The User Guide

1 · What Spojiti is

The short answers people ask first.

1.1 What is Spojiti?

Spojiti is a private messenger that never asks who you are, no phone number, no email, no name. Your recovery phrase IS your account, every chat is end-to-end encrypted, and even our own relay cannot read a word you send. That is not a setting; it is the architecture.

1.2 What can it do?

The short tour: sealed chats and groups, voice notes, stickers and GIFs, polls, disappearing and view-once messages, on-device search, stories, encrypted calls set up over the post-quantum session, live location, honest receipts, App Lock, phrase-based identity and zero-knowledge everything. The complete, always-current list, every feature, what Free includes and what each pack raises, lives at spojiti.world/features.

1.3 Why no phone number?

A phone number is an identity leash: it links your chats to your name, your SIM, your country, your records, and once a service holds it, so can anyone who compels or breaches that service. Spojiti starts from a random recovery phrase instead, so there is no number or name of yours to leak, sell, or subpoena. We did not remove the phone number as a feature; we removed it as a liability.

1.4 What does the name mean?

“Spojiti” is a South Slavic verb meaning to connect, to join together. That is the whole mission in one word: connect people, without connecting them to surveillance.

1.5 Why does Spojiti exist?

Because private conversation should not be a luxury good or a trade for your identity. Everything here follows from one question, asked at every design decision: “what is the version of this feature that we could not abuse even if we wanted to?” Sometimes that costs us a convenience. We pay it. That is the product.

1.6 Who builds it?

Spojiti is built by CognitionX Logic India Pvt Limited, an Indian start-up headquartered in Bengaluru; company details are at https://cognitionxlogic.com. The engineers who build Spojiti test every build on real devices before it ships, write these answers themselves, and read every report that comes in. One coherent architecture, owned end to end: every screen and every line of the app and the relay is ours, running on servers we operate and built on published, standard cryptography.

1.7 How does Spojiti make money?

Spojiti is funded by the packs, and nothing else. No ads, no data sales, no “partners”: all we hold about you is a random account id and the routing a relay needs, nothing worth selling even if we wanted to. When the person who pays is the user, the product serves the user. Even payment is engineered private: a blind-signed pack means we cannot link a payment to an account.

1.8 How does it compare to other messengers?

Respect where due: the best private messengers proved end-to-end encryption at scale, and we build on the same peer-reviewed cryptographic ideas. Where Spojiti goes further: no phone number needed (every mainstream messenger requires one), post-quantum protection on every chat between people, blind-signed payments that cannot be linked to you, and an on-device assistant instead of a cloud one. Versus the mainstream messengers the difference is starker, no parent company hungry for your graph, and nothing “encrypted optionally”. Every chat, always, sealed.

1.9 The company

Spojiti is built and run by CognitionX Logic India Pvt Limited, an Indian start-up headquartered in Bengaluru, and it is paid for by the people who use it: no advertisers, no data buyers, no token. Company details are at https://cognitionxlogic.com, and Spojiti’s own news is at spojiti.world/press.html. For anything else, write to spojiti@spojiti.world.

1.10 Open source and the audit

The Spojiti Private Messenger Core, the app and the relay that prove the zero-PII design, is open source, published under the AGPL v3 at github.com/Spojiti, so anyone can read exactly how a message is sealed and routed. The rest of the product is not published, and we do not say it is. The open-source licences of everything we build on are listed in Settings → About Spojiti. The protocols themselves are the public, peer-reviewed ones (Double Ratchet, ML-KEM, ML-DSA), and the post-quantum code checks itself against NIST’s own test vectors on your device at every launch. An independent security audit of the full product is in progress, expected by end of 2026 and on track; the report goes on spojiti.world in full, findings included.

2 · Getting Spojiti

Installing it on each device, keeping it current, and what the beta is.

2.1 Installing on Android

On Android, Spojiti comes as a signed APK straight from us: open spojiti.world/download.html on the phone, tap Download Spojiti.apk, open the file, and allow installs from your browser once when Android asks. It needs Android 8 or later. If Android says “App not installed”, the phone is 32-bit: use the Spojiti-arm.apk link on the same card. The page prints each file’s SHA-256, so you can check the APK is exactly the one we built and signed, and the app tells you itself when a newer build is ready.

2.2 Installing on iPhone and iPad

On iPhone and iPad the beta installs through Apple’s TestFlight: install the free TestFlight app from the App Store, open the join link from spojiti.world/download.html on the iPhone, tap Accept, then Install. Open Spojiti and tap Accept & Continue; that is the whole sign-up. Updates arrive through TestFlight on their own.

2.3 Installing on a Mac

On a Mac: download Spojiti.dmg from spojiti.world/download.html, open it and drag Spojiti to Applications. It is a native app, notarised by Apple, for Apple silicon and Intel Macs. Then either link it to your phone (on the phone: Settings → Account → Linked devices → Link a new device, and scan the code the Mac shows) or create a new identity on the Mac itself. The Mac app updates itself when a new build is out, and Open at login (Settings → Notifications → Delivery health) lets messages arrive without opening it first.

2.4 Installing on Windows

On Windows 10 or 11: download the ZIP from spojiti.world/download.html, unzip it anywhere and run spojiti.exe in the folder; there is no installer and no admin rights needed. If SmartScreen says it does not know the publisher, choose More info, then Run anyway; the Microsoft Store version follows once it is approved. Link it to your phone by its QR or create a new identity. To update, unzip the next build over the same folder; your chats live in your Windows profile, not in that folder. Closing the window keeps Spojiti running in the notification area until you choose Quit.

2.5 Spojiti on your computer

Yes: Spojiti has native apps for Mac (Apple silicon and Intel) and for Windows 10 and 11, from spojiti.world/download.html; there is no browser version yet. Link it to your phone by QR and it becomes one of your devices: pairing copies your identity to it, sealed, and it then keeps its own sealed sessions, so it keeps working when your phone is off. On a wide window the chat list and the chat sit side by side, calls and screen share work, and closing the window keeps Spojiti in the menu bar or the notification area so messages still arrive; Quit really quits. You can also create a separate identity on the computer instead of linking it.

2.6 Getting the latest build

Every time Spojiti opens it checks our own site for the next build. When one is out, a full screen asks you to update before you carry on, one button, and your chats stay safe on your device. Android and Mac: Spojiti downloads it, checks it and installs it (Android may first ask you to allow Spojiti to install its own updates). iPhone: it opens TestFlight, tap Update next to Spojiti Beta. Windows: it opens the download page, or the Microsoft Store if that is where you got it. There is no switch to turn this off and no Later: everyone moves forward together, and a build only ever comes from our own site or your store.

2.7 The beta

This is the Spojiti beta: the real app, end-to-end encrypted exactly like the launch build will be, on its own servers and its own website, spojiti.world. The official chat is :Spojiti_Beta, on the beta it carries the beta’s own name, so a beta screenshot can never pass for the launch app, and the beta’s icon carries an amber padlock. Every feature is on for everyone, and the packs are real: Settings → Spojiti Packs sells them exactly as the launch build will. Tell us everything that breaks: Settings → About Spojiti → Contact support files a ticket with no name or email, marked only with your random account id.

2.8 After the beta

The beta and the launch app run on separate rails that share nothing, not a server, not a database. So today a beta identity does not move into the launch app by itself; if we build a way to carry it over, this chat will say so plainly before launch, so nobody loses chats by surprise. Keep your 12 words written down either way.

3 · Your identity and recovery

No account, no phone number, a phrase is the whole identity, so treat this section as the one to actually read.

3.1 The recovery phrase

Your recovery phrase is your entire account, identity, keys, everything derives from it. Write it on paper and keep it safe. If it is lost and you set up no other way back (a recovery code, a passkey, Face ID on the same phone or trusted contacts, ask me about ways back), the account is gone forever: nobody, including us, can reset it, because we hold nothing about you to reset. That is the price and the point of true privacy.

3.2 Can I choose my own phrase?

The phrase is always machine-generated, on purpose: its randomness is exactly what makes your account impossible to guess. Words a human would choose are words a human can guess. Spojiti makes it for you at the one-tap start and you cannot type your own, that is a security feature, not a missing one; for a different phrase, delete this identity and start again.

3.3 Saving your 12 words

Your 12 recovery words are in Settings → Account → Recovery phrase, shown only after your phone’s own unlock if it has one. Write them on paper, in order, and keep the paper somewhere safe and offline: not a screenshot, not a photo, not a cloud note, on Android, Windows and Mac the screen blocks screenshots while it is open for exactly that reason, and an iPhone lets no app do that. Until you save them, an amber dot sits on Settings → Account and a card reminds you, because an account made with one tap has no other way back yet. (An amber dot on About Spojiti means something else: a new build is waiting.)

3.4 Every way back in

There are five ways back into an identity, and you choose which to set up. 1) The 12 recovery words, always (Settings → Account → Recovery phrase). 2) The recovery code: a printable QR of those words, locked by a seven-word code key (Settings → Account → Recovery code). 3) Face ID or fingerprint after reinstalling on the same phone (Settings → Security; not on Windows). 4) A passkey in your iCloud Keychain or Google Password Manager (Settings → Security, on iPhone and Android). 5) Trusted contacts who each hold a piece of a recovery key (Settings → Security). On a new device choose I already use Spojiti → Restore my account. Set up at least two; with none of them, nobody can bring the account back, us included.

3.5 The recovery code

The recovery code is your 12 words in another form: a QR you print or keep on an offline drive, locked by a separate seven-word code key that Spojiti generates and shows once. Make it in Settings → Account → Recovery code, and memorise or write the key apart from the code: anyone holding both is you, either alone opens nothing. To restore, choose I already use Spojiti → Restore my account, scan or paste the code, then type the key. A new code does not cancel an old one, so the only way to retire one is to destroy the paper.

3.6 Trusted contacts

Trusted contacts is recovery through people: Settings → Security → Trusted contacts splits a recovery key into pieces and sends one, sealed, to each :Handle you pick. It takes a majority to bring you back, for example 2 of 3, or 3 of 4 or 5, and fewer pieces reveal nothing at all. If you ever lose everything, choose I already use Spojiti → Restore my account → Trusted contacts, and ask enough of them to show their piece as a QR or send it as text. Pieces you hold for others are under Settings → Security → Recovery pieces I hold. Nothing is kept on any server.

3.7 Coming back with a passkey

Settings → Security → Come back with a passkey creates a passkey that seals your recovery phrase. The passkey lives in your iCloud Keychain or Google Password Manager and syncs there; Spojiti keeps only a locked copy it cannot open. On a new iPhone or Android phone signed in to the same Apple or Google account, choose I already use Spojiti → Restore my account → Passkey and you are back without typing the 12 words. The same switch turns it off, and Delete my account everywhere removes it too. Passkeys are offered on iPhone and Android.

3.8 Coming back with Face ID

Settings → Security → Come back on this phone with Face ID (or your fingerprint) keeps your seed in the phone’s own secure storage, which outlives deleting the app. If Spojiti is deleted and installed again on that phone, it opens on Welcome back, and your face or fingerprint brings the identity back, no 12 words needed. It works on that one device only, and it is not offered on Windows, where uninstalling removes the app’s own storage with it.

