group, a channel and a story. It opens an email draft that you write: PrivChat sends nothing on its own. Next to it, what cuts it off at once: block, leave, leave the channel or hide their stories.
• Settings → "Support and abuse reports": the contact email, the support page and the terms.

• Terms of use: accepted once when you open the app. No tolerance for objectionable content or abuse.
• "Report" in the menu of a contact, a group, a channel and a story. It opens an email draft that you write: PrivChat sends nothing on its own. Next to it, what cuts it off at once: block, leave, leave the channel or hide their stories.
• Settings → "Support and abuse reports": the contact email, the support page and the terms.
• Fixed: in "Change the date" of a note, with a large font, the "Save" button was split.

• Fixed: in "Change the date" of a note, with a large system font, the "Save" button was split letter by letter.

New: your calendar, inside My notes.

• A note can have a date: events, tasks with a checkbox and things that repeat (daily, weekly, monthly, yearly).
• Up to three reminders in advance, and snooze from the notification itself.
• A list by day and a month view; checklists; four labels.
• Reminders and scheduled sending now take any date and time.

Everything stays on your phone: no system calendar, no cloud. The system only gets the time of the next reminder.

• macOS only: the app now opens on macOS 27. A library that used to be loaded from a temporary folder now ships inside the app, signed and notarized with it.

• New: "My notes", the chat with yourself, at the top of the list. Nothing leaves this device.
• And its calendar: notes with a date (events, tasks with a checkbox, things that repeat), up to three reminders in advance, snooze, a list by day and a month view, checklists, four labels.
• Reminders and scheduled sending take any date and time.
• Reminders notify you while PrivChat is open.

New: the Mailbox.

• A computer or a Raspberry Pi at home keeps your contacts' messages while you are away and hands them over when you are back. Sealed: the Mailbox cannot read them. Pair it in Settings > My Mailbox.
• Optional: with internet, people can leave you messages even with your phone off.
• "Talk in person" has its own screen, and you choose Wi-Fi or Bluetooth.

"Talk in person" and packages, more private.

• The key you and your contact use to recognise each other nearby, or to open a package, now renews itself every day and the old one is deleted: anything someone recorded before can no longer be attributed.
• Ready to meet iPhones over Bluetooth too.
• Works the same with people who have not updated yet.

• New: "My Mailbox" in Settings. A device at home keeps your contacts' messages while you are away and hands them over when you are back, sealed: the Mailbox cannot read them.
• Optional: with internet, people can leave you messages even with your computer off.

• The key you and your contact use to recognise each other on the same network, or to open a package, now renews itself every day and the old one is deleted: anything someone recorded before can no longer be attributed.
• Works the same with people who have not updated yet.

Fixes for "Talk in person" and a clearer package.

• Photos now arrive over Bluetooth, not just text.
• "Create a network here" no longer vanishes after a few seconds, and it really closes when you turn the mode off.
• "Carry messages" has its own screen: sealed, messenger and delivery. Save it on a USB stick or share it through any other channel.

New: talking without internet.

• "Talk in person" (chat menu): on the same wifi, even with no way out, or within Bluetooth range, you both turn it on and write. It turns itself off.
• "Create a network here": with no wifi, your phone becomes the network.
• "Carry messages": what is pending goes in a file only they can open; carry it on a USB stick and they import it.
• No relaying through others. Anyone nearby can tell you use PrivChat.

• "Carry messages" has its own screen: sealed, messenger and delivery. Save it on a USB stick and, if it did not arrive, send it back to the internet with one click.
• Importing a package now shows who sent it and how many messages were opened.
• "Talk in person" no longer cuts large transfers when the local network is slow.

New: talking without internet, as in Android 2.10.

• "Talk in person" (conversation menu): if you are on the same local network without internet (the same wifi, or a phone's hotspot), you both turn it on for each other and write. It turns itself off after 15 minutes, 1 hour or 4 hours; the default is chosen in Settings.
• "Carry messages" and "Import a package": what is pending for a contact is saved in a file only they can open; carry it on a USB stick or send it any way you like.
• The first time you turn on In person, the system may ask whether PrivChat can use the network: it has to be allowed.

Stories: when a story had several clips, the second one never started, neither when the first ended nor when tapping the screen. Clips now play one after another, a tap on the right goes to the next one and a tap on the left goes back; after the last one, the viewer closes.

Stories: on some phones a clip longer than five seconds could not be published ("above the ceiling"). The cause was in the phone: Android raised the video bitrate on its own, the audio used the manufacturer's rate and the file came out with 400 KB of padding. Clips now last their full 15 seconds and always fit. Video messages are 400 KB lighter too.

