Every answer below is the in-app assistant's own answer, word for word, regenerated from the app that is shipping (build 317). It cannot drift from the app, because it is the same text.
The short answers people ask first.
Spojiti is a private messenger that never asks who you are — no phone number, no email, no name. Your recovery phrase IS your account, every chat is end-to-end encrypted, and even our own relay cannot read a word you send. That is not a setting; it is the architecture.
The short tour: sealed chats and groups, voice notes, stickers and GIFs, polls, disappearing and view-once messages, on-device search, stories, encrypted calls with post-quantum protection underneath, live location, honest receipts, App Lock, phrase-based identity and zero-knowledge everything. The complete, always-current list — every feature and which plan carries it — lives at spojiti.world/features.
A phone number is an identity leash: it links your chats to your name, your SIM, your country, your records — and once a service holds it, so can anyone who compels or breaches that service. Spojiti starts from a random recovery phrase instead, so there is nothing to leak, sell, or subpoena. We did not remove the phone number as a feature; we removed it as a liability.
“Spojiti” is a South Slavic verb meaning to connect, to join together. That is the whole mission in one word: connect people — without connecting them to surveillance.
Because private conversation should not be a luxury good or a trade for your identity. Everything here follows from one question, asked at every design decision: “what is the version of this feature that we could not abuse even if we wanted to?” Sometimes that costs us a convenience. We pay it. That is the product.
Spojiti is built by a two-person partnership: a CEO with twenty-five years of engineering behind him who tests every build on real devices in his own hands, and a CTO — Claude Shanwell — who wrote it end to end: every screen, every protocol, every line of the relay. Small on purpose: fewer hands, fewer leaks, one coherent architecture. You are reading the CTO’s answers right now — this corpus is written by the person who built what it describes.
Spojiti is funded by subscriptions — Pro and Pro+ — and nothing else. No ads, no data sales, no “partners”: there is nothing about you to sell even if we wanted to. When the person who pays is the user, the product serves the user. Even payment is engineered private — blind-signed entitlements mean we cannot link a payment to an account.
Respect where due: the best private messengers proved end-to-end encryption at scale, and we build on the same peer-reviewed cryptographic ideas. Where Spojiti goes further: no phone number ever (every mainstream messenger requires one), post-quantum protection on every session, blind-signed payments that cannot be linked to you, and an on-device assistant instead of a cloud one. Versus the mainstream messengers the difference is starker — no parent company hungry for your graph, and nothing “encrypted optionally”. Every chat, always, sealed.
No account, no phone number — a phrase is the whole identity, so treat this section as the one to actually read.
Your recovery phrase is your entire account — identity, keys, everything derives from it. Write it on paper and keep it safe. If it is lost, the account is gone forever: nobody, including us, can reset it, because we hold nothing about you to reset. That is the price and the point of true privacy.
The phrase is always machine-generated, on purpose: its randomness is exactly what makes your account impossible to guess. Words a human would choose are words a human can guess. If you dislike a phrase at onboarding, generate a fresh one — but you cannot type your own, and that is a security feature, not a missing one.
Names on Spojiti wear the : glyph — one colon for a person, two for a group. There is no global username registry on purpose: a registry is a directory of users, and directories get scraped. Your :name is what YOU choose to show; contacts connect by code or QR, not by searching a database. And nobody can wear our name — the app refuses lookalikes of :Spojiti at every path.
Rename any contact from the chat list’s ⋮ or the chat menu — the label is yours alone, stored only on your device; they never see it. One guard: names that imitate the official :Spojiti channel are refused, so nobody can be dressed up as us.
Install Spojiti on the new device, choose Restore, and enter your paper phrase — identity and keys derive right back. Chats return from your encrypted relay backup if you kept one (Pro+), and conversations re-establish their sealed sessions automatically on first contact. The phrase is the whole ceremony; that is why it must never be lost.
Pro+ adds a second linked device from Settings → Devices: scan the QR on the new device from your current one. Each device gets its own keys; messages are sealed to every device individually, so no device ever shares private keys with another.
