Questions, answered straight

A phone number is an identity leash: it links your chats to your name, your SIM, your country, your records, and once a service holds it, so can anyone who compels or breaches that service. Spojiti starts from a random recovery phrase instead, so there is no number or name of yours to leak, sell, or subpoena. We did not remove the phone number as a feature; we removed it as a liability.

Nobody can look you up by name: there is no directory of Spojiti users to search, which is why strangers have almost nothing to aim at. People reach you three ways, all your choice: you show your QR code face to face; you send an invite link or your Account ID through any app (Chats → + → Add :Handle); or, if you turn on People who have my number can find me, someone whose number is in your address book and who has yours can say hello from People I know, and arrives as a message request. Pairing works both ways, so once one of you adds the other you are connected.

Report it at spojiti.world/support.html#lost with your Account ID and your lost-device code (Settings → Account → Lost-device code; write it down with your 12 words). From that moment it receives no more messages, and 48 hours later it erases itself: the wait is so that, if someone else made the report, you can cancel it from any of your devices with your Spojiti PIN. As soon as Spojiti on that device then hears of it (a phone that is online usually at once, even locked or with Spojiti not open; any other device the next time Spojiti is opened on it, before its PIN), it tries to back up your chats and their media, sealed so that only your 12 words with your Spojiti PIN open them, to the places your backups go (Spojiti.cloud when none is set), and then erases itself without showing anything, even if the backup failed; restore them on a new phone with your 12 words and your PIN. If you still have another device, report from it instead, on the same screen: that report acts at once (from a device on your account 72 hours or more), and the device you report from is left alone. It is free for everyone. Until then two layers stand between a thief and your chats: your phone’s own lock, and, if you turned it on, Spojiti’s App Lock, which closes the database and drops the key. The honest limit: a device that never comes online again cannot be reached by anyone.

Every change to who can use your account is told to all your devices at once, with a card even when Spojiti is closed: a device added, a wrong Spojiti PIN, a PIN reset, a lost-device report. Settings → Account → Devices shows when each device joined and was last seen. If a device is not yours, tap Not me (on the alert, or on that device in the list): it erases itself and is blocked from your account for 30 days, every device is signed out, and you choose a new PIN, which your other devices then use to sign in. Backups from then on are sealed with a key the blocked device never saw. Not me works from a device that has been on your account 72 hours or more, so a device that just joined cannot turn it against you. If someone typed a wrong PIN, they have your 12 words: keep your PIN to yourself.

There is nothing to sign up for. On first launch Spojiti creates an identity on your phone: twelve recovery words, which are your account, and a :Handle, which is the name people see. Write the words on paper before you do anything else. Then add someone: Chats → + → Add :Handle, and scan their QR, paste their Account ID, or open the invite link they sent. That is the whole of it; there is no password, no email, no verification code, and nothing about you on our side to log in to.

Your 12 recovery words are in Settings → Account → Recovery phrase, shown only after your phone’s own unlock if it has one. Write them on paper, in order, and keep the paper somewhere safe and offline: not a screenshot, not a photo, not a cloud note, on Android, Windows and Mac the screen blocks screenshots while it is open for exactly that reason, and an iPhone lets no app do that. Until you save them, an amber dot sits on Settings → Account and a card reminds you, because an account made with one tap has no other way back yet. (An amber dot on About Spojiti means something else: a new build is waiting.)

Your recovery phrase is your entire account, identity, keys, everything derives from it. Write it on paper and keep it safe. If it is lost and you set up no other way back (a recovery code, a passkey, Face ID on the same phone or trusted contacts, ask me about ways back), the account is gone forever: nobody, including us, can reset it, because we hold nothing about you to reset. That is the price and the point of true privacy.

There are five ways back into an identity, and you choose which to set up. 1) The 12 recovery words, always (Settings → Account → Recovery phrase). 2) The recovery code: a printable QR of those words, locked by a seven-word code key (Settings → Account → Recovery code). 3) Face ID or fingerprint after reinstalling on the same phone (Settings → Security; not on Windows). 4) A passkey in your iCloud Keychain or Google Password Manager (Settings → Security, on iPhone and Android). 5) Trusted contacts who each hold a piece of a recovery key (Settings → Security). On a new device choose I already use Spojiti → Restore my account. Set up at least two; with none of them, nobody can bring the account back, us included.

Chats → the + button → Add :Handle. Then either scan their QR face to face, paste the Account ID or invite link they sent you, or use People I know, which finds contacts who have opted in to being findable by people who hold their number; the matching happens on your phone and your address book is never uploaded. Tap + Spojiti to say hello: it reaches them only if your number is in their address book too, and their answer opens the chat. Nobody can add you by searching for a name or a :Handle, because there is no directory of them.

Names on Spojiti wear the : glyph, one colon for a person, two for a group. There is no global username registry on purpose: a registry is a directory of users, and directories get scraped. Your :name is what YOU choose to show; contacts connect by code or QR, not by searching a database. And nobody can wear our name, the app refuses lookalikes of :Spojiti_Beta at every path.

Your Account ID is a random identifier, not derived from you, that another person needs once to connect. Share it three ways: show your QR from Chats → + → Add :Handle and let them scan it; send an invite link through any app (it carries your id, your :Handle and a one-time pairing token, nothing else); or copy the id itself and paste it to them. Pairing is automatic in both directions, so once one side adds the other, you are both connected. The id says nothing about who you are, and it is not searchable anywhere.