Connection fix: on some phones the app said "published" but nothing came in or went out for hours, and only forcing "no bridges" fixed it. The cause was Tor marking entry relays as dead forever after ordinary network drops (Wi-Fi going to sleep, switching networks). The app now rehabilitates them on every start, restarts itself when the service stops answering and, if that still does not help, starts from scratch. "Reachable" is shown only once the check has really come back.

Stories: record a video of up to 15 seconds and publish it to your contacts; they see it for 24 hours, then it disappears on your phone and on theirs. Chain up to four clips, add a caption, choose who can see them and remove one early. Nobody knows whether you have seen a story: there is no "seen" message at all; if you reply or react, only its author knows, in private. Each story travels encrypted to each contact, and the app tells you how many and how much it weighs before you publish.

Connection fix, the same as in Android 2.9.1.

• Tor marked entry relays as dead forever after ordinary network drops (suspending the computer, switching networks) and the program stayed "published" without connecting to anyone.
• They are now rehabilitated on every start; if the service stops answering, Tor restarts, and if that still does not help, it starts from scratch.
• "Reachable" is shown only once the check has really come back; until then, "published, checking".

Stories, like on Android 2.9.

• The stories your contacts publish (videos of up to 15 seconds, 24 hours) appear in a row above the chat list.
• They play one after another inside the app, without being written to disk in the clear.
• You can reply in private quoting the clip and react with an emoji; only the person who published it sees it.
• Nobody knows whether you have watched a story: there is no "seen" message at all.
• "Hide this person's stories" for whoever you want, and in Settings the list to show them again.
• Publishing stories needs a camera and is done from the phone.

Photos, videos and voice notes inside the app, like on Android.

• Photos show in the conversation and full screen, with zoom; they are decrypted in memory and saving them is a separate step.
• Videos play inside the app, without being written to disk in the clear.
• Voice notes: hold the microphone to record and release to send; they play right in the bubble.
• "Media in this chat" gathers photos, videos, notes and files.
• "Verify in person" and the note on how you met each contact, as on the phone.

If a conversation had gone out of sync and you rebuilt the session, the messages that were waiting stayed "unconfirmed" forever and the "cannot read" warning came back every time the contact wrote. Now, when the session is rebuilt, what was waiting is re-encrypted with the new session, arrives and gets confirmed; what cannot be resent (a one-time photo) is marked "not delivered" so you can send it again. Your conversations, keys and address stay the same.

What was waiting in the queue now arrives after rebuilding a session.

• If a conversation went out of sync and the session was rebuilt, the messages that were waiting stayed "unconfirmed" forever and the "cannot read" warning came back every time the contact wrote. They are now re-encrypted with the new session, arrive and get confirmed.
• What cannot be resent (a one-time photo) is marked "not delivered: session rebuilt" so you can send it again.

Looks right on more computers, and in your language.

• In Windows virtual machines, text could disappear and colours could look wrong. The app now detects this and draws without graphics acceleration; Settings has a switch in case another computer needs it.
• Some texts were split across two indented lines. Not any more.
• Several messages appeared in Spanish whatever the language. They are now translated.

Bridges that work in more places.

• The bridges that come with the app have been renewed and tested one by one: many of the old ones no longer connected.
• The bridges window can be closed while it checks the connection; you can repeat the check later from Settings.
• If the built-in bridges do not connect, the app tells you to fetch others.
• On Linux, the transport that disguises your traffic now starts in the .deb and AppImage packages.

Full synchronization of fixes and build cleanup to ensure compatibility improvements correctly reach all devices (Realme, Samsung and others). Stability of cover traffic is guaranteed across all supported versions. Your conversations, keys and address stay the same.

Expanded support for devices running Android 11 (API 30) and newer. Compatibility has been lowered to cover more models without sacrificing security: video messages are still recorded exclusively in RAM (memfd_create). Your conversations, keys and address stay the same.

Fixed a crash on startup affecting devices running Android versions older than 15. Improved native compatibility for the cryptographic cover traffic generator to ensure stability across all devices. Your conversations, keys and address stay the same.

A short cue now plays when a message arrives while the app is open, in the list or inside a conversation: until now nothing sounded and it was easy to miss. It does not sound like the notification, so you know where to look, and it stays quiet when your phone is silenced. And muting a chat now really mutes it: before, it showed the mark but notifications kept coming. You can turn it off in Settings. Your conversations, keys and address stay the same.

