During the open beta, everything is unlocked for everyone. Safety is free on every plan, forever.
FREE every feature is available with restricted caps
PACKS raise a limit for a year: with Everything, every feature is available with enough caps · see the packs
Identity without data
Keys, not accounts
An identity is a key made from 12 words. No number, no email, no OTP.
Pair face-to-face
Add people by QR or Account ID, always both ways. No directory to search.
Recover anywhere
Twelve words restore your identity on a new phone. We can't reset it for you, that's the point.
Messaging
Unlimited encrypted chat
Sealed with X3DH and the Double Ratchet. React, reply, edit, unsend.
Disappearing messages
Timers from seconds to a week, and view-once text, photos and video, on every plan.
GIFs & stickers
From your own gallery and our sticker packs. No third-party catalog.
Voice notes
Tap, speak, send, sealed like everything else.
Online status & read receipts
Presence and receipts you control, both ways.
Stories / status
24-hour stories with view receipts, end-to-end encrypted to each contact.
Export & backup
Encrypted chat export, plus an optional encrypted backup we cannot open, sealed with your recovery phrase.
Groups
Groups with no record
Each member gets their own sealed copy. Our relay keeps no record of any group.
Signed membership
Every add, removal and rename is signed and checked on each device.
Leaving means leaving
The moment someone leaves, every device stops accepting their messages.
Never orphaned
If the last admin leaves, the longest-standing member takes over.
The full toolkit
Media, polls, pins, timers: most of what a private chat can do.
Group calls
Device to device, no server holding the roster. Up to 4 on audio and 4 on video, for everyone.
Media, calls & location
Photos, video & files
Any file, each sealed under its own key.
Audio & video calls
Encrypted calls that get through strict networks and ring on a locked phone.
Location sharing
A sealed message, never live tracking we could watch.
Safety & control
On-device abuse guard
Blurs abusive content on your phone. Nothing leaves it.
Verifiable abuse reports
Report abuse we can verify, without reading anything else.
Screenshot control
Set by the sender: their app blocks capture on Android and Windows, tries on Mac, and on iPhone tells the sender of a screenshot.
App Lock
Fingerprint, face or PIN over the whole app.
Blocking, granular
Block messages, audio or video calls, one contact at a time.
Configurable quick actions
Pick which actions sit on your message bubbles.
Call-identity privacy
Hide your identity when you call, or the caller's on your screen.
Devices & under the hood
Multi-device
Link another phone or computer. New messages reach every device, sealed end to end.
Spojitifor Mac and Windows
Native apps, two panes, calls, tray presence. Linked with one scan.
Encrypted at rest
SQLCipher database and sealed media; with App Lock on, a stolen phone needs your PIN or biometrics to open them.
Content-free notifications
Pushes carry no content. Never your words.
Post-quantum key agreement
ML-KEM-1024, a post-quantum ratchet and ML-DSA-65 signatures, checked against NIST on your phone.
Multi-homed rails
Infrastructure we run and maintain ourselves. The app races every route.
Forced-upgrade gate
A build with a known flaw is refused once the fix is out. Everyone moves forward.
Everything, by category
Straight from the feature registry the app is checked against.
See the complete list, by category ↓
Security & Crypto· 12
End-to-end encrypted 1:1 chats
Every message sealed with X3DH + Double Ratchet; the key changes with every message (forward secrecy); the relay only moves sealed envelopes.
Post-quantum protection
ML-KEM-1024 hybrid key agreement, an ML-KEM-768 ratchet inside every chat between people (the :Spojiti_Beta chat is classical) and ML-DSA-65 signatures beside Ed25519 on the account's signed prekeys; switched on only where the NIST test vectors pass on the device; calls between two current apps too: each call's frames are sealed under a key that travels inside the post-quantum chat.
Encryption at rest
Messages in an SQLCipher database and every photo/file sealed on disk; App Lock closes the database and drops the key.
Anonymous (blind-signed) entitlements
A pack is proven to the relay with an RFC 9474 blind signature, so our records cannot link the payment, store transaction or pack code to the account.
Bot gate (proof of work)
Creating an identity costs the phone a few seconds of computation; no captcha, no phone number.
Forced-upgrade security gate
The relay refuses builds older than the safe minimum; the app shows a full-screen "update required" page.
Verify safety number
60-digit safety number per contact, compared in person or by voice; verified contacts wear a green seal.
Official :Spojiti_Beta handle
The official channel's key is pinned inside the app, and each environment names it for itself (a beta build's channel carries a _Beta suffix, so a beta screenshot can never pass for production); the word "Spojiti" (in any disguise) is refused in every name a person chooses: :Handle, contact, group, Focus and circle.
Sealed sender
Every envelope between people leaves over an anonymous connection wrapped to the recipient's keys, or waits on the phone: the relay learns who a message is for, never who sent it. Typing and receipts ride inside the ratchet; online dots for the chats on your screen are also asked of the relay. Only the :Spojiti_Beta chat uses the signed-in connection.
Post-quantum self-test sheet
Settings → Security → Post-quantum protection shows the on-device self-test verdict and the algorithms in use.
