Your private messages are end-to-end encrypted

What end-to-end encryption means

When you send a direct message, your phone scrambles it before it leaves. The only key that can unscramble it lives on the other person's phone. Our servers carry the sealed message from one to the other, and that is all they can do with it.

We are not asking you to take our word for it as a policy promise. It is not that we have decided not to look. It is that the message arriving at our server is already unreadable, and the key needed to read it was never sent to us.

What it covers

• Everything you type in a one-to-one direct message.
• Photos you send in that chat.
• Edits and replies, including the text of a message you edited later.

Encryption switches on for a conversation once both people are on a version of the app that supports it. In the chat itself, the app tells you plainly which of the two situations you are in, and it will never claim a conversation is encrypted when it is not.

What it does not cover

This is the part most companies leave out, so here it is first rather than last.

• Community posts, prayers and comments are public by design. They are meant to be read by other people, so they are not end-to-end encrypted.
• The AI companion is not a private chat between two people. What you write to it is sent to Google Gemini so it can answer you. That is described in the Privacy Policy.
• We can still see who messaged whom, and when. Sealing the contents of an envelope does not hide that the envelope was posted. We need the addressing information to deliver the message at all.
• Anything on the other person's screen is out of our hands. They can take a screenshot, or show someone. No encryption anywhere can prevent that. On Android 14 and later the app does tell you in the chat when a screenshot is taken.
• Your own phone. If someone else can unlock your phone, they can read your messages in the app, because at that point they are you. The app lock in Settings exists for exactly this.

How it actually works

If the details do not interest you, skip to the next section. Nothing here is required reading — it is here because a claim like this should be checkable.

• Each account generates a key pair on the phone the first time it is needed: a public key, which is shared, and a private key, which never leaves the device. The private key is held in Android's hardware-backed keystore.
• Sending a message performs an X25519 key exchange between your private key and the recipient's public key, producing a shared secret that only the two of you can derive. The message is then sealed with XSalsa20-Poly1305 — authenticated encryption, so a message that has been tampered with will not open at all rather than opening wrongly.
• The server stores and forwards the sealed result. It has no key material capable of opening it.

Verifying the person you are talking to

Encryption protects the message in transit. Verification answers a different question: is the key I am encrypting to really theirs?

Open a chat, tap the menu, and choose Encryption. You will see a 60-digit security number for that conversation. If you and the other person compare it and it matches, no one is standing in the middle. The app also pins the key it first saw for each person and will tell you if it ever changes — which happens legitimately when someone reinstalls the app or changes phone, and should make you curious if it happens at any other time.

Reporting, when we cannot read anything

A recovery community has to be safe. Encryption must not become a place to hide abuse, so reporting was designed at the same time as the encryption itself rather than bolted on after.

Every message carries a cryptographic commitment made by the sender, and the server counter-signs that commitment blindly — without ever seeing the message. When you report a message, your phone hands over that one message along with the proof.

• A moderator sees only the messages you chose to report, never the conversation around them.
• The proof means a reported message cannot be forged. Nobody can invent a message and pin it on someone else, and nobody can alter what they said and have it still check out.
• A sender cannot deny a message that verifies against their own commitment.

So the trade is not "privacy or safety". You keep the privacy, and a report becomes stronger evidence than a screenshot ever was.

Your recovery code

Because your private key lives on your phone and we do not hold a copy, losing the phone without a backup means losing the ability to read your old messages. There is no back door for us to open, which is the entire point, and it cuts both ways.

Go to Settings → Security and privacy → Message security and save your recovery code somewhere safe and offline. If you reinstall the app or move to a new phone, that code is the only thing that can restore your message history.

If the other person has an older version

Encryption needs both sides. If the person you are writing to has not updated yet, that chat is not end-to-end encrypted, and the app says so in the conversation rather than quietly showing a padlock. Once they update, the chat becomes encrypted from that point onward and a notice appears in the thread marking exactly when it started.

Messages sent before that moment stay as they were. We do not retroactively claim protection over messages that were not protected at the time.

Being honest about the limits

Encryption is a strong tool and a narrow one. It protects the contents of a message between two phones. It does not make the internet safe, it does not vet who you are talking to, and it does not protect you from someone you have chosen to trust.

If someone in a chat is pressuring you, sending you explicit material, or making you feel unsafe, report them. That is what the reporting above is for, and it works even though we cannot read the conversation.

Questions about any of this go to hello@christianadultblocker.com. A real person reads it.