3.9 Handles instead of names

Names on Spojiti wear the : glyph, one colon for a person, two for a group. There is no global username registry on purpose: a registry is a directory of users, and directories get scraped. Your :name is what YOU choose to show; contacts connect by code or QR, not by searching a database. And nobody can wear our name, the app refuses lookalikes of :Spojiti_Beta at every path.

3.10 Renaming a contact

Rename any contact with Edit name, from a long-press on the chat list or on their contact page, the label is yours alone, stored only on your device; they never see it. One guard: names that imitate the official :Spojiti_Beta channel are refused, so nobody can be dressed up as us.

3.11 Restoring on a new device

Install Spojiti on the new device, choose Restore, and enter your paper phrase, identity and keys derive right back. Spojiti then looks for your backups (in Spojiti.cloud, iCloud and the places you set up) and brings your chats and their media back from the one you pick; you can also choose a backup file, your old phone, or start fresh. and conversations re-establish their sealed sessions automatically on first contact. The phrase is the whole ceremony; that is why it must never be lost.

3.12 Moving your chats phone to phone

To move everything, media included, from your old phone to a new one: first link the new phone (on it choose I already use Spojiti → Link to my other device, and scan its code from the old phone’s Settings → Account → Linked devices). Then Settings → Back-Up & Storage → Send my chats to my new phone on the old one, or Get my chats from my old phone on the new one, and accept the card on the other. The history travels phone to phone, sealed with your recovery phrase, and nothing is kept on the relay. Keep Spojiti open on both until it finishes; the same Wi-Fi is fastest.

3.13 Syncing your devices

Settings → Back-Up & Storage → Sync my devices. Your two devices compare what they hold and send each other only what the other is missing: chats, their photos and files, and call recordings. A message you deleted, a chat you cleared, or one that disappeared on a device is not brought back to it, and notebooks, saved notes and view-once messages stay where they are. Pick a linked device and it shows an Accept / Reject card; or, with no server at all, tap Show a sync code on one device and scan it (or paste it, on Windows) on the other while both are on the same Wi-Fi or hotspot. Everything travels device to device, sealed with your recovery phrase; a code works once and only for a device of your identity. Keep Spojiti open on both until it finishes.

3.14 Linking another device

One identity on one device on Free and Basic, two with Pro or Plus, three with Max or Ultra: Settings → Account → Linked devices → Link a new device, then scan the QR the new device shows. Pairing copies your identity to the new device, sealed, over that QR handshake, so link only a device you own and are holding. Each device then keeps its own sessions and every message is sealed to each device separately; removing one from that same screen stops delivery to it immediately. History does not travel across the link by itself, we cannot read it to move it, but Settings → Back-Up & Storage → Send my chats to my new phone moves it phone to phone, sealed, and Sync my devices gives two devices you keep using each what the other is missing; new messages arrive on every linked device from the moment it joins.

3.15 If your phone is stolen

Report it at spojiti.world/support.html#lost with your Account ID and your lost-device code (Settings → Account → Lost-device code; write it down with your 12 words). From that moment it receives no more messages, and 48 hours later it erases itself: the wait is so that, if someone else made the report, you can cancel it from any of your devices with your Spojiti PIN. As soon as Spojiti on that device then hears of it (a phone that is online usually at once, even locked or with Spojiti not open; any other device the next time Spojiti is opened on it, before its PIN), it tries to back up your chats and their media, sealed so that only your 12 words with your Spojiti PIN open them, to the places your backups go (Spojiti.cloud when none is set), and then erases itself without showing anything, even if the backup failed; restore them on a new phone with your 12 words and your PIN. If you still have another device, report from it instead, on the same screen: that report acts at once (from a device on your account 72 hours or more), and the device you report from is left alone. It is free for everyone. Until then two layers stand between a thief and your chats: your phone’s own lock, and, if you turned it on, Spojiti’s App Lock, which closes the database and drops the key. The honest limit: a device that never comes online again cannot be reached by anyone.

3.16 If a device on your account is not yours

Every change to who can use your account is told to all your devices at once, with a card even when Spojiti is closed: a device added, a wrong Spojiti PIN, a PIN reset, a lost-device report. Settings → Account → Devices shows when each device joined and was last seen. If a device is not yours, tap Not me (on the alert, or on that device in the list): it erases itself and is blocked from your account for 30 days, every device is signed out, and you choose a new PIN, which your other devices then use to sign in. Backups from then on are sealed with a key the blocked device never saw. Not me works from a device that has been on your account 72 hours or more, so a device that just joined cannot turn it against you. If someone typed a wrong PIN, they have your 12 words: keep your PIN to yourself.

3.17 Wiping this device

Settings offers a full identity wipe: keys, chats, and identity are destroyed on-device, the relay forgets this device’s push address, and this device can no longer be woken. Wiping a device leaves your account on the relay so the 12 words can restore it; to be forgotten by the relay too, use Settings → Account → Delete my account everywhere. Keep the phrase only if you want the option to return; to remove the account from the relay as well, use Delete my account everywhere.

3.18 If you uninstall

Deleting the app is not deleting your account. Your identity lives in your 12 words (and any other way back you set up), your other linked devices keep working, and messages sent to you wait at the relay for five days and are then dropped. Uninstalling a phone app removes its chats from that phone, so restore from a backup or move them first. To leave for good, use Settings → Account → Delete my account everywhere before you uninstall: that removes the account from the relay and from every device.

3.19 Deleting your account

Two exits, both in Settings → Account. "Delete my identity on this device" erases this device completely, keys, messages, media, and your other devices keep working; the 12 words bring you back. "Delete my account everywhere" removes the account from the relay and every device, deletes a passkey recovery if you set one, then erases this device: nothing can restore it afterwards, not even the 12 words. We hold no phone number or email, and deleting removes the account, its keys, its devices, its Spojiti.cloud backups and its waiting messages; encrypted server snapshots age out within hours. Support tickets you filed stay on the board, marked with an account id that no longer exists.

3.20 Getting started

There is nothing to sign up for. On first launch Spojiti creates an identity on your phone: twelve recovery words, which are your account, and a :Handle, which is the name people see. Write the words on paper before you do anything else. Then add someone: Chats → + → Add :Handle, and scan their QR, paste their Account ID, or open the invite link they sent. That is the whole of it; there is no password, no email, no verification code, and nothing about you on our side to log in to.

3.21 Your Account ID and invite link

Your Account ID is a random identifier, not derived from you, that another person needs once to connect. Share it three ways: show your QR from Chats → + → Add :Handle and let them scan it; send an invite link through any app (it carries your id, your :Handle and a one-time pairing token, nothing else); or copy the id itself and paste it to them. Pairing is automatic in both directions, so once one side adds the other, you are both connected. The id says nothing about who you are, and it is not searchable anywhere.

3.22 QR codes

The QR does three jobs. Adding a person: Chats → + → Add :Handle → Scan a code, point at their screen, done, in both directions. Moving to a new phone or linking a Mac: Settings → Account → Linked devices → Link a new device shows a code on the new device that you scan from your current one, and your identity travels across sealed. The camera needs permission the first time; if it is dark, Torch is on the scanner. Your recovery words are never put in a QR that someone else could scan.

3.23 Adding someone

Chats → the + button → Add :Handle. Then either scan their QR face to face, paste the Account ID or invite link they sent you, or use People I know, which finds contacts who have opted in to being findable by people who hold their number; the matching happens on your phone and your address book is never uploaded. Tap + Spojiti to say hello: it reaches them only if your number is in their address book too, and their answer opens the chat. Nobody can add you by searching for a name or a :Handle, because there is no directory of them.

3.24 How people find you

Nobody can look you up by name: there is no directory of Spojiti users to search, which is why strangers have almost nothing to aim at. People reach you three ways, all your choice: you show your QR code face to face; you send an invite link or your Account ID through any app (Chats → + → Add :Handle); or, if you turn on People who have my number can find me, someone whose number is in your address book and who has yours can say hello from People I know, and arrives as a message request. Pairing works both ways, so once one of you adds the other you are connected.

3.25 Your name

Spojiti has no name field, because a name is exactly the kind of thing we refuse to hold. What people see is your :Handle, which you choose and can change in Settings → Account → Your :Handle, plus an optional Aham (status line) under it. Contacts may also give you a private label that only they can see. Nothing you set is searchable, and none of it reaches our relay in a readable form, except your :Handle inside an invite link someone opens in a browser.

3.26 Passwords and two-factor

There is no password and no two-factor code, because there is no account on a server to guard. Your identity lives on your device and is protected two ways: the twelve recovery words, which recreate it anywhere and must be kept on paper, and App Lock, which locks the app itself behind your own Spojiti PIN or your face or fingerprint. Anyone with your words is you, and so is anyone holding another way back you set up (ask me about ways back).

3.27 More than one account

A phone carries one identity on Free and Basic, two with Pro or Plus, three with Max or Ultra, each with its own recovery phrase, its own chats and its own encrypted database; they do not know about each other. The route is Settings → Account → Log out, which leaves this account's chats where they are, sealed, and drops you to the account chooser: Add account starts a fresh identity, and tapping any :Handle switches to it. Signing back in is your phone's biometrics, the twelve words, or that account's own recovery code. This is the opposite of a LINKED DEVICE, which puts the same identity on a second phone or a Mac.

4 · Privacy, honestly

What is protected, what is not, and what happens in the bad cases, in the same words the app itself uses.

4.1 End-to-end encryption

Every message is end-to-end encrypted with the same open, peer-reviewed designs that secure the world’s best messengers, the Double Ratchet, upgraded with post-quantum key agreement (ML-KEM-1024), a post-quantum ratchet inside every chat between people (ML-KEM-768) and post-quantum signatures (ML-DSA-65) on the prekeys each account publishes; only the official :Spojiti_Beta channel is still classical. Keys live only on your devices. We run the relay and still cannot read your messages, it only moves sealed envelopes and deletes them on delivery.

4.2 What Spojiti can actually see

Honestly, this much: random account ids with nothing attached, and which one an envelope is for (never who sent it, except on messages to and from the official :Spojiti_Beta account); sealed envelopes waiting for someone offline, deleted the moment they are delivered; which packs a request holds, proven by blind tokens that cannot be linked to a purchase; the network address any server sees while you are connected; when your devices connect, the push handles that wake them and the device names you type; and, only if you turned on People who have my number can find me, a blinded fingerprint of that number we cannot read back. Never your messages, media, calls, contacts, groups or number in any readable form, and your :Handle only inside an invite link someone opens in a browser. The Security page at spojiti.world draws every box we run and labels what each can and cannot see.

4.3 How the encryption works

Under every chat runs a double ratchet: the encryption key changes with every single message, derived forward in a way that cannot be run backwards. Steal today’s key and yesterday’s messages stay sealed, that is forward secrecy. On top rides post-quantum key agreement (ML-KEM-1024) and a post-quantum ratchet (ML-KEM-768) that renews the quantum protection every turn. Open, peer-reviewed designs, the same family that secures the best messengers on earth, implemented by our own engineers from the published specifications.