Capture-blocking on secret screens
Recovery words, restore, safety number, device-link QR and recovery-code screens: on Android and Windows these screens block screenshots while open; on iPhone, avoid screenshots yourself.
Build attestation
About shows the commit, Flutter version and rail this binary was built from; tap to copy.
Safety· 14
Message franking (commitment)
Every message carries a sealed commitment to its exact bytes, checked when it arrives.
Message requests (quarantine)
Messages from people not in your contacts wait in a Requests section, Accept, Delete or Block; nothing is marked read.
Block / unblock
Full block from the chat menu, chat list, contact page or a request; the other side is never told.
On-device abuse warning
"Warn me about abusive messages": likely-abusive text is blurred until you choose to view it; checked on the phone only.
Quiet switch (duress)
A secret tap pattern opens a separate, offline session holding only the conversations you chose; the real store stays sealed and untouched.
App Lock with Spojiti PIN
Require unlock with your own 6-digit Spojiti PIN or Face ID / fingerprint (never the phone’s passcode), with the recovery phrase as last resort; once a week the PIN is asked instead of the face, so it is remembered; the third wrong PIN locks it for 30 minutes, doubling to 24 hours.
Granular blocking
Block only messages, only audio calls or only video calls.
Report a contact
Report from the chat menu or contact page; recorded on this device and the contact is blocked.
Think-twice nudge
A gentle check before sending a message, a caption, an edit or a public post that may come across as hurtful; on-device.
Change PIN, Lock now
Change the PIN after confirming it is you (the current PIN, Face ID / fingerprint or the recovery phrase); it is the account’s PIN too, so it can be changed but not removed. Lock the app instantly from Settings or the chat-list lock button.
Ask to confirm before delete
A switch that makes every delete ask first.
Answer calls without unlocking
On by default: you can answer on a locked phone. Switch it off to be asked for your unlock first; declining never needs it.
Never allow call recording
One switch declines every request to record you and tells the caller at once.
Report with proof
Report selected messages from a chat (theirs and your own, selected the way Forward selects), or the whole chat from the person's profile; a group member from the group's member list. Their messages carry proof they sent them, checked by Spojiti without reading anything else; your own messages, and theirs whose proof had expired, go as context marked unverified. The report is kept in Spojiti.cloud in your region, not on the relay, and deleted 90 days after it was filed; Ops filters reports by date, region, reason, status and scope.
Privacy· 21
Disappearing messages, per chat
Tap the :Handle → Disappearing messages (⋮ in a group): new messages in the chat are deleted by Spojiti on every device when the timer lapses (a device that is off does it the next time it runs).
Disappearing, per message
The composer clock sets a timer on the next message only.
Link opening without fetch
Links are tappable and open in the browser; your phone never fetches a link because a message arrived.
Protect my content (per chat)
Chat ⋮ → Disable Screen Shot: the other side's app blocks screen capture of your messages on Android and Windows, tries on Mac, and tells you if they screenshot on iPhone.
Peer's protection always honoured
If the sender protected a chat, your device blocks capture of it whatever your plan.
View-once messages
Text, photo or video that opens once and burns; excluded from search, export and the Data hub.
Last-seen control (global)
"Show my last seen" on/off, reciprocal.
Online status controls (global)
"Show when I'm online" on/off; whatever you hide you also stop seeing (reciprocal).
Vanish-without-trace delete
Delete for everyone leaves no tombstone on either side.
Screenshots of your own chats
Allowed on every tier; only a peer's protection blocks capture.
Protect all chats by default
Settings → Security master switch protects every current and future 1:1 chat; per-chat overrides stay.
Call-identity privacy
Hide your identity when calling ("Spojiti call") and/or hide the caller on your own ring screen.
View-once closing timer
"View-once closes after": when I close it, or after N seconds/minutes.
Privacy hub
Settings → Privacy gathers what we know (no name, age, phone or email), online/last seen, link previews, view-once timer, discovery, address book and call privacy.
Sender-built link cards
"Link previews I send", on by default: your phone fetches the page and seals the card into the message, so the receiver never fetches it (the linked site sees your phone's address, not theirs). Off in a Quiet-switch session, or whenever you switch it off.
Per-:Handle online & last seen
Hide or show your presence to one person from the chat menu or contact page.
Don't allow saving (per message)
From the composer clock: the receiver's app will not save, copy or forward the next message/media.
Screenshot alert to sender (iPhone)
iOS cannot block screenshots, so a screenshot of a protected chat is detected and the sender is told.
Hide in app switcher
Blanks (Android) or blurs (iPhone) the recent-apps preview.
"What we know about you" card
Name, age, phone, email, all "not collected" shown in Settings → Privacy.
Just-in-time permissions
Camera, microphone, location and contacts are asked only when a feature needs them, notifications once in the welcome tour; denying keeps the rest working.
Messaging· 25
Unlimited text messages
No cap on texts, 1:1 or group.
Voice notes
Tap the mic to record, with a live level ring; tap send to send it, or the bin to cancel; sealed and played inline.
Typing indicators
Typing dots in the chat and "texting" on the chat list, carried inside the sealed channel.
