The messenger that
knows nothing about you
PrivateSecureDirect
iPhone · Android · Mac — one identity, every screen · see everything it does →
iPhone · Android · Mac — one identity, every screen · see everything it does →
Your identity is a cryptographic key derived from a 12-word recovery phrase only you hold. Sign-up asks for nothing, because we want to know nothing.
Every message, photo, voice note and call. Our servers only ever see ciphertext — and delete it the moment it's delivered. There is no paid tier for privacy.
An ML-KEM-1024 post-quantum key exchange on top of the classical one, a post-quantum ratchet that renews the protection every turn of the conversation, and ML-DSA-65 signatures on every key — so traffic harvested today cannot be unlocked later, and nobody with a quantum computer can pretend to be your contact. Verified against NIST's own test vectors on your device, every launch — and it switches itself off rather than pretend if that check ever fails.
Chats live encrypted on your devices, not in our cloud. Optional backups are sealed with your recovery phrase — we can't open them even if asked.
Spojiti runs on infrastructure we own and operate — multi-homed, with no big-cloud lock-in between you and your words.
Not a marketing diagram — every box we run, from the edge to the fallback TURN and the DR boxes, labelled with what it can and cannot see. Updated 2026-09-07 to show all of it.
Sealed envelopes addressed to random account IDs — with no sender: every envelope arrives over an anonymous connection, wrapped to the recipient’s keys, so the relay never holds a sender–recipient pair. Plus a coarse wake class (call vs message) so a sleeping phone can still ring. That trade is universal in VoIP push; we're just the ones who tell you.
Your name, your number, your contacts, your message content, your call audio or video. There is nothing to type them into — the app never asks.
Nothing. Every envelope is deleted the moment it's delivered. Your history lives encrypted on your devices — which is why only your 12 words can bring it back.
No account, no email, no name — describe the problem, optionally attach the app's content-free diagnostics, and you get a ticket code. That code is the only key that exists; there is no author field in our database to fill.
Every ticket and every idea lives on a public board — our replies wear the team badge, and statuses move from open to shipped where everyone can see them. Nothing disappears into a private inbox.
The most-loved ideas on the public roadmap get built. Try finding another messenger whose support desk knows nothing about you.
Spojiti for Mac is here — a real native app, not a web wrapper. Link it from your phone with one QR scan; it becomes a full device of the same identity, end-to-end encrypted like everything else.
A proper two-pane layout — chats on the left, conversation on the right — with keyboard-first ergonomics: Enter sends, Esc closes, and the window remembers its place.
Audio and video calls ring straight on the desktop — answer where you're working. Mid-call switch to video, same end-to-end encryption, same zero-knowledge relay.
Close the window and Spojiti lives on in the menu bar — messages keep arriving as native notifications. Windows and Linux builds are on the way from the same codebase.
No forms, no OTPs, no contact-list upload. Here is the entire onboarding:
One tap. Your phone generates a cryptographic identity and shows you 12 recovery words. Pick any nickname — it's a label, not an account.
Add someone by scanning their code face-to-face, or sharing your Account ID. Nobody can look you up, scrape you, or cold-message you.
Messages, calls, payments, stickers — all end-to-end encrypted from the first second. Nothing to configure to be safe.
Text, photos, videos, voice notes, files, location — plus GIFs and brand sticker packs that never touch a third-party server. Reactions, replies, edits, delete-for-everyone, disappearing messages, view-once photos, screenshot protection. Everything end-to-end encrypted, no exceptions.
Crystal audio and video with the same end-to-end protection — engineered to connect even on hostile hotel Wi-Fi and strict corporate networks, and to ring properly on a locked phone.
Request money right in the chat; they pay in their own UPI app. Spojiti holds no financial data, sees no transactions, takes no cut. More regions as we grow.
Optional warnings for abusive content, checked entirely on your phone. Nothing is scanned on our servers — structurally, nothing can be. Protection and privacy, finally on the same side. How that works →
Most messengers keep a tidy list of every group you belong to, who is in it, and who runs it. Ours cannot. A Spojiti group message is sealed separately for each member and travels as ordinary one-to-one traffic — our relay holds no record that a group exists — no roster, no member list, nothing to hand over.
Every add, removal, rename and promotion is cryptographically signed by the admin who made it, so nobody can forge their way into a room — or quietly push someone out of one. Your device checks the signature before it believes anything.
The moment someone leaves or is removed, every remaining device stops accepting their messages. No lingering read access, no ghost in the room — enforced by the members, not by a server being trusted to behave.
Photos, videos, voice notes, files, locations, reactions, edits, delete-for-everyone and disappearing timers all work in groups exactly as they do in a private chat — sealed the same way, for each member.
Encrypting a call is normal. We go further: the signalling that sets a call up rides inside your encrypted conversation, as sealed envelopes the relay cannot read — no names, no numbers, no audio, ever. One honest caveat, stated because most apps won't: an envelope carries a coarse wake class (call vs message) so a switched-off phone can still ring, which reveals that call signalling is in flight — and nothing more. Every VoIP-push app makes this trade. Group calls connect every participant straight to every other — no server sits in the middle holding the roster.
Voice and video, end-to-end encrypted, with a mid-call switch from audio to video whenever the conversation needs a face.
Anyone in a group can start a call and the others hop in. Comfortable up to 8 on audio and 4 on video — the honest limit of doing it without a server in the middle, and we would rather state it than fake it.
Phone, tablet or the native Mac app. The same identity, the same encryption, the same silence from our side of the wire.
Every messenger claims privacy, so claims are worthless. Here are the four that actually separate us — and the last steps to being indisputably the best.
Every mainstream messenger requires one. A phone number is a permanent, government-linked name for you. We never ask, so there is nothing to link.
If your device is stolen tomorrow, your past conversations stay sealed — our keys move forward with every message. Session, the other no-phone-number messenger, still does not have this.
Hybrid ML-KEM-1024 key agreement, an ML-KEM-768 ratchet that folds a fresh post-quantum secret into every turn of every conversation, and ML-DSA-65 signatures beside Ed25519 on every published key — checked against NIST's published FIPS 203 and 204 vectors on your own device at every launch. On every layer of the protocol, level with or ahead of the best; on two of them, ahead of everyone. Verified, not asserted.
Buy a plan and the payment cannot be linked to the account it unlocked. Not by your bank, not by us. Nobody else in messaging offers this.
Spojiti Private Messenger Core is published under the AGPL v3. Independent audit in progress — expected by end of 2026, on track. The report lands here in full. Next on the protocol: a private route for your IP, so the relay never sees where you connect from, and post-quantum keys for call media — a first for any messenger.
The core — and every safety feature — is free forever. Power features are a few rupees a year, because servers cost money and your data is not for sale. And every new account starts with 7 days of Pro+, free — no card, nothing to cancel.
See plans →