The call is yours. The log is all we keep.
Voice and video are encrypted end to end on every call: each frame of media is sealed with a key derived on your devices and delivered over the same encrypted channel as your messages. Our servers find you a path and carry nothing but ciphertext.
Three moving pieces, and only one of them touches your audio
A call has to cross two networks that have never met, which takes more coordination than sending a message. None of that coordination requires hearing you — so none of it does.
A content-free push wakes the other phone.
The notification carries routing ids and nothing else — no name, no number, no reason for the call. The phone starts ringing before it knows anything worth protecting, which is the point: there is nothing in the push to intercept.
Carries routing ids so the right device rings
Carries no name, number or reason for the call
Kept and not kept, side by side
The honest version of a call is two lists. Putting them next to each other is the only way to read the second one properly.
Never leaves your devices
- The audio of the call
- The video of the call
- The per-call media key
- Anything said, shown or shared during it
Encrypted on your device, decrypted on theirs. Our infrastructure forwards packets it has no key for.
Stored in the call log
- Who called whom
- When it started
- How long it lasted
- Whether it was answered, missed or declined
A missed call has to be a record of something. We hold the shape of the call so your history works — never its contents.
Group voice and video, still encrypted
A group call routes through a selective forwarding server, because a mesh where everyone sends to everyone stops working after a handful of people. Frames are encrypted with a key derived from the group’s own cryptographic state, so the forwarding server moves frames it cannot open.
The key rolls with the group
Adding or removing someone re-keys the call. A person who leaves cannot decrypt what is said after they go, and a person who joins cannot decrypt what came before — the same guarantee groups get in messaging, applied to live media.
The call stays on top of whatever you go and do
Leaving the call screen does not leave the call. It shrinks to a window that floats over whatever you went to look up, and tapping it puts you straight back — the call is never something you have to go and find again.
None of this changes the encryption. The window is the same call, keyed the same way; only the size of it changed.
Adding someone mid-call
Turning a one-to-one call into a small conference is built on the server and covered by tests, but the in-app controls are not finished — so it is not something you can do yet. We would rather say that than list it.