Honest ticks & read receipts
One tick = relay took it, two = delivered, read = actually on screen; between people, delivered and read come only from the recipient's own end-to-end receipt (B383); never faked, free for everyone.
Polls (groups)
"+" → Poll in a group: optional name, a question and its options (how many is the plan's, row 271); votes tallied on the devices; tap again to retract.
Share a contact card
:Handle button shares a card with their id and self-chosen name, never your nickname; tapping Connect on it adds them, and your first message reaches them as a request.
Stickers
Bundled sticker packs sent end-to-end encrypted; no store, no catalogue server.
Keyboard image/GIF insert
Images and GIFs picked inside Gboard/SwiftKey (or pasted where the keyboard routes them) are sent sealed.
Offline queue & automatic redrive
Type with no signal; messages queue and retry until the relay confirms. The relay holds them for the plan's window.
Location pin
Send your current location as a sealed pin; no map service is contacted unless someone taps the pin, which opens Google Maps.
Live location
Share movement for a chosen time inside the sealed chat; ends at the deadline or on Stop.
Not-yet-sent indicator
A clock on a message that has not left the device; a distinct "Not delivered" state when the retention window closed, with Resend in the message's menu (B383).
Anonymous polls
Chosen at creation: votes are kept as ballot tokens, never names; like a paper ballot box, it trusts members to vote once.
Attachment row
One row under the message box: Camera, Media, GIF, Stickers, Docs, Location and :Handle (+ Poll in groups); Payment is switched off for now.
Import signed sticker packs
Import a .spjpack from anywhere; the app verifies Spojiti's signature before keeping a byte.
GIFs
Animated GIFs from your own gallery, sent raw; no Giphy/Tenor.
Send later (scheduled)
Long-press Send to schedule; it sends from this phone when the app is next running at or after the time; list and cancel pending (how many may wait is the plan's).
Mentions
Type ":" to mention a person, "::" for everyone, with autocomplete.
Undelivered messages held by relay
The relay holds a sealed envelope for a recipient who is offline for 5 days (120 hours), on every plan. The anonymous lane carries no plan token (B383), so the relay is never told which plan the sender has.
Encryption notice in chats
Optional strip "Messages are end-to-end encrypted" under every chat header.
Aham shown on chat open
The contact's status line shows briefly under the header when you open the chat.
Forward to many :Handles at once
Pick several :Handles, or Select all, and one forward goes to each, every one sealed end-to-end for its own chat. How many at once is the cap: 5 on every plan, as a brake on mass forwarding.
Poll options
A poll carries two or more options; the plan sets how many.
MirrorMesh reactions with a character
Reaction loops and stickers drawn on your phone with Spoji's or Tipko's face: the search is the pack's own tags on the device, and the relay never sees a search or a pick. Uncounted on every plan. (Split from row 267 in B377, when the my-face half was switched off.)
Forwarded many times
A message forwarded along a chain of five or more says "Forwarded many times", and goes to one chat at a time from there. The count travels inside the seal; nobody but the chat sees it.
Message actions· 22
Reactions
Long-press quick row of favourites plus "+" for the full emoji picker.
Reply (swipe right)
Swipe right on any bubble to quote-reply; the keyboard opens. The quote rides whatever answers it: text, a voice note, a photo, video, file, sticker, album, location, contact card or reaction.
Edit (swipe left on your own)
Swipe your own text right-to-left or long-press → Edit; marked "edited" on every device.
Forward
Forward to other chats, governed by the sender's lock.
Copy
Copy text, honouring the sender's protection; never on view-once.
Delete for me / to peer / to both
Three deletes; swipe right-to-left on a received message = delete for me (asks first).
Configurable quick actions
Choose which of React / Reply / Forward appear as icons beside bubbles (off by default).
In-chat search
Chat ⋮ → Search chat, over the encrypted local database.
Personal message pins
Pin any message in any chat for yourself only; a pinned bar at the top of the chat.
Chat export
Export a chat as a readable .txt transcript or an encrypted .spojiti archive.
Tap a quote to jump to the original
Tapping a quoted reply scrolls to the original message.
Share to other apps
Share any message through the OS share sheet: a photo, video, voice note, file or sticker as the file, a reaction as a picture, and text, a location, a contact card, a poll or a payment request as words (within what the sender allows).
Undo "delete for me"
A few seconds to undo before anything is destroyed.
Labels
A message's long-press menu → Label, in every chat and Focus: the labels show under the bubble and Search chat → Labels finds them; the Chats tab has no label filter (B373).
Message info
Sent / delivered / read (or received / seen) times for any message; read-by roster for your group messages.
Double-tap action
Double-tap a message to Copy, Forward, Share, or nothing.
Scroll To (jump to a date)
Chat ⋮ → Scroll To picks a day; a floating date badge shows while scrolling, plus a jump-to-latest button.
Message order
Order a thread by sender's time or by when you received it.
Clear chat / delete conversation
Clear empties this device's copy and keeps the contact; Delete chat removes it.
Mute a chat
Mute / unmute notifications per chat or group.