Two things that used to get stuck. If you changed your Tor bridges while the app was still trying to connect, the screen waited forever and could not be closed; now it answers and tells you what to do. And in a group, when someone deleted a message for everyone or edited it, the change could take a long time to reach the others; now it goes out immediately. Your conversations, your keys and your address stay the same.

The first version of PrivChat for computers, on Windows and Linux. It is the same Tor-encrypted messaging as the phone, and it talks to it: contacts, groups, channels, attachments, QR codes with the camera, and bridges for when Tor is blocked.

• It opens with a 13-word passphrase: a PC has no secure chip to keep the key in.
• It has its own identity, separate from the phone's.

An update of the libraries the app uses internally, including the Tor ones. None of them had a known security problem: this is maintenance, so nothing falls behind. Nothing you see or use changes; your conversations, your keys and your address stay the same.

A stability and security fix in the layer that talks to Tor. Shutting the connection down at the exact moment a message was being sent could close the app; it no longer can. The app also stops accepting an unlimited number of incoming connections and stops waiting forever for data that never arrives, so nobody who knows your address gains anything by trying to exhaust your phone's memory. Your conversations, your keys and your address stay the same.

The key that encrypts this phone's database is no longer the secret the other keys come from: it is now derived separately, so one key does not open everything. The first time you open the app after updating, the database is re-encrypted on its own; it can take a few seconds and you need to do nothing. Your address, your conversations and your files stay the same. If you move to another phone, update that one too: an older version cannot open the move file.

Fixes from an internal audit by SecureAudit. A conversation can no longer go silent in one direction after the other phone spends a day switched off; the phone keeps fewer old keys; onion-service circuits use full vanguards; a message the app does not understand is no longer mistaken for a broken session; and the released build leaves no traffic log on the phone. Anyone still on 2.1 needs to update to scan your QR code; everything else works as before.

Corrected on 16 September 2026: this note said “external audit”. The audit was internal, carried out by SecureAudit.

Closing the cryptography. Each message's envelope — the part that says who writes to you — no longer depends on your identity key: with each contact it is sealed with a key born from the conversation itself that changes with it, so neither a stolen key nor a quantum computer could open past envelopes. The keys others use to start a contact with you are renewed weekly. Everything keeps working with people on 2.1; if you send them an invitation as text, ask them to update, or to scan the QR.

Post-quantum healing. Until now, someone who copied your phone's state and recorded your traffic could, with a future quantum computer, read that conversation forever. Now both sides keep folding fresh ML-KEM secrets into the keys, inside the padding every message already carried: nothing changes on the network, in your identity or in your contacts. With a contact still on 2.0 everything works as before; the verification screen tells you where it stands.

Fixes for 2.0. In a chat from your previous identity, the app no longer offers to verify the fingerprint: that identity is gone, and the only thing that makes sense is "Add again". And a leak is fixed that, after updating, filled "Invitations" with unused "Member…" entries you never created: they stop appearing and the ones already made are cleaned up automatically.

Now you always receive. If you have a PIN and Android closes PrivChat, your phone stopped being reachable and nothing arrived until you opened the app. Now it keeps your address published and keeps whatever is sent to you exactly as it arrives, encrypted and unopened, until you unlock. And if you ever stop being able to read what someone sends, the app tells you and offers to rebuild that conversation with one tap, with no fingerprint to compare again. Same encryption, same Tor.

Now you know when you cannot receive. If you have a PIN and Android closes PrivChat, the service starts again but cannot open your vault without that PIN, so your phone stops being reachable. Until now that happened silently and you only noticed because nothing arrived. Now you get a notice that takes you to open the app and unlock it, and everything sent to you meanwhile arrives then. The notice clears itself as soon as the service is back.

You can change phones now. Until today, a new phone meant starting over: new address, and every contact adding you again. Now you take your identity, your address and your conversations in a single file, and your contacts do not have to do anything, because your address does not change. The file needs two secrets to open: the passphrase you choose and your PIN. That is why exporting requires a PIN, and the old phone stops so it cannot break anyone's conversation.

Your channels no longer hand out the whole archive. Until now a channel invitation opened everything published since day one, and whoever had the key could read forever. Now you can start a stage: anyone invited from that point on will not see what came before, while your existing readers keep reading without doing anything. And if the key has leaked, you can cut: everyone is out and only comes back with a new invitation. You can also rename a channel now. Same encryption, same Tor.

Two things. So you are never left unreachable: PrivChat only receives messages while its service runs, and if Android closes it, it now comes back by itself, after closing, after an update and when the phone boots. Every twenty minutes it checks it is still reachable over Tor, and if it was stopped it tells you for how long. And groups: type @all, close polls, your phone asks for permissions by itself if you updated late, and a moderator can propose members for the admin to decide and sign.