4.4 Quantum computers

The realistic quantum threat is “harvest now, decrypt later”, recording sealed traffic today to open it when quantum machines mature. Spojiti mixes ML-KEM-1024 post-quantum key agreement into every chat between people (the official :Spojiti_Beta channel is still classical) and a fresh ML-KEM-768 secret into every turn of it, and signs the prekeys each account publishes with ML-DSA-65 as well as Ed25519, so what is recorded today stays sealed in that future too, and nobody with a quantum computer can forge those prekeys. Calls between two current apps are covered the same way: every frame of sound and picture is sealed again under a key made for that one call, which travels inside the post-quantum chat, and the call screen says post-quantum when it is. We built for the attacker of 2035, not just the one of today.

4.5 Post-quantum protection

Spojiti is post-quantum end to end: key agreement with ML-KEM-1024 hybridised with classical X25519, a post-quantum ratchet that folds a fresh ML-KEM-768 secret into every turn of the conversation, and ML-DSA-65 signatures beside Ed25519 on the prekeys each account publishes, so a future quantum computer can neither open recorded traffic nor forge those prekeys. It only activates on devices where the official NIST test vectors (FIPS 203 and 204) pass at runtime, verified strength, never assumed. The one exception is the official :Spojiti_Beta channel, which is still classical.

4.6 Checking it yourself

Three checks you can run yourself. Settings → Security → Post-quantum protection shows the self-test your phone ran at launch against NIST’s own published test vectors, and the algorithms in use; on a device where that test does not pass, post-quantum stays off rather than pretending. A contact’s safety number, compared in person or by voice, proves nobody sits between you. And the Spojiti Private Messenger Core, the app and relay code that prove the zero-PII design, is published under the AGPL v3 at github.com/Spojiti. Settings → About Spojiti also shows the exact commit your build came from.

4.7 Zero-PII, explained

Zero-knowledge of what you say is literal here: the relay stores sealed envelopes it cannot open, delivers them, and deletes them. Your avatar travels sealed. Calls go device to device, or through our TURN server, which holds no key, when a network blocks that; the relay carries only the sealed setup and a ring-or-message wake, never the call. Your packs are validated through blind signatures, so payment cannot be linked to your account. We did not promise not to look; we built it so looking finds no messages, names or contacts, only the routing a relay needs.

4.8 What about metadata?

Honest answer, because you deserve the real one: a relay that moves envelopes must know which account an envelope is FOR, or it could not deliver it. It does not know who it is FROM: every envelope except those to and from the official :Spojiti_Beta account leaves through an anonymous connection, wrapped once more to the recipient’s keys (sealed sender), so the relay never holds a sender, recipient pair. What it never knows either: your name, number, message content, or preview text, accounts are random ids with no identity attached, envelopes are deleted once your devices collect them, nothing is archived. A photo or file is fetched the same way: the right to download it rides inside the sealed message, so the relay does not learn who opened it. What it does see: your network address (until the private route ships), which account each envelope is for, its size and time, when your devices connect, the push handles that wake them, and how many cross-network call setups and number lookups an account makes, never what you say.

4.9 What the relay is

The relay is a deliberately blind post office: it routes sealed envelopes between opaque account ids, deletes them on delivery, and holds no message history, no names, no phone numbers (at most a blinded fingerprint, for someone who chose to be findable), no social graph it can read. We designed it so that even a subpoena finds nothing to read.

4.10 Why notifications arrive blank

A card that just says “New message” (or “Something new is waiting”) is the sealed-envelope notification: the push that woke your phone carried zero content, by doctrine, forever, and the envelope shows when your device could not (or was told not to) render a preview locally: previews toggled off, a view-once message (never previewed, by design), or the preview not being available for that particular envelope. Blank is not broken; blank is the promise being kept.

4.11 Push notifications and privacy

Push must transit Apple’s and Google’s infrastructure, that is how phones wake. So Spojiti tells them as little as a wake allows: the push says only that a message or a call is waiting. No sender and no text; a call's push carries only a random per-call tag. Names, faces, and message text are added by YOUR device after local decryption. Apple and Google learn only that your phone received a push and whether it was a message or a call, never what it said or who it was from.

4.12 If the relay were hacked

Assume the worst. If someone images our server they get ciphertext, random account ids, public keys and device push tokens. They also get the routing records a relay needs, device records and connection times. Backups are not on the relay at all: they are where you chose to keep them, sealed with your recovery phrase. For people who turned on being findable by number, the signing key on the server would let an attacker test phone numbers against their fingerprints. No names, no message text, your history lives on your phones, and in sealed backups only where you chose to keep them. That is the difference between promising security and being architecturally unable to lose what was never collected.

4.13 If the relay goes down

Your history lives on your devices, not our servers, an outage never touches it. Messages sent during one queue on the sender and re-drive automatically; the transport self-heals with backoff and fallback routes. And because your identity is your phrase, not an account we host, even the company vanishing could not delete who you are.

4.14 If a court demands your data

If a lawful order arrives, we comply with what we hold, and it is little: no message content, no name, number or contact list, no history. What exists is random account ids, public keys, device push tokens, last-connection times and the other records our privacy policy lists, such as Spojiti.cloud backups if you keep them there, sealed under a random name we cannot link to you or open. We cannot decrypt you. That is not defiance; it is arithmetic.

4.15 Could there be a backdoor?

There is no backdoor: keys are generated and held on your devices, the ratchet changes them every message, and the relay moves only sealed bytes. Trust still rests in two places: the keys our relay hands out, which comparing safety numbers checks, and the updates we ship. A backdoor would require redesigning the entire system into something we deliberately refused to build.

4.16 Is AI reading my messages?

No AI reads your messages, not for features, not for training, not for “safety scanning”. The relay cannot read them, so it cannot feed them to anything. There is no exception, and there used to be one: a question this assistant could not answer was passed to a server-side assistant that could consult a model. That path was removed, every answer you get from me now comes from a fixed list written by Spojiti’s CTO and stored on your device; a correction to its wording, approved by a person, can arrive from our servers. Your words train nothing and inform no one.

4.17 Where are the servers?

We run our own multi-homed infrastructure, servers we rent and run ourselves, deliberately not a hyperscaler’s data lake, and we do not name locations. The honest security answer is that server location barely matters when the server cannot read anything: your protection is mathematics on your device, not geography.

4.18 Why trust any of this?

Do not trust us, that is the design principle. Trust the architecture: open, peer-reviewed cryptographic designs; keys that never leave your devices; a relay that deletes what it delivers; diagnostics you can read yourself with no content in them; and honest answers even where they cost us (ask me about metadata). Every claim is checkable in the app’s own behavior, put this chat in airplane mode and I still answer, because I live on your device.

4.19 Nothing to hide?

Curtains, envelopes and closed doors are not for people with something to hide either. Doctors discussing a diagnosis, lawyers with clients, journalists with sources, families, friends being silly together: private conversation is ordinary and human. The people best served by Spojiti are the vulnerable, not the villains, who already have their tools. And a service that cannot read anyone protects everyone equally, including from a breach or a bad day at the company running it.

4.20 What data exists about you

We never ask for your name, email or phone number; what our servers do handle, network addresses, push handles, device labels you type, is listed on our Security page. No email or name exists on our side, and no phone number: if you choose to be findable, the relay keeps only a blinded fingerprint of it, and People I know reads your contact book on your phone and never uploads it. The relay sees opaque account ids and sealed envelopes, deletes messages on delivery, and keeps no message logs. Diagnostics stay on YOUR device and never contain message content.

4.21 Being findable by your number

Only if you turn it on: Settings → Privacy → People who have my number can find me. On Android, Spojiti takes the number from the phone’s SIM cards (one or both); an iPhone does not let any app read its SIM, so there you type your number. Either way it is blinded on the phone, and our server signs the blinded value without learning what it is. We keep only the resulting fingerprint beside your account id, so only someone who already has your number can use it. Even then their hello reaches you only if their number is in your address book too, and it lands in your message requests, never straight in your chats; someone who has your number but is not in your address book cannot reach you this way. Looking people up happens on their phone, so we never learn who searched for whom. The honest limit: someone inside Spojiti holding the signing key could test any number they like, without limit; everyone else is held to a daily budget. Turning it off deletes the fingerprint the same minute, for everyone.

4.22 Lock-screen previews

On iPhone and Android, Spojiti can show the sender and message text on your lock screen, even while the app is closed, decrypted ON your device (by a tiny extension on iPhone, by Spojiti’s own notification code on Android), from a preview sealed with a key only your contacts’ devices share with yours. Apple’s and Google’s pushes carry no content, ever; the words appear because your phone opened them locally. On by default, yours to turn off: Settings → Notifications → Rich lock-screen previews. Trade stated plainly: previews use one stable key per contact rather than the ratchet’s per-message keys, message bodies always keep the full ratchet.

4.23 Censorship and blocking

Spojiti is built to stay reachable: connection racing and DNS-resilient fallback routes are part of the transport, free for everyone, a censored user is exactly the user this app exists for. We do NOT yet disguise our traffic from deep packet inspection, so a network actively blocking Spojiti by signature can still succeed. If you cannot connect, a system VPN on top is fully compatible and is the right tool today.

4.24 Is Spojiti down, or blocked?

When the app cannot reach the relay it checks, honestly, which of three things is true: your device is offline, our relay is down, or your network can reach the internet but not Spojiti, in which case the banner says a block MAY be in the way. “May” is deliberate: a phone cannot tell a national firewall from a broken hotel router, and we would rather admit the limit of our knowledge than guess at your network.

4.25 Stopping spam without knowing anyone

Three ways, none of which needs your identity. Creating an account costs the phone a few seconds of computation, trivial for a person and expensive for a bot farm. There is no directory, so nobody can reach you without your QR, link, Account ID or, if you made it findable, your number, and anyone not in your contacts lands in Requests, content-free and never marked read. And the tools run on your own phone: block (fully, or just messages, audio or video calls), report, which blocks them and, if you choose, sends us their last few messages to you with proof they sent them, and the guard that blurs likely-abusive text before you see it.

4.26 Message franking

Every message carries a sealed commitment to its exact bytes, and your device checks it when the message arrives. The sender’s app also binds that commitment to you, under a key only Spojiti’s report key can check. So when you report someone and send us their messages, the whole chat or the ones you selected, we can verify they really sent exactly those words to you, in a chat or a group; nobody else can check it at all, and we see nothing you did not send us. A message of theirs without that proof (one received before build 396 and older than their last five) comes marked as unverified.

4.27 The bot gate

Because we ask for no phone number or email, we needed another way to stop bots minting thousands of accounts. So creating an identity costs a few seconds of computation on your phone, a proof of work that a person never notices and a bot farm cannot afford at scale. No captcha, no tracking, no puzzle to solve; the phone does the work, and the relay only checks the proof.

4.28 Permissions

Spojiti asks for a permission only at the moment a feature needs it: the camera to scan a QR or take a picture, the microphone for voice notes and calls, location only when you choose to share yours, notifications to ring. Contacts are read only if you turn on People I know or Show Spojiti in my phone’s contacts, and even then the matching happens on your phone and nothing is uploaded. Deny any of them and the rest of the app keeps working.

4.29 Age

We do not know your age and we cannot verify it, because verifying it would mean collecting exactly the personal information we refuse to hold. The Terms & EULA in Settings → About Spojiti states the minimum age for using Spojiti where you live, and the responsibility sits with the person installing it and the adults around them; a parent’s judgement matters more here than any checkbox.