Message menu switches
Settings → Experience → Message menu: an on/off switch for every item of a message's ⌄ menu, all on by default.
Delete & Edit, per person
On a person's contact page (tap their name at the top of the chat): Delete & Edit on, their deletes and edits change your copy as they do today; off, you keep the original of everything they send you once you have seen it. Until you have seen a message, its sender's Delete to Peer, Delete to Both and edits always reach your copy; the switch governs only what you have already seen. Their app tells them before they delete or edit a message to you. Decides your copy only; the relay never sees the setting.
Chat list & organisation· 13
Search names and message content
One search box: contacts first, then matches across every chat's encrypted history.
Archive + swipes
Swipe right to archive/unarchive (asks first), left to delete; Archived section below the list.
Rename a contact
A private label only on your device; names imitating :Spojiti_Beta are refused.
Blocked section + swipes
Blocked :Handles listed apart; swipe right to unblock, left to delete.
View menu
All / Unread / Groups / Stars, each with a count, plus one Circles row (the circles are capsules under the search in that view) and a Focus row.
Star chats
Star / unstar a chat; Starred view.
Circles
Local groupings (Family, Work…) of :Handles and groups; filter the list by circle; manage (rename, delete, members); nothing touches the network.
Chat long-press menu
Mark as read, Star, Edit name, Circle, Mute, Archive, Shared media, Export chat, Block, Delete chat; a group's sheet: Group info, Star, Circle, Mute, Leave, Delete chat (B383).
Mark all read
One header button, shown only when something is unread; receipts sent in a batch.
Compose button
+ → Add :Handle or Create ::New group; first-contact button on an empty list.
Zero-PII card
"End-to-end encrypted, we can't read them" card at the foot of the chat list.
Contact page
Tap the header: big avatar, Aham, Audio / Video / Request / Search actions and every chat setting as rows; the Account ID card (tap to copy).
Shared media per contact
The Data hub filtered to one chat: from the chat's menu (Data), the chat's avatar and name above the search, one tap back to everything.
Groups· 14
Group chats (no record on the relay)
Groups you create: up to 6 members on Free and Basic, 256 from Pro; each message sealed per member; the relay keeps no record of any group.
Member search when creating
Search box in the member picker.
Group audio calls
Encrypted P2P mesh; start from the group header, others join from the banner; the message relay never carries the call, and our TURN relay carries a leg's encrypted media only when a network blocks the direct path.
Group video calls
Video mesh with a card for everyone on the call, you included; full-screen a tile.
Admin-only polls switch
"Only admins create polls" per group.
Group info & management
Rename, group photo, description, add / remove members, make / remove admin, every change signed by the admin.
Leave group / never orphaned
Leave any time; if the last admin leaves, another member is promoted automatically.
End group for everyone
An admin can dissolve the group for all members.
Pin for everyone
Group admins pin a message for all members.
Group disappearing timer
Disappearing messages set for the whole group.
Group calls ring and cancel properly
Members ring (incl. lock screen); the ring stops when the starter hangs up or you join.
Groups you create
Groups you can create: two on Free and Basic, unlimited from Pro. Joining groups others create is never limited.
Members in a group you create
How many :Handles a group you create can hold: 6 on Free and Basic, 256 from Pro.
Co-admins in your groups
Whether you can make another member an admin of a group you created: from Pro.
Calls· 16
Call history (Calls tab)
Local log with honest outcomes; filters All / Incoming / Outgoing / Missed / Cancelled; search; tap to call back.
Audio calls
End-to-end encrypted, peer to peer; falls back to our TURN relay (TLS on 443) on strict networks. Every frame is sealed a second time (AES-GCM) under a key made for that one call, which travels inside the chat: post-quantum where the chat is, and the call screen says so; a device that cannot falls back to DTLS-SRTP alone, both sides together.
Video calls
Same encrypted path with camera; flip camera on the self-view. Every frame is sealed a second time (AES-GCM) under a key made for that one call, which travels inside the chat: post-quantum where the chat is, and the call screen says so; a device that cannot falls back to DTLS-SRTP alone, both sides together.
Per-contact ringtones
Set a ringtone per :Handle from the chat menu, Spojiti's pack, one of the phone's ringtones or a track of your own (B387); a hidden caller always rings with the Settings ringtone.
Noise cancellation
On-device echo and noise suppression during calls (switch in Experience).
Call recording with consent
Tap Record; the other side must Accept, or Accept, no sharing (the recording then plays only in the recorder's Spojiti, which never shares it or its transcript); both see "Recording, with their consent"; 1:1 and group (unanimous); a video call records both people, a call with the cameras off is saved as audio; played back with a pause button and a scrub bar; sealed on this device.
Switch audio → video
In an audio call the Camera slot asks the other side to go to video.
In-call controls card
Mute, Camera, Audio route, Record, Share, End, Notes, Transcribe, Summarize: a 3×3 card on a phone, one row on a wide window; folds away to a bubble.
Audio route
Phones: earpiece / speaker / Bluetooth; Android outbound calls start at the earpiece; follows headsets plugging in. Computers: the Mac's or PC's own sound outputs, by name (B383).