Free is the whole messenger: sealed chats and groups, calls, media, voice notes, GIFs and stickers, polls, Flashes, location, disappearing messages, honest read receipts, App Lock, on-device search, export and backup to this device, the full security architecture and every privacy control, forever. What Free has less of is only numbers: media and files up to 20 MB, one device and one account, two groups of your own with six members each, one call recording, one screen share, one Flash and one live location share a week, Spojiti light and dark themes, and backups to this device. Undelivered messages are held for 5 days for everyone. Every pack and what it raises: spojiti.world/subscribe.

This is the Spojiti beta: the real app, end-to-end encrypted exactly like the launch build will be, on its own servers and its own website, spojiti.world. The official chat is :Spojiti_Beta, on the beta it carries the beta’s own name, so a beta screenshot can never pass for the launch app, and the beta’s icon carries an amber padlock. Every feature is on for everyone, and the packs are real: Settings → Spojiti Packs sells them exactly as the launch build will. Tell us everything that breaks: Settings → About Spojiti → Contact support files a ticket with no name or email, marked only with your random account id.

The beta and the launch app run on separate rails that share nothing, not a server, not a database. So today a beta identity does not move into the launch app by itself; if we build a way to carry it over, this chat will say so plainly before launch, so nobody loses chats by surprise. Keep your 12 words written down either way.

On Android, Spojiti comes as a signed APK straight from us: open spojiti.world/download.html on the phone, tap Download Spojiti.apk, open the file, and allow installs from your browser once when Android asks. It needs Android 8 or later. If Android says “App not installed”, the phone is 32-bit: use the Spojiti-arm.apk link on the same card. The page prints each file’s SHA-256, so you can check the APK is exactly the one we built and signed, and the app tells you itself when a newer build is ready.

On Android, Spojiti comes as a signed APK straight from us: open spojiti.world/download.html on the phone, tap Download Spojiti.apk, open the file, and allow installs from your browser once when Android asks. It needs Android 8 or later. If Android says “App not installed”, the phone is 32-bit: use the Spojiti-arm.apk link on the same card. The page prints each file’s SHA-256, so you can check the APK is exactly the one we built and signed, and the app tells you itself when a newer build is ready.

On iPhone and iPad the beta installs through Apple’s TestFlight: install the free TestFlight app from the App Store, open the join link from spojiti.world/download.html on the iPhone, tap Accept, then Install. Open Spojiti and tap Accept & Continue; that is the whole sign-up. Updates arrive through TestFlight on their own.

On a Mac: download Spojiti.dmg from spojiti.world/download.html, open it and drag Spojiti to Applications. It is a native app, notarised by Apple, for Apple silicon and Intel Macs. Then either link it to your phone (on the phone: Settings → Account → Linked devices → Link a new device, and scan the code the Mac shows) or create a new identity on the Mac itself. The Mac app updates itself when a new build is out, and Open at login (Settings → Notifications → Delivery health) lets messages arrive without opening it first.

On Windows 10 or 11: download the ZIP from spojiti.world/download.html, unzip it anywhere and run spojiti.exe in the folder; there is no installer and no admin rights needed. If SmartScreen says it does not know the publisher, choose More info, then Run anyway; the Microsoft Store version follows once it is approved. Link it to your phone by its QR or create a new identity. To update, unzip the next build over the same folder; your chats live in your Windows profile, not in that folder. Closing the window keeps Spojiti running in the notification area until you choose Quit.

Yes: Spojiti has native apps for Mac (Apple silicon and Intel) and for Windows 10 and 11, from spojiti.world/download.html; there is no browser version yet. Link it to your phone by QR and it becomes one of your devices: pairing copies your identity to it, sealed, and it then keeps its own sealed sessions, so it keeps working when your phone is off. On a wide window the chat list and the chat sit side by side, calls and screen share work, and closing the window keeps Spojiti in the menu bar or the notification area so messages still arrive; Quit really quits. You can also create a separate identity on the computer instead of linking it.

One identity on one device on Free and Basic, two with Pro or Plus, three with Max or Ultra: Settings → Account → Linked devices → Link a new device, then scan the QR the new device shows. Pairing copies your identity to the new device, sealed, over that QR handshake, so link only a device you own and are holding. Each device then keeps its own sessions and every message is sealed to each device separately; removing one from that same screen stops delivery to it immediately. History does not travel across the link by itself, we cannot read it to move it, but Settings → Back-Up & Storage → Send my chats to my new phone moves it phone to phone, sealed, and Sync my devices gives two devices you keep using each what the other is missing; new messages arrive on every linked device from the moment it joins.

To move everything, media included, from your old phone to a new one: first link the new phone (on it choose I already use Spojiti → Link to my other device, and scan its code from the old phone’s Settings → Account → Linked devices). Then Settings → Back-Up & Storage → Send my chats to my new phone on the old one, or Get my chats from my old phone on the new one, and accept the card on the other. The history travels phone to phone, sealed with your recovery phrase, and nothing is kept on the relay. Keep Spojiti open on both until it finishes; the same Wi-Fi is fastest.