5 · Messaging

Everything that happens inside a chat.

5.1 Photos, videos and files

Photos, videos, documents and camera shots send from the row of icons under the message box, Camera, Media, GIF, Stickers, Docs, Location and :Handle (plus Poll in a group), multi-select, with captions, and a single video opens the trim screen first, all sealed end-to-end, stored encrypted on your device, and organised in the Data tab. On a Mac or a Windows PC you can also drag files from Finder, Explorer, Mail or a browser onto an open chat. A large video starts playing while it is still arriving. Sending media is on for everyone; the cap is the size of one file, sent or received: 20 MB on Free, 50 MB with Basic, 100 MB with Pro, 250 MB with Plus, 500 MB with Max and 1 GB with Ultra. A file someone sends that is over your limit shows as a locked card naming the pack that opens it, and is never downloaded for you. GIFs, stickers and voice notes are free for everyone too.

5.2 Albums

Pick several photos and videos at once from Media and they travel as one album, in the order you chose, each item sealed under its own key. An album carries up to 10, for everyone; pick more and they simply go as several albums, never refused. Each item still fits the largest single send the relay allows.

5.3 Photo quality and mobile data

Two switches in Settings → Experience. Send photos at full quality is on by default: photos go at full quality up to your limit (2048 px on the long edge, for everyone); switched off, they are resized and re-compressed before they are sealed, for smaller sends and downloads. Download media on mobile data is off by default: photos, videos and files wait for Wi-Fi until you tap one, while voice notes always arrive. Every video you pick opens a review screen first, with a trim on phones and Macs.

5.4 Voice notes

Hold the microphone in any chat to record a voice note, free for everyone, sealed like everything else, played inline. Voice notes are recorded for speech, about a quarter of a megabyte a minute, so they cost little on mobile data.

5.5 Stickers and GIFs

Stickers ship inside the app (nothing fetched from a store) and GIFs come from your own gallery through the GIF icon under the message box, so no GIF catalogue sees what you pick, both free for everyone, because expression is never paywalled here.

5.6 Adding sticker packs

Sticker packs are single files (.spjpack) you can get anywhere, our website, a friend, because the trust is a cryptographic signature, not the download source. Your app verifies every pack against Spojiti’s own signing key before a single byte is kept; a tampered or third-party pack is refused with a plain explanation. Import one from the sticker sheet’s + button. No store and nobody watching what you pick: the list of packs simply comes from our website.

5.7 The in-chat camera

The Camera icon under the message box opens Spojiti’s own camera: tap for a photo, hold for video (up to a minute, for everyone), captured inside Spojiti and sealed straight into the chat. It is on for everyone.

5.8 Sharing into Spojiti

Spojiti is in your phone’s share sheet: in any app tap Share → Spojiti (on a Mac, Send with Spojiti) to send text, a link, photos, videos or files. Spojiti opens on Send to…, you pick the chat, and it lands there sealed like anything sent from inside the app. This works on Android, iPhone and Mac.

5.9 Disappearing messages

Disappearing messages: open a chat, tap the :Handle at the top, then Disappearing messages, and pick a window (in a group it is in the ⋮ menu). New messages in that chat are deleted by Spojiti on every device when the timer lapses (a device that is off does it the next time it runs). You can also set a timer per message from the composer, and View-once media disappears after a single viewing.

5.10 View-once

View-once: when attaching, choose view-once and the recipient can open it a single time, no re-open, no save, and it is excluded from search, exports and the Data hub (an iPhone can still take a screenshot while it is open). View-once is a privacy control, so it is on for everyone, sending and receiving, with no cap.

5.11 Editing a message

Swipe your own text message from right to left, or tap the chevron on it (right-click on a computer) → Edit, to fix a sent message, the edit travels encrypted to every device and the bubble is marked edited. Honesty rule: the fact that a message changed is never hidden from the reader. Timing: until the other person has seen the message, your edit always reaches their copy; once they have seen it, their Delete & Edit switch for you decides, and if it is off, Spojiti says so before you edit: their copy keeps what you first sent.

5.12 Deleting a message

Tap the chevron on a message (right-click on a computer) → Delete for me, and on a message you sent, Delete to Peer or Delete to Both. Long-press selects several to delete for you at once. Swiping a message you received from right to left deletes it for you (a swipe always asks first). A delete-for-everyone vanishes from Spojiti on both sides without a trace, for everyone, leaving no marker is a privacy control, and privacy is never paywalled. No app can take back a screenshot or a notification already shown. Timing: until the other person has seen the message, Delete to Peer and Delete to Both always remove it from their copy; once they have seen it, their Delete & Edit switch for you decides, and if it is off, their copy stays as you sent it, and Spojiti says so before you delete.

5.13 Undo a delete

“Delete for me” gives you a few seconds to undo, the message leaves the screen at once but nothing is destroyed until the window closes. Deletes that reach the other person’s device (“to Peer”, “to Both”) cannot be undone, and say so before you confirm unless you chose Don’t ask me again.

5.14 Reactions

Tap the chevron on any message (right-click on a computer), or use the inline icons, to react, the quick row shows favourites and the + opens the full emoji picker. The same row, + included, reacts to a :Handle’s profile photo when you open it full-screen. In groups everyone’s reactions show side by side. Reactions travel encrypted like everything else.

5.15 Replying and forwarding

Swipe RIGHT on any bubble to reply with a quote, answer with text, a voice note, a photo, a video, a file, a sticker, a location or a contact, and the quoted message rides inside your reply. Its chevron menu (right-click on a computer) forwards, shares or copies it, and a long-press selects several to forward, share or copy at once, unless the sender protected their content, in which case saving, copying and forwarding are disabled exactly as they asked. Double-tapping a message forwards it by default, or copies it, shares it, or does nothing: your pick in Settings → Experience.

5.16 Forwarding to many

When you forward, pick several :Handles, or Select all, and one forward goes to each of them, sealed end to end for each chat separately: it is never a group, and nobody sees who else got it. One forward reaches up to 5 chats at once for everyone, a brake on mass forwarding. A message that has already been forwarded along a chain of five or more says Forwarded many times, and goes to one chat at a time from there; the count travels inside the seal, kept by Spojiti’s own app. Forwarding always honours the sender’s locks: a protected or view-once message cannot be forwarded at all.

5.17 Quick actions

Every message on a phone carries a small chevron at its top corner: tap it for the full action menu (on a computer, right-click the message). Long-press a message to select it, then tap others to forward, share, copy or delete them together. Every item in that menu has its own switch in Settings → Experience → Message menu, all on until you turn one off, and Share works for every kind of message. You can also choose which of react / reply / forward ride beside messages as inline icons, Settings → Experience → Quick actions. Free for everyone.

5.18 Mentions

Type a colon to mention someone: “:” and the start of their name brings up matching :Handles to pick from. In a group, “::” mentions everyone. Mentions travel inside the sealed message like every other word, so nobody outside the chat learns who you mentioned.

5.19 Typing indicators

You see typing dots when a contact is composing, and they see yours, carried inside the sealed channel, invisible to the relay like everything else.

5.20 Pinning and archiving

Pin a message from its chevron menu → Pin, pins are yours alone, stored only on your device; the other person never knows. To keep a chat handy, Star it (long-press) and open the Stars view. Swipe on the chat list to archive; archived chats slide back the moment they speak.

5.21 Stars, filters and the chat list

Long-press a chat on the Chats tab for Mark as read, Star, Edit name, Circle, Mute, Archive, Shared media, Export chat, Block and Delete chat. The view icon at the top of Chats filters the list: All, Unread, Groups, Stars, Focus and Circles (choose Circles, then a circle in the row that appears). When anything is unread, a Mark all read button appears in the header. Stars, like pins and circles, live only on this device; Free keeps up to 20 starred chats (Everything unlimited).

5.22 Search

Search from the home screen covers contact names first and message content below, and each chat’s ⋮ menu has an in-chat search, all of it running over your encrypted local database, never on a server.

5.23 Jumping to a date

In a chat, ⋮ → Scroll To picks a day and takes you straight there; while you scroll, a floating badge shows the date you are at, and a button jumps back to the newest message. To find words rather than a date, ⋮ → Search chat looks through that chat’s history on this device.

5.24 Saved messages

Tap the chevron on a message (right-click on a computer) and choose Focus to keep it, in a Focus you already have, or a new one made on the spot. Your :Saved chat and every Focus live only on this device, never on any server, and you can type straight into :Saved as a private notepad. Keeping a copy honours the sender’s sharing locks, and view-once messages can never be saved, viewing is spending. Saved messages are for everyone.

5.25 Labels

Tap the chevron on a message (right-click on a computer) → Label to tag it with a word such as “invoice” or “trip”; the label shows under the bubble. A label is local and silent like a star: it lives on this device, never travels, and nobody else ever sees it. View-once messages cannot be labelled. Up to 10 different labels, for everyone.

5.26 Pings

A Ping is a reminder on a message. Tap the chevron on any message (right-click on a computer) → Ping, give it a name, an action and a time, and your phone rings it then; the Ping leads straight back to the message. Every Ping is in the Data tab → Pings, soonest first. Pings live on this device only, and Free keeps up to 10 waiting at once (Everything unlimited).

5.27 Sending later

Long-press the send button to schedule a message. It sends from THIS phone when the app is next running at or after the time you chose, the relay never holds a message for later, because it would have to hold it readable, and it never can. Pending messages show above the composer, where you can cancel them.

5.28 Polls

Polls live in groups: the Poll icon under the message box → an optional name, a question and its options (up to 4 options and 5 polls a day, for everyone). Turn on Anonymous votes when you create it and nobody, not even you, can see who chose what; like a paper ballot box, it trusts each member to vote once. Votes are encrypted like everything else and tallied on the devices, the relay never learns what anyone chose. Tap your own choice again to retract it.

5.29 Sharing a contact

The :Handle icon under the message box shares a contact card carrying their id and the name they chose for THEMSELVES, never your private nickname for them. Receiving a card does nothing until tapped, and connecting still goes through the normal request flow.

5.30 Sharing your location

The Location icon under the message box sends one pin, or shares LIVE for a while: while Spojiti is running your position updates inside the sealed chat, and the share ends at the deadline or when you tap Stop. A pin is free without limit; a live share is once a week on Free and Basic and unlimited with Pro and above. Coordinates travel only inside the encryption and Spojiti draws no map of its own; tapping a location opens Google Maps at those coordinates.

5.31 Links in messages

Links are tappable and open in your system browser. Your phone NEVER fetches a link because a message arrived, that is how other messengers hand the link’s owner your IP address and exact read-time, and we don’t. A link card, if you see one, was built by the SENDER on their own phone before sending (Settings → Privacy → Link previews I send, on by default; switch it off there) and travels sealed inside the message like a photo. The card always shows the link’s real site name, taken from the link itself.

5.32 Sending while offline

No signal? Type anyway. Messages queue on your device under a clock and go out by themselves when the connection returns, and anything the other side has not confirmed is re-sent automatically within the relay’s window. Once the envelope is handed to the relay the clock becomes a courier bike, and the parcel and opened letter appear only on real receipts from their device.