Screen share
Share your screen in 1:1 and group calls (several at once); iPhone via Start Broadcast; Windows capture supported.
Minimise a call
Go back to the app while the call continues, 1:1 and group calls; a pill brings the group call back.
Lock-screen ringing
Calls ring over the lock screen: CallKit on iPhone, full-screen call card on Android (Answer / Decline).
Edit call history
Remove one entry, clear the log, export call logs.
Missed-call dot
Amber dot on the Calls tab while there is an unseen missed call.
My caller tune
Settings → Notifications → My caller tune: what your contacts hear while your phone rings for their call, the standard ringing tone or one of Spojiti's tunes. It reaches them inside the sealed profile envelope your status line rides, so it plays on their phone from the first second, whether your phone is awake or not. Every platform.
Screen sharing (a week)
Screen shares in a call in a week: one on Free, Basic and Pro; unlimited from Plus.
Call records & transcripts· 7
Records view
Calls → Records: play, rename, share or delete recordings (audio m4a, WAV on Windows, or video mp4); export records. A recording accepted with no sharing is marked Record only and has no Share.
Call notes
A titled text note per call, from the call card or the record.
On-device transcripts
Turn a consented recording into text on the device (Android, iPhone, Mac, Windows) with its own offline engine, Google, Apple or Microsoft, never a server; every word kept; the language model downloads in the app where the system allows; read, copy, share, edit, rename and delete it from the recording's menu; deleting the recording deletes its transcript (B383).
On-device summaries
A short summary of the transcript, computed on the phone; re-summarize.
Transcript language & translation
Choose the spoken language and translate transcripts on the phone (Android, iPhone); the translation opens from the recording's menu, "Transcript (language)" (B383).
Call tools switches
Turn Call notes / transcripts / summaries on or off in Experience.
Call recordings (a week)
Recorded calls, audio or video, in a week: one on Free, Basic and Pro; unlimited from Plus. Nothing records until the other side accepts.
Media & Files· 18
Data hub (Data tab)
Everything sent and received: Media, Docs, Voice, Links and Pings tabs, all sealed on this device (Focus lives in Chats → View → Focus); opened from a chat's menu it shows that chat only (its avatar and name above the search), one tap back to everything.
Send photos & videos
Multi-select with captions, sealed per blob with fresh keys; a video sent from a phone, a Mac or a Windows PC carries a small poster inside its sealed message (not a view-once one), so it shows a picture before it is downloaded, on every platform (B383, Windows B401).
Send documents & files
Any file via Docs.
In-chat camera (phone)
Tap for a photo, hold for video, review, send.
Share into Spojiti
Send text, links, photos, videos and files from any app via the share sheet (Android, iPhone, macOS "Send with Spojiti"): Spojiti opens on "Send to…", then the chat it went to.
Focus (notes to self)
Named private notebooks on this device: file any message into a Focus (honouring locks) or type into it; forward, share, export, clear, delete a Focus.
Desktop camera
Take a picture from inside the app on Mac and Windows. From build 364 the desktops run the phones' own camera screen: click for a photo, hold for a video, trim, send (#466).
Video review & trim
Every picked video opens the review/trim screen first, with a native cut on Android, iOS, macOS and Windows.
Pick from device or Spojiti · Data
Every picker asks: this device, or Spojiti · Data (Media / Voice / Docs), with the Forward rules.
Full-quality photos switch
Off = resized and re-compressed; on = full quality up to the plan's pixel limit.
Download media on mobile data
Mobile switch: media waits for Wi-Fi (tap to get it now); voice notes always arrive.
Media viewer
Swipe/arrow slider across media, pinch-zoom, video player, info pop-up.
Media info
Everything the device knows about an item, in a pop-up, copied as text, or shared with the item itself inside Spojiti (to a chat) or outside it (the share sheet), where the sender allows.
Media viewer actions
Forward, Share, Save to gallery, Delete; Set as My Avatar / Group Avatar; "Flash it".
Data hub views & bulk actions
Grid/list, sent/received, group by date, week, month or year, search, multi-select then forward/share/save/export/delete (export: Downloads on a computer, the share sheet on an iPhone, a chosen folder on Android); rename voice notes.
Audio player
One player for voice notes and recordings with tap/drag seek; only one thing plays at a time.
Desktop drag-and-drop
Drag files from Finder, Explorer, Mail or a browser onto an open chat on a Mac or a Windows PC: they go the way picked files go (a photo as a photo, a video to review and trim, one caption for the lot). Pasting a photo or file works on every platform too.
Live location shares (a week)
Live location shares in a week: one on Free and Basic, unlimited from Pro.
React from the viewer, or reply, arrives as a sealed message quoting the Flash.
Flashes (a week)
24-hour post, text, photo, video or audio, sealed to each contact separately.
Flash insights
Who viewed, replied and reacted to your Flash.
My Flashbacks
History of your own Flashes with filters (text/photo/video/audio) and search; take down or delete.
Flash it from the media viewer
Post a received or sent photo as a Flash in one tap.
Flash & Avatar complete
Who viewed your Flash, and replying and reacting to Flashes and Avatars: from Plus. Posting one Flash a week and changing your Avatar are free.