A phone carries one identity on Free and Basic, two with Pro or Plus, three with Max or Ultra, each with its own recovery phrase, its own chats and its own encrypted database; they do not know about each other. The route is Settings → Account → Log out, which leaves this account's chats where they are, sealed, and drops you to the account chooser: Add account starts a fresh identity, and tapping any :Handle switches to it. Signing back in is your phone's biometrics, the twelve words, or that account's own recovery code. This is the opposite of a LINKED DEVICE, which puts the same identity on a second phone or a Mac.

Every time Spojiti opens it checks our own site for the next build. When one is out, a full screen asks you to update before you carry on, one button, and your chats stay safe on your device. Android and Mac: Spojiti downloads it, checks it and installs it (Android may first ask you to allow Spojiti to install its own updates). iPhone: it opens TestFlight, tap Update next to Spojiti Beta. Windows: it opens the download page, or the Microsoft Store if that is where you got it. There is no switch to turn this off and no Later: everyone moves forward together, and a build only ever comes from our own site or your store.

Spojiti runs as native apps on Android, iPhone, Mac and Windows (on Windows a portable app from spojiti.world/download.html, with the Microsoft Store listing to follow). A browser version and a Linux app are on the roadmap, built so they keep every promise the native apps make. On a Mac or a Windows PC, link it as a second device from your phone and everything, chats and calls, works on the desktop.

Honestly, this much: random account ids with nothing attached, and which one an envelope is for (never who sent it, except on messages to and from the official :Spojiti_Beta account); sealed envelopes waiting for someone offline, deleted the moment they are delivered; which packs a request holds, proven by blind tokens that cannot be linked to a purchase; the network address any server sees while you are connected; when your devices connect, the push handles that wake them and the device names you type; and, only if you turned on People who have my number can find me, a blinded fingerprint of that number we cannot read back. Never your messages, media, calls, contacts, groups or number in any readable form, and your :Handle only inside an invite link someone opens in a browser. The Security page at spojiti.world draws every box we run and labels what each can and cannot see.

If a lawful order arrives, we comply with what we hold, and it is little: no message content, no name, number or contact list, no history. What exists is random account ids, public keys, device push tokens, last-connection times and the other records our privacy policy lists, such as Spojiti.cloud backups if you keep them there, sealed under a random name we cannot link to you or open. We cannot decrypt you. That is not defiance; it is arithmetic.

Curtains, envelopes and closed doors are not for people with something to hide either. Doctors discussing a diagnosis, lawyers with clients, journalists with sources, families, friends being silly together: private conversation is ordinary and human. The people best served by Spojiti are the vulnerable, not the villains, who already have their tools. And a service that cannot read anyone protects everyone equally, including from a breach or a bad day at the company running it.

Only if you turn it on: Settings → Privacy → People who have my number can find me. On Android, Spojiti takes the number from the phone’s SIM cards (one or both); an iPhone does not let any app read its SIM, so there you type your number. Either way it is blinded on the phone, and our server signs the blinded value without learning what it is. We keep only the resulting fingerprint beside your account id, so only someone who already has your number can use it. Even then their hello reaches you only if their number is in your address book too, and it lands in your message requests, never straight in your chats; someone who has your number but is not in your address book cannot reach you this way. Looking people up happens on their phone, so we never learn who searched for whom. The honest limit: someone inside Spojiti holding the signing key could test any number they like, without limit; everyone else is held to a daily budget. Turning it off deletes the fingerprint the same minute, for everyone.

Three ways, none of which needs your identity. Creating an account costs the phone a few seconds of computation, trivial for a person and expensive for a bot farm. There is no directory, so nobody can reach you without your QR, link, Account ID or, if you made it findable, your number, and anyone not in your contacts lands in Requests, content-free and never marked read. And the tools run on your own phone: block (fully, or just messages, audio or video calls), report, which blocks them and, if you choose, sends us their last few messages to you with proof they sent them, and the guard that blurs likely-abusive text before you see it.

Every message is end-to-end encrypted with the same open, peer-reviewed designs that secure the world’s best messengers, the Double Ratchet, upgraded with post-quantum key agreement (ML-KEM-1024), a post-quantum ratchet inside every chat between people (ML-KEM-768) and post-quantum signatures (ML-DSA-65) on the prekeys each account publishes; only the official :Spojiti_Beta channel is still classical. Keys live only on your devices. We run the relay and still cannot read your messages, it only moves sealed envelopes and deletes them on delivery.

Honest answer, because you deserve the real one: a relay that moves envelopes must know which account an envelope is FOR, or it could not deliver it. It does not know who it is FROM: every envelope except those to and from the official :Spojiti_Beta account leaves through an anonymous connection, wrapped once more to the recipient’s keys (sealed sender), so the relay never holds a sender, recipient pair. What it never knows either: your name, number, message content, or preview text, accounts are random ids with no identity attached, envelopes are deleted once your devices collect them, nothing is archived. A photo or file is fetched the same way: the right to download it rides inside the sealed message, so the relay does not learn who opened it. What it does see: your network address (until the private route ships), which account each envelope is for, its size and time, when your devices connect, the push handles that wake them, and how many cross-network call setups and number lookups an account makes, never what you say.

Assume the worst. If someone images our server they get ciphertext, random account ids, public keys and device push tokens. They also get the routing records a relay needs, device records and connection times. Backups are not on the relay at all: they are where you chose to keep them, sealed with your recovery phrase. For people who turned on being findable by number, the signing key on the server would let an attacker test phone numbers against their fingerprints. No names, no message text, your history lives on your phones, and in sealed backups only where you chose to keep them. That is the difference between promising security and being architecturally unable to lose what was never collected.