Two layers stand between a thief and your chats: your phone’s own lock, and Spojiti’s App Lock — which closes the database and drops the key, so the messages are not merely hidden, they are unreadable without you. From another device, restore with your paper phrase and revoke the old device in Settings → Devices — the relay stops delivering to it immediately. This is exactly why the phrase lives on paper at home, not in the phone’s notes.
Settings offers a full identity wipe: keys, chats, and identity are destroyed on-device, the relay forgets your push address, and the account becomes unwakeable. Because we never held your identity, there is no “deletion request” to file and no residue to chase — when your devices forget you, you are forgotten. Keep the phrase only if you want the option to return.
Settings → Delete identity erases this device completely — keys, messages, media, everything, behind a deliberate confirmation. And because we hold no account data, there is nothing on a server to delete: your phrase and devices ARE the account. Leaving is as private as staying.
What is protected, what is not, and what happens in the bad cases — in the same words the app itself uses.
Every message is end-to-end encrypted with the same open, peer-reviewed designs that secure the world’s best messengers — the Double Ratchet — upgraded with post-quantum key agreement (ML-KEM-1024), a post-quantum ratchet inside every chat (ML-KEM-768) and post-quantum signatures on every key (ML-DSA-65). Keys live only on your devices. We run the relay and still cannot read your messages — it only moves sealed envelopes and deletes them on delivery.
Under every chat runs a double ratchet: the encryption key changes with every single message, derived forward in a way that cannot be run backwards. Steal today’s key and yesterday’s messages stay sealed — that is forward secrecy. On top rides post-quantum key agreement (ML-KEM-1024) and a post-quantum ratchet (ML-KEM-768) that renews the quantum protection every turn. Open, peer-reviewed designs — the same family that secures the best messengers on earth — not homemade cryptography.
The realistic quantum threat is “harvest now, decrypt later” — recording sealed traffic today to open it when quantum machines mature. Spojiti mixes ML-KEM-1024 post-quantum key agreement into every session and a fresh ML-KEM-768 secret into every turn of it, and signs every key with ML-DSA-65 as well as Ed25519, so what is recorded today stays sealed in that future too — and nobody with a quantum computer can pretend to be your contact. We built for the attacker of 2035, not just the one of today.
Spojiti is post-quantum end to end: key agreement with ML-KEM-1024 hybridised with classical X25519, a post-quantum ratchet that folds a fresh ML-KEM-768 secret into every turn of the conversation, and ML-DSA-65 signatures beside Ed25519 on every published key — so a future quantum computer can neither open recorded traffic nor forge a key. It only activates on devices where the official NIST test vectors (FIPS 203 and 204) pass at runtime — verified strength, never assumed.
Zero-knowledge here is literal: the relay stores sealed envelopes it cannot open, delivers them, and deletes them. Your avatar travels sealed. Calls are peer-to-peer — the relay never even learns a call happened. Your subscription is validated through blind signatures, so payment cannot be linked to your account. We did not promise not to look; we built it so looking finds nothing.
Honest answer, because you deserve the real one: a relay that moves envelopes must know which account an envelope is FOR, or it could not deliver it. It does not know who it is FROM: every envelope leaves through an anonymous connection, wrapped once more to the recipient’s keys (sealed sender), so the relay never holds a sender–recipient pair. What it never knows either: your name, number, message content, or preview text — accounts are random ids with no identity attached, envelopes are deleted on delivery, nothing is archived. What it can still see is your network address, until the private route ships. That is the whole metadata story.
The relay is a deliberately blind post office: it routes sealed envelopes between opaque account ids, deletes them on delivery, and holds no message history, no names, no phone numbers, no social graph it can read. We designed it so that even a subpoena finds nothing to read.
“Something new is waiting” is the sealed-envelope notification: the push that woke your phone carried zero content — by doctrine, forever — and the envelope shows when your device could not (or was told not to) render a preview locally: previews toggled off, a view-once message (never previewed, by design), or the preview not being available for that particular envelope. Blank is not broken; blank is the promise being kept.