Notifications· 10
Content-free push
The push carries only "something is waiting"; names and text are added by your device after decryption.
Notify me policy
All messages / Only when the app is closed / Off (calls still ring).
Tap opens the message
Warm and cold start both land in the right chat.
Sender photo on notifications
Sender picture decrypted in memory; switch to show the app logo instead.
Message previews switch
Show decrypted text in notifications, or just "New message".
Rich lock-screen previews
Sender and text on the lock screen while the app is closed, opened on the phone with a per-contact preview key: on iPhone by an on-device extension, on Android by Spojiti's own notification code (B406); off = just "New message".
Checks notification permission, background delivery (battery / Autostart / Background App Refresh / open at login) and Android full-screen calls, each with a tap to the exact OS setting.
Desktop notifications
Native banners on Mac; Windows toasts that open the chat.
Ringtone and notification sound
Settings → Notifications: the ringtone from Spojiti's pack, this phone's own ringtones, or a track of your own (Android; computers: pack or track); the notification sound from every sound the phone has (Android). An iPhone rings with Spojiti's tune through CallKit and uses the system sound.
Identity & Account· 10
Profile-picture viewer
Tap any avatar to view full screen, pinch-zoom, react or reply to it.
Recovery-phrase identity
12 machine-generated words are the whole account; shown behind the phone's lock with a reminder dot until saved.
Delete identity on this device
Erases keys, messages and media here; other devices keep working; the 12 words bring it back.
Profile picture
Set, crop (pinch/drag), view or remove your photo; travels sealed to contacts.
One-tap onboarding
Accept the terms and you are in: keys and an automatic :Handle are made on the phone; no phone number, email or password.
:Handle
Choose and edit your display name in place (centre of Settings).
Aham (status line)
One line your contacts see, sealed like your picture; earlier Ahams and suggestions to pick from.
Who viewed my picture
"Seen by" list of contacts who opened your picture full-screen.
Account ID capsule
Your random Account ID in a capsule, tap to copy.
Delete my account everywhere
Removes the account from the relay and every device, deletes passkey recovery, then wipes this device.
Contacts & discovery· 8
Add by QR
Show your QR or scan theirs (torch on the scanner); pairing is mutual.
Add by Account ID or invite link
Paste an ID or open an invite link (it carries your id, :Handle and a pre-authorisation token, plus a referral id during a referral promotion); the link lands on a web page that opens the app.
Contacts import / export
Your :Handles as a small readable file, names and Account IDs only, no messages, to keep or bring to another account; importing adds the ones you do not have yet. Settings → backup.
People who have my number can find me
Opt-in beacon: we hold a blinded fingerprint of your number (read from one or both SIMs on Android, typed on an iPhone), never the number; off in one tap.
Auto-fill my own number (Android)
Reads this phone's own number(s) for the discovery sheet.
People I know
Your address book is matched on your phone; only blinded values the relay cannot read are sent to it. Each person found is one line beside their avatar, as in the chat list, with + Spojiti or Chat; the refresh bubble looks again. A match never gives an account: + Spojiti knocks, and the hello reaches them only if your number is in their address book too (mutual only). The number of people you can say hello to a week is set centrally, the same for everyone, and never sold; who can be reached stays mutual only.
Spojiti in the phone's contacts
Opt-in: :Handles appear in the phone address book (Android rows; iPhone via CallKit recents).
Say hello to people found by number
A found person gets a message request with one tap; the number of people you can say hello to is per week, counted on the phone.
Devices & accounts· 9
Linked devices
One identity on several devices, each holding the identity and its own device keys; link by QR plus a six-digit confirmation code; revoke any device.
Link a Mac or PC
Desktop joins as a linked device of your phone.
Several accounts on one phone
Separate identities with their own phrase, chats and database; Log out keeps chats sealed; Add account.
Account chooser & sign-in
Pick a :Handle and sign in with Spojiti PIN, Face ID / fingerprint, the 12 words or the recovery code; remove an account from the phone.
Account switcher
Tap "Spojiti" in the Chats header (or the logo at the foot of the desktop rail) to switch accounts.
The Spojiti PIN guards the account
The 12 words alone no longer take an account: a new phone also asks for the 6-digit Spojiti PIN, checked by the relay (it holds only a hash of a value stretched with Argon2id and salted by the 12 words), three tries then 30 minutes, doubling to 24 hours. Backups are sealed under the 12 words and a backup share the relay releases only with the PIN. A forgotten PIN is replaced at once: on a device still signed in with the face or fingerprint, on a new phone with the owner's passkey; with neither, a 7-day reset every device can cancel.
Every account change is told, and "Not me"
A device added, a wrong PIN, a PIN reset or a lost-device report is told to every device at once, with a card even when Spojiti is closed; the Devices screen shows when each device joined and was last seen. "Not me" erases a device and blocks it for 30 days, signs every device out and sets a new PIN and backup key, in one step, from a device on the account 72 hours or more.