There is no backdoor: keys are generated and held on your devices, the ratchet changes them every message, and the relay moves only sealed bytes. Trust still rests in two places: the keys our relay hands out, which comparing safety numbers checks, and the updates we ship. A backdoor would require redesigning the entire system into something we deliberately refused to build.

No AI reads your messages, not for features, not for training, not for “safety scanning”. The relay cannot read them, so it cannot feed them to anything. There is no exception, and there used to be one: a question this assistant could not answer was passed to a server-side assistant that could consult a model. That path was removed, every answer you get from me now comes from a fixed list written by Spojiti’s CTO and stored on your device; a correction to its wording, approved by a person, can arrive from our servers. Your words train nothing and inform no one.

We run our own multi-homed infrastructure, servers we rent and run ourselves, deliberately not a hyperscaler’s data lake, and we do not name locations. The honest security answer is that server location barely matters when the server cannot read anything: your protection is mathematics on your device, not geography.

Push must transit Apple’s and Google’s infrastructure, that is how phones wake. So Spojiti tells them as little as a wake allows: the push says only that a message or a call is waiting. No sender and no text; a call's push carries only a random per-call tag. Names, faces, and message text are added by YOUR device after local decryption. Apple and Google learn only that your phone received a push and whether it was a message or a call, never what it said or who it was from.

Three checks you can run yourself. Settings → Security → Post-quantum protection shows the self-test your phone ran at launch against NIST’s own published test vectors, and the algorithms in use; on a device where that test does not pass, post-quantum stays off rather than pretending. A contact’s safety number, compared in person or by voice, proves nobody sits between you. And the Spojiti Private Messenger Core, the app and relay code that prove the zero-PII design, is published under the AGPL v3 at github.com/Spojiti. Settings → About Spojiti also shows the exact commit your build came from.

Your Spojiti PIN is six digits of your own, never your phone’s passcode, and it is one PIN for two things. It opens Spojiti when Require unlock is on (Settings → Security → App Lock), or Face ID / Touch ID / your fingerprint does; once a week Spojiti asks for the PIN instead, so you keep it. And it protects your account: a new phone asks for it with your 12 words, so the words alone can no longer take your account. Three wrong PINs lock it for 30 minutes, longer each time. Forgot it? On a device still signed in, tap "Forgot PIN?" on the lock screen: your face or fingerprint (or your 12 words) opens Spojiti and you choose a new PIN at once. On a new phone, tap "Forgot PIN?" and "Use my passkey" if you turned on passkey recovery: your face or fingerprint, then a new PIN at once, and nothing is lost. With neither, a 7-day reset starts that every device of yours can cancel; the phone asks for the new PIN by itself on the day, and backups made before the reset open again 30 days after it started. The message database itself is encrypted at rest (SQLCipher) regardless.

If you are made to unlock this phone: Settings → Security → Quiet switch. You choose a tap pattern, what to tap and how many times, and mark which conversations may be seen under it. Tapping that pattern, on the lock screen (anywhere but the PIN keypad) or inside the app, switches to a separate, real session holding only those conversations, which stays offline while it is open; the same pattern brings you back after your usual unlock. Nothing is faked and nothing is destroyed; your real store stays sealed and is never opened, written to or timestamped while that session is active. Every copy of Spojiti carries two encrypted stores from first run, so having one proves nothing about you. The honest limits: it does not defend against someone who takes the phone and analyses it later with the right tools, or who knows this feature exists and demands the pattern; and if someone knows you talk to a particular person and that person is absent from what they see, this does not save you. App Lock (closes the database and drops the key) and revoking a device from Settings → Account → Linked devices are the other two tools. Never paywalled, for anyone, safety is not something we sell.

Block from their contact page or a long-press on the chat list, a blocked contact cannot reach you and is never told they were blocked. The complete block is free forever, and so is selective blocking, just messages, just audio calls, or just video calls, because blocking is a safety control and safety is never paywalled.

Report a :Handle from their contact page (tap their name at the top of the chat), or a member of a group from the group’s member list (tap the group’s name, then the member): they are blocked at once, without being told, and you choose whether the report reaches us. From their contact page the whole chat goes (in a group, only that member’s messages); to send particular messages, yours or theirs, select them in the chat and tap Report. The newest 2,000 messages at most go, and only their words: a photo, video or file is named, never sent. Their messages carry cryptographic proof that they sent them, which we check; yours, and any of theirs without that proof, come marked as unverified. Switched off, the report stays on your device. A report we receive is kept in a separate reports store on Spojiti.cloud, in your region, not on the relay, and is deleted 90 days after it was filed. What also runs, free and only on your phone: Warn me about abusive messages blurs a likely-abusive incoming message until you choose to see it, and Think-twice before sending nudges you before something that may hurt goes out, a message, a caption, an edit or a public post (both in Settings → Security). Your messages are never scanned on our servers.

Two guards in Settings → Security, both on by default and both computed only on your phone. Warn me about abusive messages blurs a likely-abusive incoming message until you choose to view it. Think-twice before sending gives a gentle check before a message, caption, edit or public post of yours that may come across as hurtful goes out; you can still send it. The check is a word list, so it misses sarcasm and new phrasing: a nudge, not a judge. Nothing is scanned on our servers, and neither the message nor the verdict leaves your device.