Push must transit Apple’s and Google’s infrastructure — that is how phones wake. So Spojiti sends them nothing: the push says “something is waiting”, full stop. No sender, no text, no ids. Names, faces, and message text are added by YOUR device after local decryption. Apple and Google learn only that your phone received a push — never what it said or who it was from.
Assume the worst: someone images our server tonight. They get sealed envelopes awaiting delivery (unreadable — keys are on your devices), random account ids, and public keys. No names, no numbers, no message history — history exists only on your phones. That is the difference between promising security and being architecturally unable to lose what was never collected.
Your history lives on your devices, not our servers — an outage never touches it. Messages sent during one queue on the sender and re-drive automatically; the transport self-heals with backoff and fallback routes. And because your identity is your phrase, not an account we host, even the company vanishing could not delete who you are.
If a lawful order arrives, we comply — and what we can hand over is what we hold: sealed ciphertext in transit, random account ids, and nothing else. No identity, no content, no history, no contact list. We cannot decrypt you, and we cannot identify you. That is not defiance; it is arithmetic.
There is no backdoor, and more importantly there is nowhere to put one: keys are generated and held on your devices, the ratchet changes them every message, and the relay moves only sealed bytes. A backdoor would require redesigning the entire system into something we deliberately refused to build.
No AI reads your messages — not for features, not for training, not for “safety scanning”. The relay cannot read them, so it cannot feed them to anything. There is no exception, and there used to be one: a question this assistant could not answer was passed to a server-side assistant that could consult a model. That path was removed — every answer you get from me now comes from a fixed list written by Spojiti’s CTO and stored on your device. Your words train nothing and inform no one.
The relay is small, self-hosted infrastructure we operate ourselves — deliberately not a hyperscaler’s data lake. But the honest security answer is: server location barely matters when the server cannot read anything. Your protection is mathematics on your device, not geography.
Do not trust us — that is the design principle. Trust the architecture: open, peer-reviewed cryptography; keys that never leave your devices; a relay that deletes what it delivers; diagnostics you can read yourself with no content in them; and honest answers even where they cost us (ask me about metadata). Every claim is checkable in the app’s own behavior — put this chat in airplane mode and I still answer, because I live on your device.
We collect no personal information because we never ask for any. No phone number, email, or name exists on our side. The relay sees opaque account ids and sealed envelopes, deletes messages on delivery, and keeps no message logs. Diagnostics stay on YOUR device and never contain message content.
On iPhone, Spojiti can show the sender and message text on your lock screen — decrypted ON your device by a tiny extension, from a preview sealed with a key only your contacts’ devices share with yours. Apple’s push carries no content, ever; the words appear because your phone opened them locally. On by default, yours to turn off: Settings → Notifications → Rich lock-screen previews. Trade stated plainly: previews use one stable key per contact rather than the ratchet’s per-message keys — message bodies always keep the full ratchet.
Spojiti is built to stay reachable: connection racing and DNS-resilient fallback routes are part of the transport, free for everyone — a censored user is exactly the user this app exists for. We do NOT yet disguise our traffic from deep packet inspection, so a network actively blocking Spojiti by signature can still succeed. If you cannot connect, a system VPN on top is fully compatible and is the right tool today.
When the app cannot reach the relay it checks, honestly, which of three things is true: your device is offline, our relay is down, or your network can reach the internet but not Spojiti — in which case the banner says a block MAY be in the way. “May” is deliberate: a phone cannot tell a national firewall from a broken hotel router, and we would rather admit the limit of our knowledge than guess at your network.
Everything that happens inside a chat.
Photos, videos, documents and camera shots send from the “+” in a chat — multi-select, with captions — all sealed end-to-end, stored encrypted on your device, and organised in the Data tab. Sending media is a Pro feature; receiving, and sending GIFs, stickers and voice notes, is free for everyone.
Hold the microphone in any chat to record a voice note — free on every tier, sealed like everything else, played inline.
Stickers ship inside the app (nothing fetched from a store) and GIFs send through “+” — both free on every tier, because expression is never paywalled here.
