FAQ

Do I need a phone number or email?

No. There is no registration, no profile, no username. Your identity is a cryptographic keypair generated and stored only on your device. You share it with a contact when you decide — ideally by scanning a QR code in person.

How do I start a conversation?

Add a contact once — by scanning their QR in person, or by adding them remotely and verifying their safety number — and from then on you just write to them. The conversation is derived from your two identities, so there is no room code to share and nothing for the server to link. For a one-off with someone who isn’t a contact, you can still open a room with a shared key or an invite QR.

Can I keep separate identities?

Yes. One app-lock can hold several identities, each with its own keys and its own contacts, and you choose which identity you talk to a given contact from. Keep work, family, and a pseudonym apart on one phone — nothing on the device or the server links them.

How do I know a contact is really them?

Every contact has a safety number — a fingerprint of your two identities. Added in person by QR, it can’t be tampered with. Added remotely, you compare the safety number out-of-band — a call, another app, a piece of paper — and one digit off means stop: someone is in the middle. Verified contacts are marked. The binding is deniable: there is no per-message signature that could later prove who said what.

What does “your key is anything” mean?

A conversation key can be a password, any file you both have (a PDF, a photo, an MP3), a link the app fetches over Tor (the key is the hash of what it downloads, so the content must stay identical), or a Shamir split across several files. It is hashed locally and never transmitted. Whoever holds the same key can read; everyone else sees a locked block.

What can the server see?

Almost nothing. The relay is deaf: it stores opaque encrypted blocks and timestamps, plus one-time invite tokens as hashes only. No senders, no recipients, no key hints, no contact lists — that information never reaches it. Seized, it reveals noise.

What’s left is the traffic itself — that something moves — and the app narrows even that: every block is padded to a fixed size (so length tells nothing), the conversation address rotates on a short clock and is phase-shifted per conversation (so the relay can’t cluster your chats or tie one timing slip to your whole history), and a high-risk mode adds constant-rate cover traffic so when you send is hidden too. What no low-latency network can erase — an adversary watching the entire network at once — we name in the whitepaper.

How does Tor fit in?

Tor is on by default: you reach the network as a Tor v3 onion service and the server never learns your IP or location. You can switch to Tor bridges where Tor itself is blocked, or to a standard connection when hiding your location isn’t the point — but turning Tor off is a deliberate step the app makes you confirm, because off means the server sees your address. The app states plainly what each mode reveals.

What happens if I lose my key?

It’s gone — and so are those messages. Keys and decryption exist only on your device; there is no account and no administrative override, so we cannot recover them even if asked. That’s the point. Back up your keys.

Is it really private if you operate the server?

The design assumes the operator can be compromised. That’s why access is decided purely by who holds the key, why the server stores only ciphertext, and why Tor hides where you are. We tell you exactly where each protection ends — see the whitepaper.

Could police do to YGOOW what they did to EncroChat?

Not the way it scaled. EncroChat was broken in 2020 by an implant on the handsets plus control of its central servers — never by breaking the cipher — and those central servers are why one operation reached tens of thousands of people. YGOOW has no such centre: the relay is deaf, holds no keys or contacts, and a seized one is noise, so there is no single place to harvest everyone from. What we honestly do not stop is the other half — an implant on your unlocked phone reads your screen regardless, exactly as the trust model says. The full story is on the blog: they broke the content, not the cipher.

And Ricochet — police deanonymised that, didn’t they?

They did, in 2024 — but again, not by breaking Tor or the cipher. German investigators timed the Tor network and used a guard-discovery attack to find which entry node a Ricochet user’s onion service kept using, then made the ISP name the subscriber. It worked because in Ricochet every user is a standing onion service. In YGOOW the onion service is the relay; you are a Tor client, with no standing service of your own to locate that way — and traffic is padded and circuit-isolated on top. The limit we don’t pretend away — a global adversary watching the whole network at once — is named in the whitepaper. Full story: they broke the metadata, not the cipher.

Do you use Google for notifications?

No. No Firebase, no FCM, no push broker — nothing that would learn who pings whom. A local foreground service keeps the connection alive while the app is unlocked and delivers there; the notification you see carries no content and no sender, only that something arrived. Lock or close the app and delivery stops — consistent with the rest of the design: nothing on-device, nothing to leak.

Why isn’t there a built-in VPN?