Two separate things: as a SENDER you can protect your content, and on Android, Windows and Mac the recipient’s device blocks capture of it whatever packs they hold. Taking screenshots of your own chats is allowed for everyone. Honesty note: iOS does not let any app truly block screenshots, so where blocking is impossible we say so instead of pretending.

Disable Screen Shot (in the chat’s ⋮ menu or on their contact page) lets YOU decide what happens to what you send: block saving, copying and forwarding of your messages and media on the receiving side. Consent over your own content is free, it is a safety control, and safety is never paywalled.

Verify a contact by comparing safety numbers from their profile, the green check means the keys match what you confirmed. This official :Spojiti_Beta chat is verified differently: our public key ships inside the app itself, so nobody can impersonate this channel, and no one else is allowed to wear the Spojiti name.

Presence is a privacy control, so it is yours for everyone: switch online status and last seen off for everyone in Settings → Privacy, or per :Handle on their contact page (tap their name at the top of the chat) → Online & last seen. It works both ways, whatever you hide from someone, you stop seeing of theirs, and everyone sees what their contacts chose to share with them. Read receipts stay free and honest for everyone.

Yes, and the relay keeps no record of any group. A group message is sealed separately for each member’s devices and travels as ordinary one-to-one traffic, with no group name, member list or photo attached. Because a group message goes out as one batch of sealed copies, the relay can see which accounts receive copies together, but nothing it stores names a group or who is in it. Adding, removing and promoting members must come from an admin, over that admin’s own sealed session, and every device checks them against the member list it already holds, so nobody who is not an admin can forge one, and once someone leaves, the group stops accepting their messages. Group calls connect members directly to each other.

Audio and video are end-to-end encrypted (DTLS-SRTP). Call setup rides inside the sealed chat, and every frame of sound and picture is sealed a second time (AES-GCM) under a key made for that one call, which travels inside that chat: where the chat is post-quantum, so is the call, and the call screen says post-quantum. If either device cannot add that second seal (an older version), the call goes on under DTLS-SRTP alone and the screen does not say post-quantum. On strict networks the encrypted media is relayed by our TURN server, which holds no key. The relay sees that call signalling is in flight. The push path carries a coarse wake, ring or message, so a sleeping phone can ring; that trade is universal for calls on phones, and we would rather tell you. Calls are free for everyone.

On Free and Basic you can create two groups of your own, each of up to six people, and only you are its admin; with Pro and above you create as many as you like, with up to 256 members, and can make other members admins. Joining groups others create is never limited. Group audio calls carry 4 people and group video 4, for everyone: the call caps exist because calls are a true peer-to-peer encrypted mesh, where every participant connects to every other and quality is protected by honest limits. The relay never carries the call itself.

Open the group and tap the call button in its header: members ring, on the lock screen too, and anyone can join later from the banner in the group. Group calls are an encrypted mesh, every device connected directly to every other: up to 4 people on audio and 4 on video, for everyone, because a mesh past those sizes stops sounding good. Everyone on the call has a card, you first: a face, or the live picture when the camera is on. Screen share and consented recording work in group calls too; a group recording needs everyone to accept.

Call recording is on for everyone; the only cap is how many a week (one on Free, Basic and Pro; unlimited with Plus and above). It always asks the other side first: tap Record during a call and they see “They want to record this call” with Accept, Accept, no sharing and Reject; nothing records until they accept, and both screens say “Recording, with their consent” the whole time. At your limit, the app only tells you which pack lifts it; nothing interrupts the call. The recording is mixed on your phone, sealed, and kept in Calls → Records on this device only, where you can play, share or delete it (a recording accepted with no sharing is marked Record only and has no Share, and neither does its transcript); it never touches our relay. Whether recording is lawful varies by place and by who consented, so Spojiti insists on consent everywhere, and you remain responsible for the law where you are.

Disappearing messages: open a chat, tap the :Handle at the top, then Disappearing messages, and pick a window (in a group it is in the ⋮ menu). New messages in that chat are deleted by Spojiti on every device when the timer lapses (a device that is off does it the next time it runs). You can also set a timer per message from the composer, and View-once media disappears after a single viewing.

Each message you send wears a small picture of its journey: a clock means it has not left your phone yet, a courier on a bike means it was handed to the relay, a parcel means it reached their device, and an opened letter means it was actually on their screen while they were there. A clock struck through means the relay’s window closed before they came online, so it was not delivered. Spojiti never fabricates a receipt, if it says read, it was read.

Tap the chevron on a message (right-click on a computer) → Delete for me, and on a message you sent, Delete to Peer or Delete to Both. Long-press selects several to delete for you at once. Swiping a message you received from right to left deletes it for you (a swipe always asks first). A delete-for-everyone vanishes from Spojiti on both sides without a trace, for everyone, leaving no marker is a privacy control, and privacy is never paywalled. No app can take back a screenshot or a notification already shown. Timing: until the other person has seen the message, Delete to Peer and Delete to Both always remove it from their copy; once they have seen it, their Delete & Edit switch for you decides, and if it is off, their copy stays as you sent it, and Spojiti says so before you delete.