5.33 A message that will not send

A message on the courier bike (what people call one tick) has been handed to the relay and the other side has not yet confirmed receiving it; Spojiti keeps re-sending it until they do, within the relay’s window (five days, for everyone). A plain clock means it has not left YOUR phone: the app shows that you are offline and reconnects on its own, airplane mode off, the backlog drains itself.

5.34 How long the relay waits

If the other person stays offline, the relay holds your sealed message for five days, for everyone: the relay is never told which packs the sender holds. If the window closes before their phone comes back, the relay drops it unread and your message shows a clock struck through, meaning not delivered, so nothing pretends to be on its way. Send it again once they are back. The relay never keeps a message longer, because a store of old messages is a store we would rather not have; the encrypted files messages point to are deleted about six days after upload.

5.35 Message info

Tap the chevron on a message (right-click on a computer) → Message info for its exact times: sent, delivered and read for yours, received and seen for theirs. On your own messages in a group it lists who has read it so far. The times come from the same honest receipts as the status icons and are kept on your device.

5.36 Sending a message

Open a chat, type, and send; the row of icons under the box attaches photos and videos, documents, the camera, GIFs, stickers, your location, a :Handle or (in a group) a poll, and holding the microphone records a voice note. Every message is sealed to the other person’s devices before it leaves yours. The small picture beside it tells its journey: a clock until it leaves your phone, a courier bike once the relay has it, a parcel when it reaches their device, an opened letter once it was on their screen. A message that stays on the bike is waiting for them to come online; if you are the one offline it queues and goes by itself the moment there is a connection. Only if they stay offline past the relay’s five-day window is it not delivered, and the app says so.

5.37 Copying a message

Tap the chevron on a message (right-click on a computer) and choose Copy; it goes to your clipboard like any text. If the sender turned on Disable Screen Shot, copying, forwarding and saving of their messages are disabled on your side, and the app says so instead of silently failing. View-once messages can never be copied.

5.38 Clearing or deleting a chat

From their contact page (tap the name at the top of the chat; in a group, the ⋮ menu): Clear chat empties the conversation on this device and keeps the contact; Delete chat removes the whole chat from this device. Both act on your copy only, because the other person’s copy is theirs; to remove a message you sent from their side too, tap its chevron and choose Delete to Both. Nothing readable is on our relay to clear: it holds sealed copies only until they are delivered or expire.

5.39 Muting a chat

Open the chat, ⋮ → Mute notifications; the chat keeps receiving, it just stops ringing your phone, and the same menu unmutes it. Settings → Notifications sets when banners appear and what a notification may reveal for everything at once, and Calm mode quietens the whole app when you want a break.

6 · Profile and people

What others see of you, and how people reach you.

6.1 Your profile picture

Set your photo in Settings, for anyone. It travels sealed to your contacts like a message; our relay holds the encrypted file for a few days and can never see it. Tap any avatar to view it full-screen.

6.2 Who viewed your picture

When a contact opens your profile picture full-screen, your app is told over the encrypted channel, never the relay. Your picture’s sheet shows who looked and when, for anyone. A contact you are connected with can react to or reply to your profile picture from your one-to-one chat; it arrives as a normal sealed message quoting “Profile photo”.

6.3 Your status line

Settings → Account → Aham lets you write one line your contacts see on your contact page. It travels inside the same end-to-end encrypted envelope as your profile picture, so the relay never sees it, an Aham is yours and your contacts’ business, nobody else’s.

6.4 A contact's page

Tap the name at the top of a chat to open its contact page: their picture large, their Aham, buttons for Audio, Video, Request and Search, and every setting for that chat as a row, ringtone, online and last seen, screenshot protection, star, circle, block and report among them. For a group the same tap opens the group’s info.

6.5 Circles

Circles group your :Handles and groups, Family, Work, whatever you like, and live on this device, where nobody else ever sees them. Add a chat to one from its ⋮ menu, its contact page, or a long-press on the Chat tab ("New circle" there creates it and puts the chat in). To see just one circle, tap the view icon at the top of the Chat tab, choose Circles and tap its name in the row that appears, the list shows only those chats. The circle icon at the end of that row opens Manage circles, to rename, delete, or add and remove :Handles. A circle changes none of a chat’s settings, and circles never travel on their own: they leave this device only inside your sealed backup or a phone-to-phone transfer.

6.6 Inviting someone

Connect by QR code face-to-face, or send an invite link through any app you like, the link carries your id, your :Handle and a one-time pairing token, never a phone number. There is no directory to search and no contact-book upload, ever: you meet people here the way you meet them in life.

6.7 Message requests

Messages from people not in your contacts arrive as REQUESTS, held apart, content-free notifications, nothing marked read. Accept by replying, or ignore and they never know. Sharing someone’s contact card never grants access; it only lets the receiver ASK.

6.8 Blocking

Block from their contact page or a long-press on the chat list, a blocked contact cannot reach you and is never told they were blocked. The complete block is free forever, and so is selective blocking, just messages, just audio calls, or just video calls, because blocking is a safety control and safety is never paywalled.

6.9 Reporting abuse

Report a :Handle from their contact page (tap their name at the top of the chat), or a member of a group from the group’s member list (tap the group’s name, then the member): they are blocked at once, without being told, and you choose whether the report reaches us. From their contact page the whole chat goes (in a group, only that member’s messages); to send particular messages, yours or theirs, select them in the chat and tap Report. The newest 2,000 messages at most go, and only their words: a photo, video or file is named, never sent. Their messages carry cryptographic proof that they sent them, which we check; yours, and any of theirs without that proof, come marked as unverified. Switched off, the report stays on your device. A report we receive is kept in a separate reports store on Spojiti.cloud, in your region, not on the relay, and is deleted 90 days after it was filed. What also runs, free and only on your phone: Warn me about abusive messages blurs a likely-abusive incoming message until you choose to see it, and Think-twice before sending nudges you before something that may hurt goes out, a message, a caption, an edit or a public post (both in Settings → Security). Your messages are never scanned on our servers.

6.10 Verifying a contact

Verify a contact by comparing safety numbers from their profile, the green check means the keys match what you confirmed. This official :Spojiti_Beta chat is verified differently: our public key ships inside the app itself, so nobody can impersonate this channel, and no one else is allowed to wear the Spojiti name.

6.11 Online and last seen

Presence is a privacy control, so it is yours for everyone: switch online status and last seen off for everyone in Settings → Privacy, or per :Handle on their contact page (tap their name at the top of the chat) → Online & last seen. It works both ways, whatever you hide from someone, you stop seeing of theirs, and everyone sees what their contacts chose to share with them. Read receipts stay free and honest for everyone.

6.12 Read receipts

Each message you send wears a small picture of its journey: a clock means it has not left your phone yet, a courier on a bike means it was handed to the relay, a parcel means it reached their device, and an opened letter means it was actually on their screen while they were there. A clock struck through means the relay’s window closed before they came online, so it was not delivered. Spojiti never fabricates a receipt, if it says read, it was read.

6.13 Flashes

A Flash is a 24-hour post, text, photo, video or audio, sealed individually to each of your contacts; the relay sees only ciphertext. Posting one Flash a week and watching your contacts' Flashes are free; with Plus and above you post without limit and get Flash & Avatar complete: who viewed yours, and replying and reacting to Flashes and Avatars. A reply arrives as an ordinary sealed message in that chat, quoting what you replied to.

7 · Calls

Encrypted voice and video.

7.1 Voice and video calls

Calls are free for everyone and are end-to-end encrypted, going device to device, or through our TURN server, which holds no key, when a network blocks that, our relay only carries the sealed call setup, never the call itself. It can tell that a wake was a ring rather than a message, so a sleeping phone can ring, and it counts the cross-network call setups an account asks for. Group calls run as an encrypted mesh: up to 4 on audio and 4 on video, for everyone, capped where quality stays honest.

7.2 How private a call is

Audio and video are end-to-end encrypted (DTLS-SRTP). Call setup rides inside the sealed chat, and every frame of sound and picture is sealed a second time (AES-GCM) under a key made for that one call, which travels inside that chat: where the chat is post-quantum, so is the call, and the call screen says post-quantum. If either device cannot add that second seal (an older version), the call goes on under DTLS-SRTP alone and the screen does not say post-quantum. On strict networks the encrypted media is relayed by our TURN server, which holds no key. The relay sees that call signalling is in flight. The push path carries a coarse wake, ring or message, so a sleeping phone can ring; that trade is universal for calls on phones, and we would rather tell you. Calls are free for everyone.

7.3 During a call

During a call the controls are Mute, Camera, Audio, Record, Share, End, Notes, Transcribe and Summarize: a 3 × 3 card on a phone, one row on a computer, and the card folds away to a bubble. Audio switches between earpiece, speaker and Bluetooth and follows a headset when you plug it in. In an audio call, Camera asks the other side to move to video. You can leave the call screen and use the app while the call goes on; a pill brings it back.

7.4 Caller privacy

Caller-identity privacy is on for everyone, both ways: hide who YOU are from their ring screen when calling, or hide who is calling YOU on your own screen (Settings → Privacy). When an identity is hidden, per-contact ringtones fall back to the default tone, a distinctive ring will never leak who is calling through the speaker.

7.5 Ringtones

Settings → Notifications → Ringtone: pick from Spojiti’s tunes, your phone’s own ringtones or any track you have (on Android; a computer rings with the tunes or a track; an iPhone rings with Spojiti’s tune). Notification sound, under it, is any sound your phone has. A :Handle can have its own ringtone from their contact page (tap their name at the top of the chat), any of those sounds, for anyone and for as many :Handles as you like. A hidden caller always rings with the Settings ringtone, so the tune itself cannot identify anyone. My caller tune, on the same screen, is what your contacts hear while your phone rings for their call: the ringing tone, or one of Spojiti’s tunes. It reaches them sealed, beside your status line, and plays on their phone from the first second.

7.6 Noise cancellation

On-device noise cancellation (free for everyone, Settings → Experience) suppresses echo and background noise during calls, processed entirely on your phone, because sending audio anywhere for cleanup would be someone else hearing your call.

7.7 Call history

The Calls tab keeps your history, group calls included under the group's name, outcomes recorded honestly (missed, declined, duration) and stored only on your device. The relay keeps no call log: it remembers a ring for 75 seconds at most, only so a hang-up can stop it.

7.8 Call recording

Call recording is on for everyone; the only cap is how many a week (one on Free, Basic and Pro; unlimited with Plus and above). It always asks the other side first: tap Record during a call and they see “They want to record this call” with Accept, Accept, no sharing and Reject; nothing records until they accept, and both screens say “Recording, with their consent” the whole time. At your limit, the app only tells you which pack lifts it; nothing interrupts the call. The recording is mixed on your phone, sealed, and kept in Calls → Records on this device only, where you can play, share or delete it (a recording accepted with no sharing is marked Record only and has no Share, and neither does its transcript); it never touches our relay. Whether recording is lawful varies by place and by who consented, so Spojiti insists on consent everywhere, and you remain responsible for the law where you are.