On purpose. A VPN run by us would see your real IP — and could link it to your YGOOW use, the exact correlation the deaf relay and Tor are built to remove. A free one would also need accounts and rate-limits, dragging identifiers back into an account-less app. If you want a VPN, run a system one yourself; we would rather not be a party that could deanonymise you, even if we promised not to.

Will a quantum computer read my messages one day?

That is the right question to ask, because the attack starts now: an adversary records your traffic today and decrypts it whenever the hardware arrives. So contact conversations don’t rest on X25519 alone — a quantum-resistant key exchange (ML-KEM-768, the NIST standard) runs alongside it, and both results are mixed into one key. It’s a hybrid, deliberately: an attacker must break both, so the new algorithm can only add safety, never subtract it. What we won’t say is “quantum-proof” — nobody honest says that about a field this young. See the whitepaper for the parameters, or learn the words for the plain version.

Doesn’t post-quantum crypto need a key server?

Usually, yes — and that is the interesting part. The standard approach parks one-time keys on a server so a first message can be encrypted to someone who is offline. Our relay is not allowed to hold anything about you, so we don’t have that option. Instead both devices derive the starting post-quantum key from the secret the two of you already share, in the same instant, with nothing sent and nothing stored. The honest cost: that very first exchange is only as fresh as the secret it came from, and full healing kicks in after one round-trip. We write that down rather than round it up — see the comparison.

Why do I have to choose a security level?

Because a default is a decision made for you by someone who won’t be there when it matters. YGOOW makes you pick how each conversation is protected — there is no insecure default, and if you choose nothing, you can’t chat. It takes one tap and a few honest words. See choosing your protection.

Is YGOOW open source?

No — and we won’t pretend otherwise. The app stays closed-source. Trust here does not come from reading our code; it comes from the published whitepaper, an independent audit we have committed to, and a signed warrant canary you can verify yourself. We mark this plainly in the comparison, because the projects that blur it are the ones to distrust.

Can you be forced to hand over my messages?

There is nothing to hand over. We never negotiate or hold your keys — they are agreed between people offline, and our relay stores only ciphertext. You cannot be compelled to surrender what you never possess; that property is designed in, not promised. The full reasoning, and its limits, are in the trust model.

What if I am forced to unlock my phone?

You get tools, not a promise. You can set a decoy password that opens a separate, empty profile — the one you show under pressure — while your real profile stays hidden in the same store, with nothing on disk that proves it exists. A panic lock disarms your fingerprint and re-locks the app, so a finger held to the sensor opens nothing; only a secret does, and a secret you can refuse or give as the decoy. And the screen itself can’t be screenshotted or caught in the “recent apps” preview. What this cannot hide is that you run YGOOW at all — we protect what’s inside, not the app’s existence, and we say so in the trust model.

Do messages disappear?

You can attach conditions to a conversation or a single message: a lifetime (when it is erased), an open-after date (a message that won’t open before then — a time capsule), burn-after-read (gone after a set number of opens), even only near a place. All of it is checked on your device, so the server never learns when — or whether — you read. These guard against a phone seized later; they are an honest device-side policy, not a leash on the other end — they cannot force a determined or already-compromised recipient to forget. We say so rather than sell it as magic.

Is it safe if my phone is stolen?

Partly, and we won’t overstate it. Messages you have already sent stay sealed (forward secrecy), and in the strictest mode nothing that opens a conversation is stored on the device at all. The profile is encrypted at rest under your app-lock, the screen is blocked from screenshots and the “recent apps” preview, and a decoy profile and panic lock are there for a phone taken while you’re present (above). But no messenger survives a phone that is unlocked in an attacker’s hands or carrying spyware — it reads your screen regardless of any cryptography. We tell you exactly where that line is.

Can I use a hardware key (YubiKey)?

Yes — as a second factor for your app-lock. Turn it on and unlocking needs both your secret and a tap of your YubiKey (over NFC): the key computes an HMAC-SHA1 challenge-response that never leaves it, and that result is mixed into the app-lock key. Lose the key and your secret alone won’t open the app, so it’s opt-in for high-stakes use — and a physical token is itself a “tell”, which is why it’s off by default. It is a local access gate, not a per-message signature: your messages stay deniable. (USB-C is on the roadmap; today it’s NFC.)

When is the app available?

YGOOW for Android is on its way. Follow the blog for progress.