Including the uncomfortable ones. If something here is unclear or you think we are wrong, tell us — we would rather fix the answer than defend it.
Really. Open the app and you already have an account. Your identity is a cryptographic key pair your device creates — no sign-up form, no SMS code, no email. You connect with people by scanning a QR code or sharing an invite link.
They do not, and that is deliberate — nobody can look you up. You share an invite link or show a QR code to exactly the people you choose. Being unfindable by strangers is a feature: it is why Spojiti has almost no spam surface.
When you set up, you are given a 12-word recovery phrase. Write it down and keep it somewhere safe. That phrase — and only that phrase — restores your identity on a new device. We cannot reset it for you, because we do not have it. That is the trade privacy demands, and we would rather be honest than pretend otherwise.
Opaque account identifiers, ciphertext we are routing while someone is offline (deleted the moment it is delivered), your subscription tier, and the connection data any server sees. Not your messages, media, calls, contacts, group memberships or name — none of it ever reaches us in readable form.
We comply with lawful requests, and what we can produce is what we hold: random identifiers and ciphertext we cannot open. There is no name to disclose, no contact list, no message history. We built it this way precisely so that being compelled changes nothing.
Cash, envelopes and closed doors are not for people with something to hide either. Doctors discussing a diagnosis, lawyers with clients, journalists with sources, couples arguing, friends being stupid together — private conversation is ordinary and human. The people best served by Spojiti are the vulnerable, not the villains, who already have tools.
Three ways, none needing your identity. Creating an account requires a proof-of-work computation — trivial for a person, expensive for a bot farm. Nobody can message you without your invite, so cold-contact spam barely exists. And blocking, muting and reporting run entirely on your own device.
You buy on the website and receive a one-time access code. When you redeem it, your app performs a blind signature — the server signs proof of your plan without ever seeing the token it is signing. The payment and the unlocked account are mathematically unlinkable. Your bank knows you bought something from us; we cannot tell which account it became.
No, and we will not pretend. Cards and UPI are identity-bound rails — the processor and your bank know who paid. What we guarantee is the link they cannot make: the account that redeems the code cannot be traced back to the purchase, even by us.
Unlimited private one-to-one messaging and voice notes, fully encrypted, forever. The free tier is not crippled bait — it is the point. Pro (₹149/year) adds calls, media and power-user controls; Premium (₹399/year) adds multi-device, view-once and the full toolkit.
Neither. Access codes are one-time purchases that last a year. There is no mandate on your card, nothing stored to charge later, and nothing to cancel. When the year is up, you decide again.
Yes — and the server cannot even tell a group exists. Group messages are sealed individually for each member and travel as ordinary one-to-one traffic. Adding, removing and promoting members are cryptographically signed by the admin who did it, so a membership change cannot be forged.
The audio and video are encrypted end to end, and so is the call setup: the signalling that normally tells a server who is calling whom rides inside your existing encrypted conversation. Our relay cannot tell a call is happening. Group calls connect every participant directly to every other — sensible up to 8 on audio and 4 on video, the honest physics of doing it without a server in the middle.
Yes. There is a proper native Mac app — not a browser tab — signed and notarised by Apple, that links to your phone by QR and holds its own keys. Windows and Linux are on the roadmap.
Yes, and you can check rather than take our word for it. Session setup performs an ML-KEM-768 key exchange (the NIST standard, FIPS 203) alongside the classical one, and both must be broken to read anything — so traffic recorded today cannot be unlocked by a future quantum computer. What we do differently: the implementation verifies itself against NIST's own published test vectors on your device, every time the app starts. If that check fails, post-quantum turns itself off and tells us, instead of quietly pretending. Older versions of the app keep working normally throughout.
Not yet, and we will not claim otherwise. Our security page documents the architecture in full, and we have had no independent audit — one is budgeted for V1.0 and not yet commissioned. Publishing verifiable claims matters more to us than publishing a repository nobody reads. Where we stand will always be stated plainly.
CognitionX Logic India Private Limited, a small company in Bengaluru, funded by subscriptions rather than advertising. That is not incidental — a business that sells attention eventually needs to know who is paying attention.
Your messages live encrypted on your own devices, not on our servers, so they do not vanish with us. Your identity comes from your recovery phrase. We are also building toward self-hosting and federation, so no institution has to depend on our continued existence.
Ask it. We answer in plain language, and if the answer is a limitation, we will say so.