7.9 Never being recorded

Spojiti never records you without asking: every recording waits for your Accept. Accept, no sharing lets them record but keeps the recording inside their Spojiti, which never shares it or its transcript. To never even be asked, turn on Settings → Privacy → Never allow call recording: every request to record you is declined automatically, and the caller is told at once that you do not allow it. A recording only ever exists on the recorder’s own device, never on our relay.

7.10 Screen share

Anyone can share their screen inside a call, one to one and in a group, and more than one person can share at once; once a week on Free, Basic and Pro, without limit from Plus (at your limit the app only tells you which pack lifts it; the call goes on). Start it from the in-call bar; on iPhone the system asks you to tap Start Broadcast first, and until you do the other side sees black, so the chip on your own screen tells you whether your share is actually live rather than leaving you to guess. The stream is end-to-end encrypted exactly like the call it rides in.

7.11 Transcripts and summaries

A call recording can be transcribed on your own device, and that transcript summarised, both entirely on the phone, so nothing is uploaded and no cloud service hears a word of it. Turn either on from the in-call bar before you stop recording, and the result is sealed beside the recording in Calls → Records: the recording’s ⋮ menu reads, copies, edits, shares, renames or deletes it, and opens the translation if you chose one. Deleting the recording deletes its transcript too. Because it runs on-device it is not instant on a long call, and it is only as good as the audio it heard.

7.12 When a call does not ring

Calls ring over the lock screen: through CallKit on iPhone and as a full-screen call card on Android, with Answer and Decline. If a call does not ring, open Settings → Notifications → Delivery health: it checks notification permission, background delivery, Android’s full-screen calls and Do Not Disturb, and each row taps straight to the setting that fixes it. By default you can answer on a locked phone straight away (Settings → Privacy → Answer calls without unlocking); switch it off to be asked for your unlock first. Declining never needs it.

7.13 When a call misbehaves

Calls go phone to phone over the internet, so they cost data, not minutes, and work on Wi-Fi or mobile data anywhere in the world. If one side sits behind a strict network, the call falls back to our TURN relay, which forwards the encrypted media without holding a key. Dropped or one-way audio nearly always means a weak or changing network on one side: move closer to the router, switch between Wi-Fi and data, and call again. If the phone keeps buzzing after a call ended, update to the latest build, that was a bug we fixed. Still stuck? Settings → About Spojiti → Diagnostics → Share and send it with a support ticket; it contains no content.

8 · Groups and Echoes

Sealed group chats, group calls, and Echoes, spaces defined by what is said.

8.1 Groups

Groups are end-to-end encrypted with per-member sealing, and the relay keeps no record of any group: a group message travels as a batch of separately sealed one-to-one copies. On Free and Basic you can create two groups of six; Pro and above lifts that to unlimited groups of up to 256, with co-admins. Create one from Chats → + → Create ::New group; the member picker has search built in.

8.2 How private a group is

Yes, and the relay keeps no record of any group. A group message is sealed separately for each member’s devices and travels as ordinary one-to-one traffic, with no group name, member list or photo attached. Because a group message goes out as one batch of sealed copies, the relay can see which accounts receive copies together, but nothing it stores names a group or who is in it. Adding, removing and promoting members must come from an admin, over that admin’s own sealed session, and every device checks them against the member list it already holds, so nobody who is not an admin can forge one, and once someone leaves, the group stops accepting their messages. Group calls connect members directly to each other.

8.3 Running a group

Tap the group’s name at the top of the chat for its info. Admins can rename it, set its photo and description, add or remove members, make or remove admins (with Pro and above, in groups you created), pin a message for everyone (3 pins per group), set a disappearing timer for the whole group, turn on Only admins create polls, or End group for everyone. Every one of those changes must come from an admin, over that admin’s own sealed session, and each member’s device checks it against the member list it already holds, so nobody who is not an admin can forge one. Anyone can Leave group at any time; if the last admin leaves, another member becomes admin, so a group is never orphaned. Someone an admin removes is told who removed them, and the group turns read-only for them.

8.4 Group limits

On Free and Basic you can create two groups of your own, each of up to six people, and only you are its admin; with Pro and above you create as many as you like, with up to 256 members, and can make other members admins. Joining groups others create is never limited. Group audio calls carry 4 people and group video 4, for everyone: the call caps exist because calls are a true peer-to-peer encrypted mesh, where every participant connects to every other and quality is protected by honest limits. The relay never carries the call itself.

8.5 Group calls

Open the group and tap the call button in its header: members ring, on the lock screen too, and anyone can join later from the banner in the group. Group calls are an encrypted mesh, every device connected directly to every other: up to 4 people on audio and 4 on video, for everyone, because a mesh past those sizes stops sounding good. Everyone on the call has a card, you first: a face, or the live picture when the camera is on. Screen share and consented recording work in group calls too; a group recording needs everyone to accept.

8.6 Echoes

Echoes are on the way: in this build the Echoes tab shows Coming Soon, and the service behind it opens in a coming release. What is being built: an Echo is a space defined by what is said, not by who is in it, named :::handle. You will ATTUNE to follow one (nobody is told), post a RESONANCE, reply with a REVERB, turn a post up with AMPLIFY (counted, never who) and FADE to stop, under a wave-mark that is yours there alone. A PRIVATE Echo opens only with the Acoustic Key its Conductor shares and is sealed to the people attuned; a PUBLIC Echo, found in Discover, will be readable by anyone including us, we say so, while nobody can see who is attuned and every read and post rides an anonymous token, never your account. A group admin will be able to attune a whole group.

9 · Protection on this device

The phone in your hand is part of the threat model.

9.1 Staying safe, the checklist

A short checklist, in order of what matters most. 1) Your twelve words ARE the account: keep them offline, never in a screenshot, never in a cloud note, anyone holding them is you. 2) Turn on App Lock, so a lost or borrowed phone cannot open your chats, and turn off message previews in Settings → Notifications if the lock screen should show nothing either. 3) Verify the safety number with the people who matter, in person or by voice, once. 4) If you might be forced to unlock, set the Quiet switch and decide what it shows, read its honest limits when you set it. 5) Leave requests from strangers unanswered; ignoring them tells them nothing. 6) On a shared or risky network, remember the relay never sees your words, but it does see that your device connected; calls go device to device when the network allows, which shows each side the other’s network address, and otherwise through our TURN server, which holds no key. 7) When a device is lost, revoke it from Settings → Account → Linked devices on any other device you hold. 8) Diagnostics exports carry no message content, they are safe to send us when something breaks.

9.2 App Lock

Your Spojiti PIN is six digits of your own, never your phone’s passcode, and it is one PIN for two things. It opens Spojiti when Require unlock is on (Settings → Security → App Lock), or Face ID / Touch ID / your fingerprint does; once a week Spojiti asks for the PIN instead, so you keep it. And it protects your account: a new phone asks for it with your 12 words, so the words alone can no longer take your account. Three wrong PINs lock it for 30 minutes, longer each time. Forgot it? On a device still signed in, tap "Forgot PIN?" on the lock screen: your face or fingerprint (or your 12 words) opens Spojiti and you choose a new PIN at once. On a new phone, tap "Forgot PIN?" and "Use my passkey" if you turned on passkey recovery: your face or fingerprint, then a new PIN at once, and nothing is lost. With neither, a 7-day reset starts that every device of yours can cancel; the phone asks for the new PIN by itself on the day, and backups made before the reset open again 30 days after it started. The message database itself is encrypted at rest (SQLCipher) regardless.

9.3 Quiet switch

If you are made to unlock this phone: Settings → Security → Quiet switch. You choose a tap pattern, what to tap and how many times, and mark which conversations may be seen under it. Tapping that pattern, on the lock screen (anywhere but the PIN keypad) or inside the app, switches to a separate, real session holding only those conversations, which stays offline while it is open; the same pattern brings you back after your usual unlock. Nothing is faked and nothing is destroyed; your real store stays sealed and is never opened, written to or timestamped while that session is active. Every copy of Spojiti carries two encrypted stores from first run, so having one proves nothing about you. The honest limits: it does not defend against someone who takes the phone and analyses it later with the right tools, or who knows this feature exists and demands the pattern; and if someone knows you talk to a particular person and that person is absent from what they see, this does not save you. App Lock (closes the database and drops the key) and revoking a device from Settings → Account → Linked devices are the other two tools. Never paywalled, for anyone, safety is not something we sell.

9.4 The abuse guard and Think-twice

Two guards in Settings → Security, both on by default and both computed only on your phone. Warn me about abusive messages blurs a likely-abusive incoming message until you choose to view it. Think-twice before sending gives a gentle check before a message, caption, edit or public post of yours that may come across as hurtful goes out; you can still send it. The check is a word list, so it misses sarcasm and new phrasing: a nudge, not a judge. Nothing is scanned on our servers, and neither the message nor the verdict leaves your device.

9.5 Protecting what you send

Disable Screen Shot (in the chat’s ⋮ menu or on their contact page) lets YOU decide what happens to what you send: block saving, copying and forwarding of your messages and media on the receiving side. Consent over your own content is free, it is a safety control, and safety is never paywalled.

9.6 Protecting one message, one chat, or all

Three levels. One message: tap the clock in the message box and choose Don’t allow saving, and the next message or media asks their app not to let it be saved, shared, forwarded or copied. One chat: ⋮ → Disable Screen Shot protects everything you send there. Every chat: Settings → Security → Screenshot protection covers every current and future one-to-one chat at once, with per-chat choices still yours. On Android, Windows and Mac the system keeps a protected chat out of screenshots and screen recordings; iPhone lets no app block a screenshot, so there it is detected and you are told.

9.7 Screenshots

Two separate things: as a SENDER you can protect your content, and on Android, Windows and Mac the recipient’s device blocks capture of it whatever packs they hold. Taking screenshots of your own chats is allowed for everyone. Honesty note: iOS does not let any app truly block screenshots, so where blocking is impossible we say so instead of pretending.

9.8 Hiding from the app switcher

Settings → Security → Hide in app switcher. On Android it blanks Spojiti’s preview in the recent-apps screen; on iPhone it blurs your chats there. It covers the preview only: on iPhone it cannot stop a screenshot, because iOS gives no app that power, and on Android screenshots of the open app still work unless a chat is protected.

9.9 Notifications

Notifications are under Settings → Notifications: choose All, only when the app is closed, or Off, and toggle message previews separately. Pushes that wake the app carry NO content and no sender: the words only ever exist decrypted on your device.

9.10 Delivery health

If messages or calls only arrive when you open Spojiti, open Settings → Notifications → Delivery health. It checks, on this device, everything that decides whether Spojiti can be reached while closed: notification permission, background delivery (battery optimisation and Autostart on Android, Background App Refresh on iPhone, Open at login on a Mac, the notification-area icon on Windows), full-screen calls and Do Not Disturb. Each row says what is wrong in plain words and taps straight to the setting that fixes it, and it checks again every time you come back.

9.11 Faces on notifications

Notification cards can show the sender’s photo in Spojiti’s scalloped frame, decrypted in memory on YOUR device from your own sealed store; the push itself still carries nothing. Prefer plainer cards? Settings → Notifications → Sender photo, off.

9.12 The notification centre

Spojiti keeps no notification history of its own: a dismissed banner is never a lost message, because the message is waiting in its chat.