Sticker packs are single files (.spjpack) you can get anywhere — our website, a friend — because the trust is a cryptographic signature, not the download source. Your app verifies every pack against Spojiti’s own signing key before a single byte is kept; a tampered or third-party pack is refused with a plain explanation. Import one from the sticker sheet’s + button. No store, no catalogue server, nobody watching what you pick.
The “+” sheet has a camera: tap for a photo, hold for video, captured inside Spojiti and sealed straight into the chat. Camera capture rides the media gate (Pro).
Disappearing messages: open a chat → ⋮ menu → Disappearing, and pick a window. New messages in that chat are deleted on every device when the timer lapses. You can also set a timer per message from the composer, and View-once media disappears after a single viewing.
View-once: when attaching, choose view-once and the recipient can open it a single time — no re-open, no save, and it is excluded from search, exports and the Data hub. View-once is a Pro feature; received view-once messages open on every tier.
Swipe LEFT on your own bubble (or long-press → Edit) to fix a sent message — the edit travels encrypted to every device and the bubble is marked edited. Honesty rule: the fact that a message changed is never hidden from the reader.
Long-press a message to delete it for yourself, for the other person, or for everyone. On the free tier a deleted-for-everyone message leaves an honest “message deleted” marker; on Pro and above the bubble vanishes on both sides without a trace — the sender’s tier decides, because it is the sender’s message.
“Delete for me” gives you a few seconds to undo — the message leaves the screen at once but nothing is destroyed until the window closes. Deletes that reach the other person’s device (“for them”, “for everyone”) stay irreversible and say so before you confirm.
Long-press any message (or use the inline icons) to react — the quick row shows favourites and the + opens the full emoji picker. In groups everyone’s reactions show side by side. Reactions travel encrypted like everything else.
Swipe RIGHT on any bubble to reply with a quote; long-press (or the chevron menu) to forward or copy — unless the sender protected their content, in which case saving, copying and forwarding are disabled exactly as they asked. Which inline icons appear is yours to configure in Settings.
Every bubble has a chevron for the full action menu, and you can choose which of react / reply / forward ride beside messages as inline icons — Settings → Quick actions. Free for everyone.
You see typing dots when a contact is composing, and they see yours — carried inside the sealed channel, invisible to the relay like everything else.
Long-press a chat to PIN it to the top — pins are yours alone, stored only on your device; the other person never knows. Swipe on the chat list to archive; archived chats slide back the moment they speak.
Search from the home screen covers contact names first and message content below, and each chat’s ⋮ menu has an in-chat search — all of it running over your encrypted local database, never on a server.
Long-press any message and choose Save to keep a copy in your Saved chat — one tap, no picker. Saved lives only on this device, never on any server, and you can also type straight into it as a private notepad. Saving honours the sender’s sharing locks, and view-once messages can never be saved — viewing is spending. Saved messages are part of Pro.
Long-press the send button to schedule a message. It sends from THIS phone when the app is next running at or after the time you chose — the relay never holds a message for later, because it would have to hold it readable, and it never can. Pending messages show above the composer, where you can cancel them.
Polls: “+” → Poll, add an optional name, a question and up to six options. Votes are encrypted like everything else and tallied on the devices — the relay never learns what anyone chose. Tap your own choice again to retract it.
“+” → Contact shares a contact card carrying their id and the name they chose for THEMSELVES — never your private nickname for them. Receiving a card does nothing until tapped, and connecting still goes through the normal request flow.
Location: “+” → Location sends one pin (Pro), or share LIVE for 5, 15, 30 or 60 minutes (Pro+) — your movement updates inside the sealed chat and ends honestly at the deadline or when you tap Stop. Coordinates exist only inside the encryption; no map service is ever contacted by us.
Links are tappable and open in your system browser. Your phone NEVER fetches a link because a message arrived — that is how other messengers hand the link’s owner your IP address and exact read-time, and we don’t. A link card, if you see one, was built by the SENDER on their own phone before sending (Settings → Privacy → Link previews I send, off by default) and travels sealed inside the message like a photo. The card always shows the link’s real site name, taken from the link itself.
