FAQ

Do I need a phone number or email?

No. There is no registration, no profile, no username. Your identity is a cryptographic keypair generated and stored only on your device. You share it with a contact when you decide — ideally by scanning a QR code in person.

How do I start a conversation?

Add a contact once — by scanning their QR in person, or by adding them remotely and verifying their safety number — and from then on you just write to them. The conversation is derived from your two identities, so there is no room code to share and nothing for the server to link. For a one-off with someone who isn’t a contact, you can still open a room with a shared key or an invite QR.

Can I keep separate identities?

Yes. One app-lock can hold several identities, each with its own keys and its own contacts, and you choose which identity you talk to a given contact from. Keep work, family, and a pseudonym apart on one phone — no key, contact, or Tor circuit is shared between them, and the relay holds no record that ties them together. What the relay can still try is timing (a phone’s identities wake up on the same schedule); we measured that, and we say what it finds in the whitepaper.

How do I know a contact is really them?

Every contact has a safety number — a fingerprint of your two identities. Added in person by QR, it can’t be tampered with. Added remotely, you compare the safety number out-of-band — a call, another app, a piece of paper — and one digit off means stop: someone is in the middle. Verified contacts are marked. The binding is deniable: there is no per-message signature that could later prove who said what.

What does “your key is anything” mean?

A conversation key can be a password, any file you both have (a PDF, a photo, an MP3), a link the app fetches over Tor (the key is the hash of what it downloads, so the content must stay identical), or a Shamir split across several files. It is hashed locally and never transmitted. Whoever holds the same key can read; everyone else sees a locked block.

What can the server see?

Almost nothing. The relay is deaf: it stores opaque encrypted blocks and timestamps, plus one-time invite tokens as hashes only. No senders, no recipients, no key hints, no contact lists — that information never reaches it. Seized, it reveals noise.

What’s left is the traffic itself — that something moves — and the app narrows even that: every block is padded to a size bucket (measured: 0.04 bit of length information per frame, and the same size whatever the mode or policy), the conversation address rotates on a short clock and is phase-shifted per conversation (so an outside timing slip ties you to one address for one epoch, not to a fixed handle), and an optional high-risk mode adds cover traffic so that, inside an open conversation, the relay cannot tell which frames are yours. What we measured and will not hide: from timing alone, the relay can still group the addresses of one phone and keep that pseudonym across rotations — it learns that a device is active and roughly how many conversations it keeps, never who it is, where it is, or what was said. The numbers, and the fix under decision, are in the whitepaper.

How does Tor fit in?

Tor is on by default: you reach the network as a Tor v3 onion service and the server never learns your IP or location. You can switch to Tor bridges where Tor itself is blocked, or to a standard connection when hiding your location isn’t the point — but turning Tor off is a deliberate step the app makes you confirm, because off means the server sees your address. The app states plainly what each mode reveals.

What happens if I lose my key?

It’s gone — and so are those messages. Keys and decryption exist only on your device; there is no account and no administrative override, so we cannot recover them even if asked. That’s the point. Back up your keys: the app exports your profile as a single sealed file — Argon2id with 256 MiB of memory, padded so its size does not reveal how many contacts you have, and optionally without message history, because we measured that the file’s size does give away how much history is inside. A backup opens with the secret alone, anywhere, with unlimited attempts — so the secret you seal it with is the whole game, and the export is strict about it: a dictionary word dressed up with digits and a symbol gets a warning, not a pass.

Is it really private if you operate the server?

The design assumes the operator can be compromised. That’s why access is decided purely by who holds the key, why the server stores only ciphertext, and why Tor hides where you are. We tell you exactly where each protection ends — see the whitepaper.

Could police do to YGOOW what they did to EncroChat?

Not the way it scaled. EncroChat was broken in 2020 by an implant on the handsets plus control of its central servers — never by breaking the cipher — and those central servers are why one operation reached tens of thousands of people. YGOOW has no such centre: the relay is deaf, holds no keys or contacts, and a seized one is noise, so there is no single place to harvest everyone from. What we honestly do not stop is the other half — an implant on your unlocked phone reads your screen regardless, exactly as the trust model says. The full story is on the blog: they broke the content, not the cipher.

And Ricochet — police deanonymised that, didn’t they?

They did, in 2024 — but again, not by breaking Tor or the cipher. German investigators timed the Tor network and used a guard-discovery attack to find which entry node a Ricochet user’s onion service kept using, then made the ISP name the subscriber. It worked because in Ricochet every user is a standing onion service. In YGOOW the onion service is the relay; you are a Tor client, with no standing service of your own to locate that way — and traffic is padded and circuit-isolated on top. The limit we don’t pretend away — a global adversary watching the whole network at once — is named in the whitepaper. Full story: they broke the metadata, not the cipher.

Do you use Google for notifications?

No. No Firebase, no FCM, no push broker — nothing that would learn who pings whom. A local foreground service keeps the connection alive while the app is unlocked and delivers there; the notification you see carries no content and no sender, only that something arrived. Lock or close the app and delivery stops — consistent with the rest of the design: nothing on-device, nothing to leak.

Why isn’t there a built-in VPN?

On purpose. A VPN run by us would see your real IP — and could link it to your YGOOW use, the exact correlation the deaf relay and Tor are built to remove. A free one would also need accounts and rate-limits, dragging identifiers back into an account-less app. If you want a VPN, run a system one yourself; we would rather not be a party that could deanonymise you, even if we promised not to.