A Ping is a reminder on a message. Tap the chevron on any message (right-click on a computer) → Ping, give it a name, an action and a time, and your phone rings it then; the Ping leads straight back to the message. Every Ping is in the Data tab → Pings, soonest first. Pings live on this device only, and Free keeps up to 10 waiting at once (Everything unlimited).

Echoes are on the way: in this build the Echoes tab shows Coming Soon, and the service behind it opens in a coming release. What is being built: an Echo is a space defined by what is said, not by who is in it, named :::handle. You will ATTUNE to follow one (nobody is told), post a RESONANCE, reply with a REVERB, turn a post up with AMPLIFY (counted, never who) and FADE to stop, under a wave-mark that is yours there alone. A PRIVATE Echo opens only with the Acoustic Key its Conductor shares and is sealed to the people attuned; a PUBLIC Echo, found in Discover, will be readable by anyone including us, we say so, while nobody can see who is attuned and every read and post rides an anonymous token, never your account. A group admin will be able to attune a whole group.

Packs use blind signatures (an open IETF standard): the relay can verify your device holds a valid pack without ever learning which purchase, or which person, it came from. A pack code from our website names no account. Even at checkout, we cannot connect money to messages.

No, and we will not pretend otherwise. Cards and bank transfers are identity-bound rails: the payment processor, the App Store and your bank know that you paid, and your statement shows it. What we guarantee is the link nobody can make: the pack is blind-signed when it is redeemed, so the account it unlocks cannot be traced back to the purchase from the token itself, even by us.

Free is the whole messenger: sealed chats and groups, calls, media, voice notes, GIFs and stickers, polls, Flashes, location, disappearing messages, honest read receipts, App Lock, on-device search, export and backup to this device, the full security architecture and every privacy control, forever. What Free has less of is only numbers: media and files up to 20 MB, one device and one account, two groups of your own with six members each, one call recording, one screen share, one Flash and one live location share a week, Spojiti light and dark themes, and backups to this device. Undelivered messages are held for 5 days for everyone. Every pack and what it raises: spojiti.world/subscribe.

There is nothing to cancel, because nothing recurs: a pack is paid once, runs for its year and then simply ends, with no card on file and no auto-renewal. You keep every feature when it ends. A purchase is final: we never learn who paid us, which is the point of paying anonymously, so there is nothing to refund against; a pack bought in the App Store follows the store's own rules. The full policy is at spojiti.world/refund.

Five packs, one ladder, a year each, and a higher pack includes every pack below it. Basic: media and files up to 50 MB, and Custom Themes. Pro: 100 MB, unlimited groups with up to 256 members and co-admins, unlimited live location, two devices and two accounts. Plus: 250 MB, unlimited call recordings and screen sharing, and Flash & Avatar complete (who viewed, replies and reactions). Max: 500 MB, three devices and three accounts, and 2 GB of backup on Spojiti.cloud. Ultra: files up to 1 GB and 5 GB on Spojiti.cloud. There is no feature in any of them that Free lacks, and nothing in them is a safety feature; those are free for everyone. Current prices, in your own currency, are in Settings → Spojiti Packs and at spojiti.world/subscribe.

In the app, Settings → Spojiti Packs → Unlock Now on the pack you want: on an iPhone the App Store takes the payment; on Android, Mac and Windows our website checkout opens on that pack, you pay by card or net banking, and the code it gives you is added in one tap. Or buy on spojiti.world/subscribe without an account and paste the PACK_ code in Settings → Spojiti Packs → Redeem Pack (on a device with Spojiti installed, the page's button opens it for you). A code is what it holds, so keep it private until it is added. Current prices are on that page and in Spojiti Packs, never quoted from memory here.

Packs are priced per country, in your own currency: India in rupees, the United Kingdom in pounds, Europe in euros, the rest of the world in dollars, and the prices change from time to time, so Settings → Spojiti Packs and spojiti.world/subscribe are always the current word, and I never quote a number from memory. What I can promise: every feature free forever, and packs that buy bigger limits, never safety.

A pack code is how a pack bought on spojiti.world/subscribe, or won through a promotion, reaches the app without an account: it begins PACK_. Paste it in Settings → Spojiti Packs → Redeem Pack (or Redeem New Pack when you already hold one); on a device with Spojiti installed, the website's button opens it for you. The pack switches on at once, for a year, as a fresh blind-signed token, so the relay can check it is genuine without ever learning who bought it. If a code is refused, check it was typed whole and that its year has not ended. A promo code is different: that goes in Apply Promocode on the same screen.

A promo code, from Spojiti or a creator you follow, goes in Settings → Spojiti Packs → Apply Promocode. It does one of two things: it unlocks a pack for free, for a set time, or it takes a percentage off a pack. A free pack works everywhere; a percentage off applies when you buy on our website or from the Android, Mac and Windows apps (the App Store cannot take a discounted price, so an iPhone shows the offer and where it applies). Each code runs between two dates and for a set number of people, and is used when it is applied. Spojiti counts how often a code is used, never who used it.

Settings → Promotions lists what is running where you are, as cards: an offer on packs (a percentage off, or a pack free for a set number of people, between two dates) with its button; the referral reward (Share my link: when enough people you invited have joined, the pack set for the offer unlocks for you, and each person who joined through your link gets the pack set for them); and the promo code you applied, if any. Every reward is a pack unlocked through the blind signature, so the pack it turns on is never tied to your account.

