Technology · Closed beta
Messages are locked on your device before they leave it. This page says what that covers, what still sits on the servers, and the limits we do not claim.
Last updated 9 September 2026 · Operator: Kastia. We do not publish packet layouts, key-derivation internals, or operational secrets.
The short version
Pigeon is a messenger. You install it on a phone or a computer, sign in, and talk to people. Encryption happens on your device, before a message is sent.
There is one message core. The internet is the usual path. Nearby is the spare path for when that path is gone. The lock is the same on both.
Honest metadata
Servers hold ciphertext and delivery metadata: that a message was sent, roughly when, and which chat. Username and email (for a sign-in code) are ordinary account data.
To deliver mail and run an account we need some labels. That is the part people skip when they say “encrypted.”
Username, display name, optional profile photo, the email or phone used to sign in, device names and public device keys, which chats you belong to, plan limits, and opaque envelopes — ciphertext plus delivery metadata (conversation, size, time).
Private message text, group plaintext, file plaintext. We store locked copies, not a readable archive. We cannot turn sealed envelopes into plaintext for anyone — including us, or a court order aimed at us.
Private message text, group plaintext, file plaintext, backup passphrases, or a spare copy of your message keys. Logs do not write message bodies. Push payloads do not include the text.
Display names, usernames, and profile pictures are visible to people you chat with, like a name on a mailbox. They are not end-to-end encrypted. The letters inside are.
The table, not only the good news
Encryption is a design, not a slogan. Here is what it is for, and where it stops.
| Situation | What we designed for |
|---|---|
| Someone watching the internet | They see encrypted traffic. They do not get message text or photos. |
| Someone with our servers (including us, or a court order aimed at us) | They can see accounts, membership, and sealed envelopes. They cannot read private chats, groups, or files. We cannot turn that into plaintext for anyone. |
| A stranger’s Pigeon phone used as a Nearby relay | It can forward a sealed packet. It cannot decrypt it. |
| A radio in the same room | Bluetooth is local. Timing, size, and “a Pigeon user is nearby” can leak. Message bodies still do not. |
| A stolen unlocked phone | If the device is open, the thief can read what the owner could read. Use a device passcode and the in-app lock. |
We are not an anonymity network. We do not claim that Kastia cannot tell which account talked to which chat. We do not claim sealed sender (hiding who sent a message from the server). We do not claim that malware on your phone is something we can defeat. Those are real limits. Naming them is part of the product.
Proven protocol
For one-to-one chats we use the Signal Protocol — the same family of designs used by Signal. We did not invent a new cipher. We use a widely reviewed protocol through a maintained library.
A session starts with PQXDH, including a post-quantum hybrid step, so a later break of today’s public-key math is harder to rewind. After that, the Double Ratchet gives each message fresh keys. If a device is stolen later, older messages that already left the device stay out of reach. That property is called forward secrecy.
If verification or decryption fails, the message is rejected — no “best effort” decrypt that might show garbage or skip a check.
The lock sits above the network. TLS protects the pipe to our servers. Bluetooth has its own radio layer. Neither of those is the privacy story. Confidentiality is the ciphertext, not the truck.
Not only one-to-one
The same on-device lock covers families, broadcasts, and photos. People outside the conversation still cannot open it.
Families, clubs, a project of up to a few hundred people. Same pairwise Signal sessions plus a shared group key. Each member can post; everyone in the group can read; people outside cannot. Roles decide who can add members. After you leave, you should not keep reading new posts — the design is built so membership actually matters.
Broadcasts: a class, a team, an announcement board. Public posts are signed so readers can tell they came from the channel’s publishers. Private channels are sealed so followers can read them and we still cannot. We store locked copies, not a readable archive.
On your device, Pigeon encrypts the file first, with a fresh key, then uploads the sealed blob. The key that opens the file travels inside the encrypted message — not as a readable field on the file server. When the other person downloads the blob, their app decrypts it locally. We cannot generate a thumbnail. Support staff cannot preview the image.
People and devices
An account is a person. A device is a phone or computer that person has allowed. Credentials are bound to the device. If a laptop is lost, you can revoke that device from another signed-in copy of Pigeon. We cannot log in as you from our side and dump a chat history — we do not have the keys.
Sign-in uses a short code emailed (or, when enabled, a phone code), or a Google sign-in. When Google is used, we verify a signed identity token from Google. We do not want your Google password, and we do not log those tokens.
A new device starts empty. History does not silently appear on a second computer. If you want history on a new device, you restore a backup you made. That is how we avoid keeping a readable copy “just in case.”
When the network fails
Range is about a large room, not a city. If other Pigeon users in between also have Nearby on, a message can hop — a hallway or a dense crowd. It will not find a phone across town by itself, and it is not Apple or Google’s Find My network. Those systems work because millions of strangers’ phones upload encrypted location over the internet. We do not have that crowd, and we are not going to pretend we do.
Relays forward bytes they cannot read. You turn Nearby on when you want it. Turn it off, and the phone stops advertising that it is participating.
Anyone with a radio nearby can observe that Pigeon traffic is happening — timing, rough size, proximity. That is the nature of Bluetooth. The body of the message stays sealed.
When the internet returns, a message that went over Nearby can also be sent on the cloud path so devices that were not in the room still get it.
Restore is on purpose
Optional encrypted backup seals your conversations with a passphrase you choose. That passphrase is turned into a key on your device; it is not sent to us as a password we could type later. We store a sealed blob. If you forget the passphrase, we cannot reset it. That is harsh. It is also the only honest design if we refuse to hold a spare key.
Linked devices do not auto-sync history in this beta. Restore is something you do on purpose.
Closed beta
Questions
This page is the public architecture. The privacy policy is the store listing. The terms of use are the contract. Write [email protected] if something here is unclear.