Forgot PIN: face, passkey or a reset, nothing lost
"Forgot PIN?" on the lock screen: Face ID or fingerprint (or the 12 words) opens Spojiti and a new PIN is chosen before anything else. On a new phone, the owner's passkey stands in for the PIN and a new one is set at once, the backups kept. With no device and no passkey, a 7-day reset every device can cancel, waited out on the phone with a reminder on the day; the backups from before it open again 30 days after it started, unless a device from before the reset keeps them closed.
Accounts on one phone
How many Spojiti accounts one phone can hold and switch between (Settings → Account → Log out / Add account): one on Free and Basic, two from Pro, three from Max.
Recovery & backup· 12
Restore with the 12 words
Twelve fields with word autocomplete, checksum and paste-whole-phrase.
Export encrypted backup
An encrypted file only your recovery phrase opens: save it or share it from Back-up & Restore.
Scheduled backups to the places you choose
Back up now, or weekly at a time you set, messages only or messages and media; to this device, to a folder you choose, or, with Max or Ultra, to Spojiti.cloud (in your own region, sealed; the newest copy kept). Restore from any of them with your recovery phrase.
Recovery code (encrypted QR)
A printable QR of your recovery words, locked by a generated seven-word code key.
Come back with Face ID after reinstall
Reinstall on the same phone and get back in with biometrics instead of the 12 words (not on Windows).
Come back with a passkey
A passkey in iCloud Keychain / Google Password Manager seals your phrase; the relay keeps only a locked copy.
Trusted contacts (social recovery)
Split a recovery key between people you trust; any threshold of them can bring you back; "Recovery pieces I hold" for others.
Send / get my chats phone to phone
Move the whole history, media included, directly between two linked phones.
Restore from a backup
From Spojiti.cloud, iCloud, Google Drive, your own server, a folder, a file or your old phone; offered right after the 12 words on a new device.
Storage on this device
What the encrypted store and media weigh; check integrity, clear temporary files, compact the database.
Lost device: tries a backup, then erases itself
Report a lost phone or computer on the Support page with the Account ID and the lost-device code (derived from the recovery phrase; the relay holds only its hash), or from another signed-in device. A report from the Support page stops the device receiving at once and acts 48 hours later, so a report someone else made can be cancelled from any of the account’s devices with the Spojiti PIN; one from a device on the account 72 hours or more acts at once (B420, B422). Each device that existed at the report hears it on its next connection, before any message, or at once through a wake that makes it ask for itself, even locked behind App Lock or with Spojiti not open (a phone the system will not wake, or a computer with Spojiti closed, hears the next time Spojiti starts, before its PIN): it covers the screen, tries a sealed backup to the places its backups go (Spojiti.cloud when none is set), and erases itself. A device set up again afterwards is never touched.
Sync my devices
Settings → Back-Up & Storage → Sync my devices: two devices of one identity compare what they hold and each sends the other only what it is missing (chats, their media, call recordings); nothing either deleted, cleared or let expire comes back to it. With a linked device (Accept / Reject on the other), or with no server at all: a code shown on one device and scanned (pasted on Windows) on the other, on one Wi-Fi or hotspot. Sealed with the recovery phrase end to end.
Subscription· 8
Spojiti Packs, a year each
Five packs, one ladder: Basic (files to 50 MB, custom themes), Pro (100 MB, unlimited groups with admins, unlimited live location, two devices and accounts), Plus (250 MB, unlimited call recordings and screen sharing, Flash & Avatar complete), Max (500 MB, three devices and accounts, 2 GB on Spojiti.cloud), Ultra (1 GB files, 5 GB on Spojiti.cloud). A pack lasts a year on every device of your identity and includes every pack below it; buying it again renews it. Priced per country in Ops.
Spojiti Packs page
Settings → Spojiti Packs: the card that says what you hold (Free Forever, or your pack and its limits), Apply Promocode and Redeem Pack, then the five packs, Basic, Pro, Plus, Max and Ultra, each with its regional price, its features and limits, and Unlock Now. A higher pack includes every pack below it; an unlocked pack says so instead of a button.
Caps shown everywhere
One card for every limit: it names the limit you reached, the pack that raises it and Unlock Now where a purchase can start there; during a call it only informs, so no checkout ever interrupts a call. A received file over your limit shows as a locked card, never fetched.
Limits set centrally
The relay hands every app the current limits when it connects; before its first connection an app uses the Free limits.
Redeem a pack code
Buy a pack on the website without an account; the receipt's PACK_ code (or a promotion's) is redeemed in the app, Settings → Spojiti Packs → Redeem Pack, or in one tap from the website on a device that has Spojiti. The pack becomes a blind-signed token, so no purchase names an account.
Buying a pack in the app
Unlock Now buys the pack: on iPhone through the App Store (one product per pack per price group, created in App Store Connect); on Android, Mac and Windows through the website checkout, which opens on that pack and hands the code back to the app. The relay mints the pack's token once per purchase.
Paid mark on support tickets
A ticket filed with a blind pack token is marked with the pack on the board without learning who filed it.
Promo codes
A promo code, applied in the app (Settings → Spojiti Packs → Apply Promocode), either unlocks a pack for free or takes a percentage off a pack. Each code has a name, start and end dates and how many people may use it; a free pack works on every platform, a percentage off applies on the website and in the Android, Mac and Windows apps. Ops sees how many used each code, never who.