9.13 Notifications on iPhone

On iPhone, check three things: iOS Settings → Notifications → Spojiti (allowed, banners on), Spojiti’s own Settings → Notifications policy, and Focus/Do-Not-Disturb. A freshly installed build needs one app open to register for pushes. If cards show without message text, that is the previews toggle, ask me about “rich previews”. Still stuck? Settings → About Spojiti → Diagnostics exports a content-free log that pinpoints it.

9.14 Notifications on Android

On Android the usual thief is battery optimization: exempt Spojiti (Settings → Apps → Spojiti → Battery → Unrestricted) so the system does not strangle the connection. Check the notification channel is enabled and no Focus mode is filtering. Spojiti’s transport self-heals aggressively, but no app can outrun a system that puts it to sleep.

10 · Backup, storage and updates

Keeping your history yours, and the app current.

10.1 Backing up

Settings → Back-Up & Storage → Back-up & Restore. A backup is your chats, and if you choose, their media (the switch: Messages only, or Messages & media), sealed on your device with your recovery phrase before it leaves, useless to anyone else. Tap Back up now, or set a weekly schedule: the day and the time you pick. You choose where backups go, one place or several: this device, a folder you pick, iCloud Drive on an iPhone, a synced iCloud Drive, Google Drive, OneDrive or Dropbox folder on a computer, your own server (SFTP, WebDAV, S3-compatible or FTPS), or email; and, with the Max pack (2 GB) or Ultra (5 GB), Spojiti.cloud, our encrypted backup store, which cannot open what it keeps, in your own region, Europe or India, wherever your account is, never a choice. The first backup to a place is whole; after that only what changed goes, and nothing goes when nothing changed. Each place keeps your newest backups and deletes the oldest only after a new one has arrived. Restore from any of them with your recovery phrase.

10.2 What an export contains

Chat export (free for everyone, your data is yours) writes your conversation out on-device, under your control, for your own keeping, the relay is never involved and never could be, since it holds no history to export. Your data was always yours; export just hands it to you in portable form.

10.3 Storage on this device

Settings → Back-Up & Storage → Storage on this device shows what Spojiti weighs here, the encrypted database, media, files, profile pictures, all measured as the sealed bytes the disk actually holds. Check integrity tests the database, Clear temporary files tidies up, and Compact rebuilds the database so space from deleted and expired messages returns to your device. Nothing about your chats changes.

10.4 Diagnostics

Settings → About Spojiti → Diagnostics can export a session log to help troubleshoot, it lives on your device, contains no message content and no PII, and is only ever shared if YOU choose to send it. Nothing is ever uploaded on its own. The same screen shows how much data Spojiti has sent and received since it started, counted on your device.

10.5 Updates

Updates are not optional. Every time Spojiti opens it checks for the next build, and when one is out it asks you to update before it carries on, your chats stay safe on your device while it does. The relay can also require a minimum app version, so a device missing a protection cannot quietly keep talking as if it had it. About in Settings shows your exact version and build.

10.6 The Data tab

The Data tab is everything you have received and sent, in one place: Media, Docs, Voice, Links and your Pings, searchable and filterable, all stored encrypted on this device (call recordings live in Calls → Records). Files reach our relay only as encrypted blobs, deleted a few days after upload (about six by default) whether or not they were opened. Deleting from Data frees the space here and here only.

10.7 Which version am I on?

Settings → About Spojiti shows the version and build you are running, and Check for updates tells you if a newer one exists. Spojiti also checks every time it opens, and when a newer build is out it asks you to install it before carrying on, there is no Later. The relay refuses a build older than the minimum we still consider safe, and the app says so plainly when that happens.

10.8 Battery

Spojiti is built to be quiet in the background: it keeps two connections to the relay while it runs, wakes only for content-free push notifications, and does no scanning or analytics behind your back; background work such as scheduled backups runs only if you turned it on. If battery use looks high, it is almost always a long call or a large media send; Android users can also check that the app is not caught by aggressive battery optimisation, which mostly shows up as late notifications rather than drain.

10.9 Battery saver

Settings → Experience → Battery saver freezes the moving backdrop and the call card’s motion and skips automatic transcription after calls; it turns on by itself while your phone’s own power saver is on. Battery & performance, just above it, shows the battery and heat state your phone reports. Calm mode, in the same place, stills the rest of the app’s animation.

11 · Plans, and paying privately

What is free forever, what each tier carries, and how paying stays anonymous.

11.1 The plans

No plans, one app. Every feature is free forever, sealed chats and groups, calls, media, voice notes, Flashes, location, export, backup, and every safety and privacy control, because those are never sold. What Free sets is numbers, and a pack raises them for a year: Basic, Pro, Plus, Max or Ultra, one ladder where a higher pack includes every pack below it. Buy one in Settings → Spojiti Packs → Unlock Now (through the App Store on an iPhone, through our website checkout on Android, Mac and Windows), or on spojiti.world/subscribe as a pack code to redeem in the app. Spojiti Packs in Settings and spojiti.world/subscribe are always the current word on prices.

11.2 Free

Free is the whole messenger: sealed chats and groups, calls, media, voice notes, GIFs and stickers, polls, Flashes, location, disappearing messages, honest read receipts, App Lock, on-device search, export and backup to this device, the full security architecture and every privacy control, forever. What Free has less of is only numbers: media and files up to 20 MB, one device and one account, two groups of your own with six members each, one call recording, one screen share, one Flash and one live location share a week, Spojiti light and dark themes, and backups to this device. Undelivered messages are held for 5 days for everyone. Every pack and what it raises: spojiti.world/subscribe.

11.3 Premium

Five packs, one ladder, a year each, and a higher pack includes every pack below it. Basic: media and files up to 50 MB, and Custom Themes. Pro: 100 MB, unlimited groups with up to 256 members and co-admins, unlimited live location, two devices and two accounts. Plus: 250 MB, unlimited call recordings and screen sharing, and Flash & Avatar complete (who viewed, replies and reactions). Max: 500 MB, three devices and three accounts, and 2 GB of backup on Spojiti.cloud. Ultra: files up to 1 GB and 5 GB on Spojiti.cloud. There is no feature in any of them that Free lacks, and nothing in them is a safety feature; those are free for everyone. Current prices, in your own currency, are in Settings → Spojiti Packs and at spojiti.world/subscribe.

11.4 Caps, and reaching one

Every feature is on for everyone; what Free sets is numbers: how big, how many, how many a week. Settings → Spojiti Packs shows your pack and its limits. When you reach one, Spojiti says which limit it was and shows the pack that raises it, with Unlock Now where a purchase can start there; during a call it only tells you, so the call is never interrupted by a checkout. A file someone sends that is over your limit shows as a locked card naming the pack that opens it, and is never downloaded for you. Weekly limits reset every Monday (UTC). Safety and privacy controls carry no limit at all.

11.5 The trial

There is no trial, and nothing to try before the clock runs out: the app is free forever with the Free limits from the first minute, no card and no identity attached. A pack raises the limits for a year when you want more, and when it ends you keep every feature; only the numbers return to Free's.

11.6 Prices

Packs are priced per country, in your own currency: India in rupees, the United Kingdom in pounds, Europe in euros, the rest of the world in dollars, and the prices change from time to time, so Settings → Spojiti Packs and spojiti.world/subscribe are always the current word, and I never quote a number from memory. What I can promise: every feature free forever, and packs that buy bigger limits, never safety.

11.7 Buying Premium

In the app, Settings → Spojiti Packs → Unlock Now on the pack you want: on an iPhone the App Store takes the payment; on Android, Mac and Windows our website checkout opens on that pack, you pay by card or net banking, and the code it gives you is added in one tap. Or buy on spojiti.world/subscribe without an account and paste the PACK_ code in Settings → Spojiti Packs → Redeem Pack (on a device with Spojiti installed, the page's button opens it for you). A code is what it holds, so keep it private until it is added. Current prices are on that page and in Spojiti Packs, never quoted from memory here.

11.8 Paying anonymously

Packs use blind signatures (an open IETF standard): the relay can verify your device holds a valid pack without ever learning which purchase, or which person, it came from. A pack code from our website names no account. Even at checkout, we cannot connect money to messages.

11.9 What your bank knows

No, and we will not pretend otherwise. Cards and bank transfers are identity-bound rails: the payment processor, the App Store and your bank know that you paid, and your statement shows it. What we guarantee is the link nobody can make: the pack is blind-signed when it is redeemed, so the account it unlocks cannot be traced back to the purchase from the token itself, even by us.

11.10 Payment requests

Payment requests are switched off for now: Google Pay and PhonePe refuse a person-to-person payment handed to them by another app, so payments inside Spojiti are being designed properly rather than patched. A request card you already received still shows and still pays by its QR. Spojiti never touches money and never sees a transaction, then or now.

11.11 How long a plan lasts

A pack runs for a year, to the end of the month a year from the day you add it; Settings → Spojiti Packs shows the month yours runs to. Nothing renews by itself: buy it again to renew, and when it ends you keep every feature and only the numbers return to Free's. Buying a higher pack starts that pack's own year at once, and it includes every pack below it. The packs on sale and their prices are at spojiti.world/subscribe.

11.12 When a plan ends

Settings → Spojiti Packs shows the month your pack runs to, and names the pack. Timing is tracked in month-grain windows on purpose: exact expiry seconds would make you more identifiable, and even our billing protects the crowd.

11.13 Safety is never paywalled

Iron rule, written into how we build: safety, privacy, and cryptographic strength are NEVER paywalled. Free gets the same double ratchet, the same post-quantum protection, the same zero-knowledge relay, App Lock, blocking, presence controls, view-once, vanish delete, caller-identity privacy, everything that keeps you safe. A pack buys bigger numbers on the limits: bigger files, more devices, more a week. Never protection.

11.14 Redeeming an access code

A pack code is how a pack bought on spojiti.world/subscribe, or won through a promotion, reaches the app without an account: it begins PACK_. Paste it in Settings → Spojiti Packs → Redeem Pack (or Redeem New Pack when you already hold one); on a device with Spojiti installed, the website's button opens it for you. The pack switches on at once, for a year, as a fresh blind-signed token, so the relay can check it is genuine without ever learning who bought it. If a code is refused, check it was typed whole and that its year has not ended. A promo code is different: that goes in Apply Promocode on the same screen.

11.15 Cancelling and refunds

There is nothing to cancel, because nothing recurs: a pack is paid once, runs for its year and then simply ends, with no card on file and no auto-renewal. You keep every feature when it ends. A purchase is final: we never learn who paid us, which is the point of paying anonymously, so there is nothing to refund against; a pack bought in the App Store follows the store's own rules. The full policy is at spojiti.world/refund.

12 · The app around it all

The official chat, the assistant, and the rest.

12.1 The :Spojiti_Beta chat

This is the official Spojiti channel, key-verified by the app itself. Right now your questions are answered ON YOUR DEVICE from a built-in help guide, the message itself still travels, end-to-end encrypted, to the :Spojiti_Beta account like any chat, where nothing reads or answers it today. No model is ever consulted and no question leaves your phone to be answered; when my book does not have it, I say so and point you to the full guide.