A pack runs for a year, to the end of the month a year from the day you add it; Settings → Spojiti Packs shows the month yours runs to. Nothing renews by itself: buy it again to renew, and when it ends you keep every feature and only the numbers return to Free's. Buying a higher pack starts that pack's own year at once, and it includes every pack below it. The packs on sale and their prices are at spojiti.world/subscribe.

Every feature is on for everyone; what Free sets is numbers: how big, how many, how many a week. Settings → Spojiti Packs shows your pack and its limits. When you reach one, Spojiti says which limit it was and shows the pack that raises it, with Unlock Now where a purchase can start there; during a call it only tells you, so the call is never interrupted by a checkout. A file someone sends that is over your limit shows as a locked card naming the pack that opens it, and is never downloaded for you. Weekly limits reset every Monday (UTC). Safety and privacy controls carry no limit at all.

Iron rule, written into how we build: safety, privacy, and cryptographic strength are NEVER paywalled. Free gets the same double ratchet, the same post-quantum protection, the same zero-knowledge relay, App Lock, blocking, presence controls, view-once, vanish delete, caller-identity privacy, everything that keeps you safe. A pack buys bigger numbers on the limits: bigger files, more devices, more a week. Never protection.

If messages or calls only arrive when you open Spojiti, open Settings → Notifications → Delivery health. It checks, on this device, everything that decides whether Spojiti can be reached while closed: notification permission, background delivery (battery optimisation and Autostart on Android, Background App Refresh on iPhone, Open at login on a Mac, the notification-area icon on Windows), full-screen calls and Do Not Disturb. Each row says what is wrong in plain words and taps straight to the setting that fixes it, and it checks again every time you come back.

Calls ring over the lock screen: through CallKit on iPhone and as a full-screen call card on Android, with Answer and Decline. If a call does not ring, open Settings → Notifications → Delivery health: it checks notification permission, background delivery, Android’s full-screen calls and Do Not Disturb, and each row taps straight to the setting that fixes it. By default you can answer on a locked phone straight away (Settings → Privacy → Answer calls without unlocking); switch it off to be asked for your unlock first. Declining never needs it.

A message on the courier bike (what people call one tick) has been handed to the relay and the other side has not yet confirmed receiving it; Spojiti keeps re-sending it until they do, within the relay’s window (five days, for everyone). A plain clock means it has not left YOUR phone: the app shows that you are offline and reconnects on its own, airplane mode off, the backlog drains itself.

If the other person stays offline, the relay holds your sealed message for five days, for everyone: the relay is never told which packs the sender holds. If the window closes before their phone comes back, the relay drops it unread and your message shows a clock struck through, meaning not delivered, so nothing pretends to be on its way. Send it again once they are back. The relay never keeps a message longer, because a store of old messages is a store we would rather not have; the encrypted files messages point to are deleted about six days after upload.

On Android the usual thief is battery optimization: exempt Spojiti (Settings → Apps → Spojiti → Battery → Unrestricted) so the system does not strangle the connection. Check the notification channel is enabled and no Focus mode is filtering. Spojiti’s transport self-heals aggressively, but no app can outrun a system that puts it to sleep.

On iPhone, check three things: iOS Settings → Notifications → Spojiti (allowed, banners on), Spojiti’s own Settings → Notifications policy, and Focus/Do-Not-Disturb. A freshly installed build needs one app open to register for pushes. If cards show without message text, that is the previews toggle, ask me about “rich previews”. Still stuck? Settings → About Spojiti → Diagnostics exports a content-free log that pinpoints it.

Calls go phone to phone over the internet, so they cost data, not minutes, and work on Wi-Fi or mobile data anywhere in the world. If one side sits behind a strict network, the call falls back to our TURN relay, which forwards the encrypted media without holding a key. Dropped or one-way audio nearly always means a weak or changing network on one side: move closer to the router, switch between Wi-Fi and data, and call again. If the phone keeps buzzing after a call ended, update to the latest build, that was a bug we fixed. Still stuck? Settings → About Spojiti → Diagnostics → Share and send it with a support ticket; it contains no content.

When the app cannot reach the relay it checks, honestly, which of three things is true: your device is offline, our relay is down, or your network can reach the internet but not Spojiti, in which case the banner says a block MAY be in the way. “May” is deliberate: a phone cannot tell a national firewall from a broken hotel router, and we would rather admit the limit of our knowledge than guess at your network.

Spojiti is built to be quiet in the background: it keeps two connections to the relay while it runs, wakes only for content-free push notifications, and does no scanning or analytics behind your back; background work such as scheduled backups runs only if you turned it on. If battery use looks high, it is almost always a long call or a large media send; Android users can also check that the app is not caught by aggressive battery optimisation, which mostly shows up as late notifications rather than drain.

We want it: write to spojiti@spojiti.world, and attach a Diagnostics export (Settings → About Spojiti → Diagnostics) if it is a bug, the log is content-free and PII-free by construction, so sharing it costs you nothing. Every report is read by the engineers who build Spojiti, with no outsourced desk in between. An AI tool may draft a reply to a post on the support board, and a person approves each one before it appears.