Files of several GB. The 512 MB cap is gone: the limit is now the protocol's own, about 64 GB per file. And above all, a transfer knows where it was: if Android freezes or closes the app, or you restart the phone, it carries on from the part it had reached instead of starting over. Neither side keeps a second copy. Before a file that will take hours you are told how long. Going past 512 MB needs this version on both phones. Same encryption, same Tor.

Groups: @ mentions (type @ and pick who; each phone shows its own nickname, only the identifier travels; a notice and an “@” mark when you are mentioned), moderators (named by the admin; they can remove members, set read-only and delete anyone’s message for everyone, always through the admin’s phone, which is the one that signs) and permissions: writing, polls, reactions and editing, each for everyone or only admin and moderators. Members on an older version keep reading everything.

Large files: up to 512 MB per file, in 1 MB parts with retries, never loading the whole file into memory. You see the progress when sending and, when receiving, “Receiving n/m parts” with the name. Before a large file, a notice with the size and the time Tor will likely need. And a five-screen introduction on first open, with what makes this app different from the usual ones and what it costs; skip it, and with “Do not show again” it stays away (it lives in Settings). Same encryption, same Tor.

My notes: a chat with yourself, at the top of the list. Write yourself whatever you want to keep — notes, photos, files, voice notes — quote it, edit it, pin it or set a reminder, and search it like any chat. From any conversation or group, “Forward” to “My notes” saves it there. Everything stays encrypted on this phone: nothing travels to anyone, not even over Tor. Same encryption, same Tor.

View-once photo: the other side opens it once and it is erased from their phone; you keep no copy, it stays out of the gallery and cannot be forwarded. Offered only once your contact has a version that can open it. Video messages can be swiped through like photos. A message just sent reads “sending…” or “sent”: the “unconfirmed” warning and the “Now” button appear only after the time Tor predictably needs. Empty chats, groups and channels are shown as a card. Same encryption, same Tor.

Edit a sent message: the other side sees the new text with an “edited” mark, no new bubble. “Delete for everyone” leaves the message as “deleted” on both sides; it is a request and it says so. Polls in groups: up to eight options, one or several answers; you see the count and your vote, not who voted what. Read-only in groups: the admin decides who writes. An older version shows an edit as a quoted reply and a deletion as an empty reply. Same encryption, same Tor.

Block a contact: you receive nothing from them and cannot write to them; unblock any time. Pin messages to the top of a chat, mark the ones you still have to deal with, and set a reminder on one. A private note on each conversation, group or channel: only you see it. Schedule a message for an hour from now, tonight or tomorrow. In groups, “Reply privately” opens the chat with the author. And each contact’s trust level, by name, under “Verify”. All of it is local. Same encryption, same Tor.

Profile photo: you now choose the framing yourself, dragging and pinching the photo inside the square before sending it; the same for the group and channel photos. Tap the avatar in the header of a chat, a group, a channel or in “My identity” to see it full size. And in the chat’s photos you can now swipe from one to the next without leaving and coming back. Nothing changes underneath: same encryption, same Tor.

Profile photo. Set a photo in “My identity” and your contacts will see it once you have written to each other; the name they see is still the one they gave you. The admin can set the group photo, and the publisher the channel photo. It travels encrypted inside the conversation, with no GPS or phone data, under 12 KB. If you prefer, only to contacts you have verified (Settings › Privacy). Notifications never show it. Same encryption, same Tor.

Photo captions: when you send a photo you can write a text under it, as in channels; it travels encrypted inside the same message. Chat backgrounds with patterns: six of our own — dots, lines, grid, waves, leaves and doodles — besides the six tints, good in both dark and light theme and using nothing of yours. A back arrow and a three-dot menu like in any messenger, and the pinned and muted marks are easier to see in the list. Same encryption, same Tor.

Settings now has its own screen, organized in five groups: appearance, privacy and security, notifications, network and PrivChat. “My identity” keeps what is yours: your ID, your verification fingerprint and your invitations. And every menu in the app now has an icon, hand-drawn so they look the same on any phone and in both themes. Nothing changes underneath: same encryption, same Tor, same messages.

Light theme option in “My identity”. Forward several messages at once: select them and choose who to send them to. In groups you can now forward a message and select several to delete or forward, just like in a regular chat. The chat menu is tidier: “Verify in person” brings together the QR check and the manual fingerprint comparison. And if a contact has no secure session with you yet, the chat says so plainly. Plus the 1.11.1 improvements: voice notes five times lighter and a gallery by type.