12.2 Is the assistant an AI?

I am :Spojiti_Beta, the product’s own guide, and I am not an AI model. Every answer I give is written in advance by Spojiti’s CTO and stored ON your device (a corrected wording, approved by a person, can arrive from our servers): no model is consulted, your question is never sent anywhere to be answered, and I work in airplane mode, try it. When the answer is not in my book I say exactly that and point you at the full guide, instead of guessing.

12.3 Calm mode

Calm mode (Settings) freezes ambient animation and dims the glow, built for motion sensitivity and migraine, free because accessibility is never sold. The system reduce-motion setting is honored on top.

12.4 Appearance

Settings → Experience → Default Themes follows your phone’s light or dark setting, or pins one. For colour, Custom Themes just below holds nine built-in themes, your own bubble and background colours, and wallpapers, all free and stored only on this device.

12.5 Custom themes and wallpapers

Settings → Experience → Custom Themes recolours the app your way, with the Basic pack or above (Spojiti's own light and dark themes are free). Pick one of nine built-in themes, Spojiti, Forest, Ocean, Lagoon, Sunset, Dusk, Mono, Ember, Rose, each in light and dark, or set your own colours for sent and received bubbles, the chat background and buttons, down to a bubble's text, time and reply bar, with a live preview that flags a colour that would not read. Wallpapers come as nine patterns or any picture from your gallery or Spojiti · Data. All of it stays on this device.

12.6 MirrorMesh reactions

MirrorMesh reactions are small animated reactions and stickers drawn on your phone with a character’s face, Spoji, our mascot, or Tipko, the little robot, sent sealed like any message and uncounted for everyone. Packs come from our website and are added in Settings → Experience → Add-ons → Reaction packs (up to 3 installed, for everyone); searching and picking happen on your phone, so the relay never sees what you chose. Reactions that wear your own face arrive in a later build.

12.7 Language

Spojiti speaks English, Hindi, Kannada, Spanish, Arabic (right to left) and French, pick yours in Settings → Experience → Language (there is a search box), and every word of the app changes to it. The app carries English; a language arrives as a small pack from spojiti.world the first time you pick it, signed by Spojiti and checked on your device, like the reaction packs, and a corrected pack reaches you by itself. Nothing you write is ever sent anywhere to be translated, and call transcripts can be translated on the phone too (Android and iPhone).

12.8 Where Spojiti runs

Spojiti runs today on Android, iPhone, Mac and Windows, with one identity model everywhere. Android, Mac and Windows download from spojiti.world/download.html, and iPhone installs through TestFlight; on Windows the portable app is joined by the Microsoft Store listing once it is approved. A browser version and a Linux app are on the roadmap.

12.9 What is coming next

The roadmap is public: Echoes going live, Spojiti in the Microsoft Store, a Linux app and a browser version, contacts you can carry in and out, abuse reports you can send us with cryptographic proof, and a private route that hides your network address from the relay. Ideas and the release log live at spojiti.world/roadmap.

12.10 Saying hello

Hello, and welcome. I am :Spojiti_Beta, the app’s own guide, answering on your device. Ask me anything about Spojiti in plain words: how to add someone, what the ticks mean, how calls or backups work, what is free and what is not, or why we never ask for a phone number. If a question is not in my book I will say so and point you to the full guide at spojiti.world/userguide.

12.11 What you can ask

Ask me in your own words and I will find the matching answer. The topics I cover: your identity and recovery phrase; adding people by QR, invite link or Account ID; sending messages, photos, files, voice notes, stickers, polls and locations; disappearing and view-once messages; groups and Echoes; calls and call recording; stories, circles and profiles; blocking, reporting and message requests; App Lock, the Quiet switch and screenshots; notifications; backups, storage and updates; devices and platforms; packs, paying privately and codes; and how the encryption and the relay actually work. The whole guide, in the same words, is at spojiti.world/userguide, and the white paper at spojiti.world/whitepaper goes deeper.

12.12 Finding your way around

The bottom bar has five tabs: Chats, Calls, Echoes (Coming Soon in this build), Data and Settings. Settings opens on eight doors: Account (picture, :Handle, Aham, recovery phrase and code, linked devices, log out and delete), Experience (language, themes, add-ons, quick actions, media quality, call tools, battery, the welcome tour), Notifications (delivery health, alerts, previews), Back-Up & Storage, Privacy (online and last seen, link previews, being findable, call privacy), Security (App Lock, the Quiet switch, post-quantum, protected chats, safety guards, ways back in), Spojiti Packs (your pack, every pack and its limits, promo codes and pack codes), Promotions, and About Spojiti (version, updates, diagnostics, support, reviews, legal). Inside a chat, the ⋮ menu in the corner holds everything about that one conversation.

12.13 Where to read more

Everything I know, and more, is written down on spojiti.world: the User Guide (these same answers, organised), the FAQ, the Security page, the Tech Docs, and the white paper, which explains the identity model, the post-quantum protocol, sealed media, anonymous payments, Echoes, the infrastructure and the threat model in full, with a PDF you can keep. The Compare page sets Spojiti beside the messengers people ask about, feature by feature, honestly.

12.14 The welcome tour

The welcome tour you saw on first launch can be replayed any time: Settings → Experience → Replay welcome tour. It is the same short walk through your :Handle, your 12 words, the recovery code, coming back with Face ID or your fingerprint, and notifications, and it costs nothing to watch again.

12.15 Sample chats

Settings → Experience → Preview with sample chats fills the app with example conversations, so you can see how everything looks before you have anyone to talk to. They live in memory only: nothing is saved and nothing is sent.

12.16 Terms, privacy and licences

Settings → About Spojiti holds the Terms & EULA, the Privacy policy, the open-source licences and the exact version and build you are running. The same terms and privacy policy are on the website at spojiti.world/terms and spojiti.world/privacy; the short version of the privacy policy is that we hold nothing about you to have a policy about.

12.17 Web, Windows and Linux

Spojiti runs as native apps on Android, iPhone, Mac and Windows (on Windows a portable app from spojiti.world/download.html, with the Microsoft Store listing to follow). A browser version and a Linux app are on the roadmap, built so they keep every promise the native apps make. On a Mac or a Windows PC, link it as a second device from your phone and everything, chats and calls, works on the desktop.

13 · Support and feedback

Reaching the people who build Spojiti, without telling them who you are.

13.1 Reporting a problem

We want it: write to spojiti@spojiti.world, and attach a Diagnostics export (Settings → About Spojiti → Diagnostics) if it is a bug, the log is content-free and PII-free by construction, so sharing it costs you nothing. Every report is read by the engineers who build Spojiti, with no outsourced desk in between. An AI tool may draft a reply to a post on the support board, and a person approves each one before it appears.

13.2 Support tickets

Settings → About Spojiti → Contact support files a ticket on our public support board from inside the app: pick a category, describe it in plain text, and if you like attach the Diagnostics export, which records what the app did and never what you said. You get a ticket code: it is the only key to your ticket, so save it, and replies appear under it at spojiti.world/support.html. No email and no :Handle are attached; the ticket is marked as coming from your random account id, which only our staff can see. Posting on the website instead asks for a six-digit code we send to your own :Spojiti_Beta chat, so nobody can post as you.

13.3 Reporting a vulnerability

Thank you, we want it. Email spojiti@spojiti.world with SECURITY in the subject, or open a ticket on the support board, which takes no name and no email. Say what you found, how to reproduce it and which build (Settings → About Spojiti). We acknowledge within 3 business days and send a fix or a written plan within 90 days for anything confirmed, faster for anything touching message confidentiality. Good-faith research is authorised, and credited if you wish; there is no paid bounty today. The full policy is under Reporting a vulnerability on the Security page at spojiti.world.

13.4 Ideas for Spojiti

Ideas go on the Roadmap page at spojiti.world/roadmap, under What should we build?: post one, or back someone else’s, and the most-loved get built. Posting needs no sign-up; it asks for a six-digit code sent to your own :Spojiti_Beta chat so nobody can post as you, and the post is marked with your random account id, which only our staff can see. Bugs are better filed from Settings → About Spojiti → Contact support.

13.5 Ratings and reviews

One place, not tied to your name: Settings → About Spojiti → Reviews & feedback publishes a rating and review on spojiti.world, stored with no name, no :Handle and no account; a written review first needs a one-time code sent to your :Spojiti_Beta chat, whose record is erased within a day. After a good rating the app may also offer your store's own rating prompt.

14 · And also

Answers that arrived after the sections above were drawn.

14.1 Delete edit

Delete & Edit is on each person’s contact page (tap their name at the top of the chat, or the chat’s menu). On, as it starts, their Delete to Both, Delete to Peer and edits change your copy too. Off, you keep the original of everything they send you once you have seen it (a message you have not seen yet can still be taken back or edited by its sender), in your chat and in your groups with them, on all your devices; their app tells them before they delete or edit a message to you, so nothing is hidden from them. It decides your copy only: theirs, and everyone else’s, follow their own choices, and the relay never sees the setting.

14.2 Addon packs

Spojiti Packs are five, Basic, Pro, Plus, Max and Ultra, each for a year on every device of your identity, and a higher pack includes every pack below it, so you only ever hold one. Settings → Spojiti Packs shows which pack you hold and its limits, then each pack with its price in your currency, its features and limits, and Unlock Now; a pack you already hold says so instead. Buying the same pack again renews it; buying a higher one starts its year at once. A pack becomes a blind-signed token on your device, so no payment is linked to your account. A file larger than one send carries goes in sealed 1 MB pieces, and a dropped transfer picks up where it stopped.

14.3 Promo code

A promo code, from Spojiti or a creator you follow, goes in Settings → Spojiti Packs → Apply Promocode. It does one of two things: it unlocks a pack for free, for a set time, or it takes a percentage off a pack. A free pack works everywhere; a percentage off applies when you buy on our website or from the Android, Mac and Windows apps (the App Store cannot take a discounted price, so an iPhone shows the offer and where it applies). Each code runs between two dates and for a set number of people, and is used when it is applied. Spojiti counts how often a code is used, never who used it.

14.4 Videos

Settings → Experience → How Spojiti works has short videos with Spoji, made from the app’s own screens: getting started, privacy and safety, your way back in, everyday features like Flashes, Pings and the Data tab, devices and accounts, and settings and help. Each one downloads from our website only when you tap it, and plays only if Spojiti signed it. The same videos are in the User Guide at spojiti.world/userguide.html.

14.5 My packs

Settings → Experience → Add-ons keeps them in one place: the languages on this device (English is built in; update or remove the others), the reaction and sticker packs from our website, Spojiti’s tunes for your ringtone, and GIFs, which come from your own gallery and need nothing extra. One switch, Update add-ons automatically, decides whether a newer signed version replaces yours by itself when Spojiti starts, or waits until you tap Update. (Add-ons were called My Packs until build 396; packs now means only what raises a limit, in Spojiti Packs.)

14.6 Promotions

Settings → Promotions lists what is running where you are, as cards: an offer on packs (a percentage off, or a pack free for a set number of people, between two dates) with its button; the referral reward (Share my link: when enough people you invited have joined, the pack set for the offer unlocks for you, and each person who joined through your link gets the pack set for them); and the promo code you applied, if any. Every reward is a pack unlocked through the blind signature, so the pack it turns on is never tied to your account.