Will a quantum computer read my messages one day?

That is the right question to ask, because the attack starts now: an adversary records your traffic today and decrypts it whenever the hardware arrives. So contact conversations don’t rest on X25519 alone — a quantum-resistant key exchange (ML-KEM-768, the NIST standard) runs alongside it, and both results are mixed into one key. It’s a hybrid, deliberately: an attacker must break both, so the new algorithm can only add safety, never subtract it. What we won’t say is “quantum-proof” — nobody honest says that about a field this young. See the whitepaper for the parameters, or learn the words for the plain version.

Doesn’t post-quantum crypto need a key server?

Usually, yes — and that is the interesting part. The standard approach parks one-time keys on a server so a first message can be encrypted to someone who is offline. Our relay is not allowed to hold anything about you, so we don’t have that option. Instead your identity carries its own long-term post-quantum key, which travels with the rest of your identity when you swap codes — nothing uploaded, nothing requested, nothing burned.

The honest cost is elsewhere, and it is about healing rather than post-quantum: the first chain of a conversation still starts from a key derived from the secret you two already share, so it is not yet post-compromise-fresh — full healing kicks in after one round-trip. We write that down rather than round it up — see the comparison.

Why do I have to choose a security level?

Because a default is a decision made for you by someone who won’t be there when it matters. YGOOW makes you pick how each conversation is protected — there is no insecure default, and if you choose nothing, you can’t chat. It takes one tap and a few honest words. See choosing your protection.

Is YGOOW open source?

No — and we won’t pretend otherwise. The app stays closed-source. Trust here does not come from reading our code; it comes from the published whitepaper, an independent audit we have committed to, and a signed warrant canary you can verify yourself. We mark this plainly in the comparison, because the projects that blur it are the ones to distrust.

Can you be forced to hand over my messages?

There is nothing to hand over. We never negotiate or hold your keys — they are agreed between people offline, and our relay stores only ciphertext. You cannot be compelled to surrender what you never possess; that property is designed in, not promised. The full reasoning, and its limits, are in the trust model.

What if I am forced to unlock my phone?

You get tools, not a promise. You can set a decoy password that opens a separate profile — the one you show under pressure — while your real profile stays hidden in the same store. We measured it the way a forensic examiner would work, over months of simulated use: without the decoy password, one or two copies of the phone’s storage don’t reveal the hidden profile, and the unlock takes the same time. With the decoy password, a never-used decoy is a clue, and two copies show that the real profile was used in between — so use the decoy like a real profile. A panic lock disarms your fingerprint and re-locks the app, so a finger held to the sensor opens nothing; only a secret does, and a secret you can refuse or give as the decoy. And the screen itself can’t be screenshotted or caught in the “recent apps” preview. What this cannot hide is that you run YGOOW at all — we protect what’s inside, not the app’s existence, and we say so in the trust model.

What is a Dead Drop?

A one-time text note behind a link or QR code. You write it in the app — or on ygoow.com/d in any browser — and get a link; whoever opens it reads the note once, and the relay deletes it. The key sits in the part of the link after #, which never reaches any server, so a chat app’s link preview can’t open or burn it. You can add a password and send it on another channel: without it, the link can neither read nor destroy the note. What the relay sees is when the note was made, its size class and when it was opened — never the words.

Does the recipient need the app?

No. A Dead Drop link opens in a browser too, and a note left in the browser opens in the app. The app is the safer side of that trade, and the page says why: in a browser, the code that decrypts is sent by our server each time the page loads, and over a normal connection our server sees your IP address — Tor Browser and our onion address remove that. You can check the page’s math in your own browser.

What happens to a very long message?

It is split into numbered parts (“part 1/3”, “part 2/3”…), each padded to the largest size class, so every part of a long text is the same size on the wire. Nothing is dropped silently. The relay can still see that several large frames went out in a row — that a long text was sent, not what it said.

Do messages disappear?

You can attach conditions to a conversation or a single message: a lifetime (when it is erased), an open-after date (a message that won’t open before then — a time capsule), burn-after-read (gone after a set number of opens). All of it is checked on your device, so the server never learns when — or whether — you read. These guard against a phone seized later; they are an honest device-side policy, not a leash on the other end — they cannot force a determined or already-compromised recipient to forget. We say so rather than sell it as magic.

Is it safe if my phone is stolen?

Partly, and we won’t overstate it. Messages you have already sent stay sealed (forward secrecy), and in the strictest mode nothing that opens a conversation is stored on the device at all. The profile is encrypted at rest under your app-lock, the screen is blocked from screenshots and the “recent apps” preview, and a decoy profile and panic lock are there for a phone taken while you’re present (above). But no messenger survives a phone that is unlocked in an attacker’s hands or carrying spyware — it reads your screen regardless of any cryptography. We tell you exactly where that line is.

Can I use a hardware key (YubiKey)?

Yes — as a second factor for your app-lock. Turn it on and unlocking needs both your secret and a tap of your YubiKey (over NFC): the key computes an HMAC-SHA1 challenge-response that never leaves it, and that result is mixed into the app-lock key. Lose the key and your secret alone won’t open the app, so it’s opt-in for high-stakes use — and a physical token is itself a “tell”, which is why it’s off by default. It is a local access gate, not a per-message signature: your messages stay deniable. (USB-C is on the roadmap; today it’s NFC.)

When is the app available?

YGOOW for Android is on its way. Follow the blog for progress.