Voice notes like in the apps you already know: hold the microphone to record whatever you want to say, release to send, slide left to cancel; or tap to record hands-free. They weigh five times less than before at the same quality, and consecutive notes play one after another. The chat gallery separates photos, videos, voice notes and files, and notes can be played right there. Attachments travel lighter. Reply to a video message with another in one tap. Android 15 and 16.

Push to talk: hold the microphone to speak, release to send; clips of up to 8 seconds that weigh like a long text, and if you keep talking the next one goes out. In “Voice mode” incoming clips play by themselves. Consecutive voice notes play one after another. The chat gallery now separates photos, videos, voice notes and files, and notes can be played right there. Attachments travel lighter. Reply to a video message with another in one tap. No real-time calls, on purpose. Android 15 and 16.

New icons across the app. The attach, camera, microphone, play and other controls are no longer emoji: they are now single-colour drawings of our own, so they look the same on every phone and follow the theme colour. Emoji stay where they belong: in reactions. No protocol or data changes.

You can now react to a message with an emoji, in chats and in groups. Plus more comfort, all local: pin chats to the top, mute them and archive them; drafts are kept and shown in the list; select several messages at once; day separators and a "new messages" divider; swipe to reply; see a chat's media at a glance; play voice notes at 1.5x or 2x. Fixed the channel compose box, which got squeezed at large font sizes.

PrivChat's engine is now a portable core the app shares with bots: headless nodes that publish to channels or reply 1:1, speaking the same protocol (guide on the website). The app behaves the same and your identity does not change.

In "Verify in person" you can now paste the code as well as scan it, and onion services raise the "vanguards" defense.

Also: compatibility with 16 KB page-size devices and cleanup of deprecated APIs.

Background delivery, hardened after testing on real devices: the app keeps the processor awake while the service runs, retries the queue when the network returns or power saving ends, and warns you if Android is limiting it. Recommended: battery set to "unrestricted".

Plus a more manageable main list: All / Unread / Contacts / Groups / Channels tabs, your own named folders (long-press a chat → "Tabs…") and a single "New" button.

Channels grow up:

• Photos and voice notes with captions in posts (photos re-compressed and metadata-stripped, as always). Reading them needs 1.8.
• Optional alert for new posts if you enable background refresh.
• Search now covers channels; send invitations through a chat; "not responding since…".
• Publishers can trim served history, with explicit reader re-join.
• Details show data served/received, plus measured group cost.

New: channels — one-way broadcast with anonymous readers. Your channel gets its own onion address and signing key; readers fetch over anonymous circuits and the publisher can't tell who reads. Posts are signed and chained: history can't be rewritten silently.

Polished after the first real-world testing:

• "Join a channel" can now scan the QR code (previously pasted text only).
• Long-press a channel in the list for its options, as with chats and groups.

New: channels — one-way broadcast with anonymous readers.

• Publish: your channel gets its own onion address and its own signing key, unlinked from your messaging identity.
• Read: subscribe with an invitation (QR or text) and fetch over an anonymous circuit; the publisher can't tell who reads.
• Posts are signed, encrypted and hash-chained: history can't be rewritten silently.
• Optional per-channel background refresh, and ephemeral deletion of what you've read.

New: groups, polished through their first real-world testing:

• Chat backgrounds (built-in tints), for groups and 1:1.
• Group chat now looks and works like 1:1: search, jump to quote, same composer.
• Contacts introduced by a group now tell the truth: "you met through group X".
• Fixes: keyboard covering the field, gap under the composer, held-back messages that no longer wait for you to write.
• Long-press a chat in the list for its options.

New: groups, plus fixes from their first real-world testing:

• Held-back group messages no longer wait for you to write: the queue catches up on its own as soon as the other device is reachable again.
• Fixed: the keyboard covered the text field in group chats.
• Long-press a chat in the list for its options without opening it.

Groups: end-to-end encrypted, no servers, up to 12 members, text only. Joining requires this version.

New: groups (1.6.0) plus two fixes from first real-world use:

• Fixed: the keyboard covered the text field in group chats.
• New: long-press a chat in the list to rename, disappearing messages, clear, verify, leave the group or delete — without opening the chat.

Groups: end-to-end encrypted, no servers, up to 12 members, text only. Joining requires this version.

New: groups.

• End-to-end encrypted groups with no servers: every message travels directly to each member over Tor.
• Up to 12 members. The group creator manages the member list, signed with their key.
• Text only: attachments stay in private chats.
• Other members can learn your .onion address; the app warns you before you join.
• Joining requires this version; older versions ignore the invitation without breaking.

Plus minor fixes.