Settings → About Spojiti → Contact support files a ticket on our public support board from inside the app: pick a category, describe it in plain text, and if you like attach the Diagnostics export, which records what the app did and never what you said. You get a ticket code: it is the only key to your ticket, so save it, and replies appear under it at spojiti.world/support.html. No email and no :Handle are attached; the ticket is marked as coming from your random account id, which only our staff can see. Posting on the website instead asks for a six-digit code we send to your own :Spojiti_Beta chat, so nobody can post as you.

Thank you, we want it. Email spojiti@spojiti.world with SECURITY in the subject, or open a ticket on the support board, which takes no name and no email. Say what you found, how to reproduce it and which build (Settings → About Spojiti). We acknowledge within 3 business days and send a fix or a written plan within 90 days for anything confirmed, faster for anything touching message confidentiality. Good-faith research is authorised, and credited if you wish; there is no paid bounty today. The full policy is under Reporting a vulnerability on the Security page at spojiti.world.

Ideas go on the Roadmap page at spojiti.world/roadmap, under What should we build?: post one, or back someone else’s, and the most-loved get built. Posting needs no sign-up; it asks for a six-digit code sent to your own :Spojiti_Beta chat so nobody can post as you, and the post is marked with your random account id, which only our staff can see. Bugs are better filed from Settings → About Spojiti → Contact support.

One place, not tied to your name: Settings → About Spojiti → Reviews & feedback publishes a rating and review on spojiti.world, stored with no name, no :Handle and no account; a written review first needs a one-time code sent to your :Spojiti_Beta chat, whose record is erased within a day. After a good rating the app may also offer your store's own rating prompt.

The roadmap is public: Echoes going live, Spojiti in the Microsoft Store, a Linux app and a browser version, contacts you can carry in and out, abuse reports you can send us with cryptographic proof, and a private route that hides your network address from the relay. Ideas and the release log live at spojiti.world/roadmap.

Spojiti is post-quantum end to end: key agreement with ML-KEM-1024 hybridised with classical X25519, a post-quantum ratchet that folds a fresh ML-KEM-768 secret into every turn of the conversation, and ML-DSA-65 signatures beside Ed25519 on the prekeys each account publishes, so a future quantum computer can neither open recorded traffic nor forge those prekeys. It only activates on devices where the official NIST test vectors (FIPS 203 and 204) pass at runtime, verified strength, never assumed. The one exception is the official :Spojiti_Beta channel, which is still classical.

The Spojiti Private Messenger Core, the app and the relay that prove the zero-PII design, is open source, published under the AGPL v3 at github.com/Spojiti, so anyone can read exactly how a message is sealed and routed. The rest of the product is not published, and we do not say it is. The open-source licences of everything we build on are listed in Settings → About Spojiti. The protocols themselves are the public, peer-reviewed ones (Double Ratchet, ML-KEM, ML-DSA), and the post-quantum code checks itself against NIST’s own test vectors on your device at every launch. An independent security audit of the full product is in progress, expected by end of 2026 and on track; the report goes on spojiti.world in full, findings included.

Spojiti is built and run by CognitionX Logic India Pvt Limited, an Indian start-up headquartered in Bengaluru, and it is paid for by the people who use it: no advertisers, no data buyers, no token. Company details are at https://cognitionxlogic.com, and Spojiti’s own news is at spojiti.world/press.html. For anything else, write to spojiti@spojiti.world.

Do not trust us, that is the design principle. Trust the architecture: open, peer-reviewed cryptographic designs; keys that never leave your devices; a relay that deletes what it delivers; diagnostics you can read yourself with no content in them; and honest answers even where they cost us (ask me about metadata). Every claim is checkable in the app’s own behavior, put this chat in airplane mode and I still answer, because I live on your device.

Your history lives on your devices, not our servers, an outage never touches it. Messages sent during one queue on the sender and re-drive automatically; the transport self-heals with backoff and fallback routes. And because your identity is your phrase, not an account we host, even the company vanishing could not delete who you are.

Spojiti is funded by the packs, and nothing else. No ads, no data sales, no “partners”: all we hold about you is a random account id and the routing a relay needs, nothing worth selling even if we wanted to. When the person who pays is the user, the product serves the user. Even payment is engineered private: a blind-signed pack means we cannot link a payment to an account.

Two exits, both in Settings → Account. "Delete my identity on this device" erases this device completely, keys, messages, media, and your other devices keep working; the 12 words bring you back. "Delete my account everywhere" removes the account from the relay and every device, deletes a passkey recovery if you set one, then erases this device: nothing can restore it afterwards, not even the 12 words. We hold no phone number or email, and deleting removes the account, its keys, its devices, its Spojiti.cloud backups and its waiting messages; encrypted server snapshots age out within hours. Support tickets you filed stay on the board, marked with an account id that no longer exists.

Deleting the app is not deleting your account. Your identity lives in your 12 words (and any other way back you set up), your other linked devices keep working, and messages sent to you wait at the relay for five days and are then dropped. Uninstalling a phone app removes its chats from that phone, so restore from a backup or move them first. To leave for good, use Settings → Account → Delete my account everywhere before you uninstall: that removes the account from the relay and from every device.

I am :Spojiti_Beta, the product’s own guide, and I am not an AI model. Every answer I give is written in advance by Spojiti’s CTO and stored ON your device (a corrected wording, approved by a person, can arrive from our servers): no model is consulted, your question is never sent anywhere to be answered, and I work in airplane mode, try it. When the answer is not in my book I say exactly that and point you at the full guide, instead of guessing.