Personalisation & Themes· 6
Default Themes (System / Light / Dark)
Follow the phone or pin light or dark.
Nine built-in themes
Spojiti, Forest, Ocean, Lagoon, Sunset, Dusk, Mono, Ember, Rose, each recolours the whole app, light and dark.
Custom chat colours
Sent bubble, received bubble, chat background and buttons from a colour palette, and, per bubble, the text, time, :Handle name, reply background, reply bar and border, a shadow switch, with a live preview; a colour that would not read is flagged, and every automatic colour is chosen to read on its bubble; reset to default.
Wallpapers
Nine patterns, or a picture from the gallery or Spojiti · Data.
Language
Every word of the app in English, Hindi, Kannada, Spanish, Arabic (right-to-left) or French. The picker has a search box and lists whatever languages our website publishes; a language is a signed pack downloaded when picked, and updates itself.
Custom Themes
The nine custom themes, your own colours and wallpapers: from Basic. Spojiti light and dark are free.
Accessibility & UX· 7
Calm mode
Freezes ambient animation and dims the glow; OS reduce-motion is honoured too.
Welcome tour
Short first-run tour (handle, recovery code, biometrics, notifications); replay from Settings.
Instant resume
A returning user lands on the chat list at once instead of a splash.
Battery saver
Freeze backdrop and call-card motion, skip auto-transcription; follows the OS saver.
Battery & performance reading
Battery and thermal state with a refresh.
Preview with sample chats
Fill the app with example conversations in memory; nothing saved.
How Spojiti works videos
Short captioned videos with Spoji, made from the app's own screens, in Settings → Experience. Each one downloads from our website only when tapped, and plays only if Spojiti signed it.
Assistant & support· 8
:Spojiti_Beta in-app guide
The official chat answers questions from a fixed guide stored on the phone, with no AI model; the answer is found on the phone, so it works in airplane mode.
Diagnostics
On-device action log with no content or PII; copy or export for support.
About, Terms, Privacy, licences
Version and build, Terms & EULA and Privacy policy read in the app (no browser), open-source licences.
Network quality probe
Diagnostics measures round-trip time and jitter to our relay.
Contact support
File a ticket on the public board from the app, optionally with the diagnostics export; no account.
Reviews & feedback
Rating and review published on spojiti.world with no name and no account; a written review first needs a one-time code from your :Spojiti_Beta chat.
Check for updates / auto-update
Manual check and automatic updates (web-rail builds), accepted only from this build's own site and verified by SHA-256; a waiting build puts the amber dot on Settings, About Spojiti and Check for updates. Updates cannot be turned off.
A code from the official chat before any website post
Support tickets, feedback, roadmap ideas and replies on the website need a six-digit code sent to the poster's own official chat. The code request is deleted within a day; a verified post keeps the random account id that verified it, visible only to our staff. No name, number or e-mail exists to join it to.
Platforms & Desktop· 8
Android app
APK from the beta site (Play later).
iPhone and iPad app
TestFlight build for iPhone and iPad.
macOS app
Native Mac app (DMG).
Windows app
Native Windows app: a portable ZIP from the download page today (unzip and run, no installer; links, notification clicks and update offers work), the Microsoft Store (MSIX) once it is approved; incl. call recording, transcripts, screen share and screenshot protection.
Desktop three-column layout
Rail, chat list and chat side by side at ≥880 px; narrows to the phone layout.
Close to tray / menu bar
Closing the window keeps Spojiti running in the menu bar / notification area; Quit really quits.
Open at login (Mac)
Start with the Mac so messages arrive without opening the app.
Desktop settings as pop-ups
Settings sections open as pop-up windows on Mac and Windows.
Reliability & network· 3
Auto-connect and self-heal
Silent register and reconnect with backoff, route racing and DNS fallback on every launch.
Is it us, you, or a block?
When offline the banner says whether your device, our relay, or your network may be the cause.
Relay connection card
Settings → Account shows the relay connection state and a Test button.
Productivity· 1
Pings (reminders)
Set a Ping on any message: a name, an action and a time; the phone rings it, and the card leads back to the message.
Media· 1
Albums
Several photos and videos picked at once travel as one album, in order.
Settings· 2
Add-ons
Settings → Experience → Add-ons (B433: was About Spojiti → My Packs): the languages on this device (English built in; update or remove the others), the reaction and sticker packs from the website, Spojiti's tunes for the ringtone, and GIFs (from your own gallery, no pack). One switch, Update add-ons automatically: on, a newer signed pack replaces yours at launch; off, nothing is fetched until you tap Update.
Promotions
Settings → Promotions lists what Ops is running where you are: offers on packs (a percentage off, or a pack free for a set number of people, between two dates), referral rewards (share your link; when enough people you invited have joined, a pack unlocks for you, and the person who joined gets the pack set for them), and the promo code you applied. Each card carries its own button: claim, share, or unlock.
Which plan has what?
The full side-by-side matrix lives on the plans page.
Everything Spojiti does