No signal? Type anyway. Messages queue on your device and retry automatically until the relay confirms — reconnection is silent and nothing is ever lost to a dead spot. One tick means the relay took it; ticks never claim more than what truly happened.
A message parked on “sent” means the other side has not come online to collect it — the relay holds the sealed envelope and your app re-drives it automatically with growing patience. Nothing is lost; delivery completes the moment their device reappears. If YOUR connection is the issue, the app shows it and reconnects on its own — airplane mode off, the backlog drains itself.
What others see of you, and how people reach you.
Set your photo in Settings (Pro — it rides the media gate). It travels sealed to your contacts like a message; we never host or see it. Tap any avatar to view it full-screen.
When a contact opens your profile picture full-screen, your app is told over the encrypted channel — never the relay. On Pro+, your picture’s sheet shows who looked and when. Anyone can react to or reply to a profile picture; it arrives as a normal sealed message quoting “Profile photo”.
Settings → Status lets you write one line your contacts see on your contact page. It travels inside the same end-to-end encrypted envelope as your profile picture, so the relay never sees it — a status is yours and your contacts’ business, nobody else’s.
Circles are labels for your contacts — Family, Work, whatever you like — that live ONLY on this device and can carry privacy defaults: a disappearing timer, screenshot protection, mute. Put a chat in a circle from its contact page and the defaults apply once, through the same controls you could have set by hand; after that the chat’s own settings stay in charge. Nothing about circles ever touches the network — not even that you use them.
Connect by QR code face-to-face, or send an invite link through any app you like — the link carries an id, never a phone number or name. There is no directory to search and no contact-book upload, ever: you meet people here the way you meet them in life.
Messages from people not in your contacts arrive as REQUESTS — held apart, content-free notifications, nothing marked read. Accept by replying, or ignore and they never know. Sharing someone’s contact card never grants access; it only lets the receiver ASK.
Block from the chat menu or the chat list — a blocked contact cannot reach you and is never told they were blocked. The complete block is free forever. From Pro you can also block selectively: just messages, just audio calls, or just video calls.
Reporting works WITHOUT breaking encryption: message franking lets you prove to us what was sent to you, cryptographically, without us ever being able to read anything else. An on-device guard can also blur likely-abusive incoming media before you see it, and nudge a sender before they send it — all computed on the phone, free, always.
Verify a contact by comparing safety numbers from their profile — the green check means the keys match what you confirmed. This official :Spojiti chat is verified differently: our public key ships inside the app itself, so nobody can impersonate this channel, and no one else is allowed to wear the Spojiti name.
Presence works one way on Free, by design: a Free account always shows its online status and last-seen to accepted contacts and cannot switch that off — controlling your presence (globally or per person) is a Pro control. And SEEING others’ online status and last-seen is a Pro feature too: on Free, nobody’s presence is shown to you. Read receipts stay free and honest for everyone.
Ticks tell the truth here: one tick = the relay accepted it, two = delivered to their device, read = it was actually on their screen while they were there. Spojiti never fabricates a receipt — if the ticks say read, it was read.
Stories are 24-hour posts — text, photo, video or audio — sealed individually to each of your contacts; the relay sees only ciphertext. Viewing stories is free for everyone; posting them is Pro+. React to a story straight from the viewer.
Encrypted voice and video.
Calls (Pro) are encrypted peer-to-peer — our relay only carries the sealed call setup, never the call itself, and cannot tell a call happened. Group calls run as an encrypted mesh: up to 8 on audio and 4 on video, capped where quality stays honest.
Pro+ adds caller-identity privacy both ways: hide who YOU are when calling, or hide who is calling YOU on your own screen. When an identity is hidden, per-contact ringtones fall back to the default tone — a distinctive ring will never leak who is calling through the speaker.
Pro+ lets you set a per-contact ringtone from the chat menu. It cooperates with identity privacy: a hidden caller always rings with the default tone, so the tune itself cannot identify anyone.
On-device noise cancellation (Pro+) suppresses echo and background noise during calls — processed entirely on your phone, because sending audio anywhere for cleanup would be someone else hearing your call.
The Calls tab keeps your history — outcomes recorded honestly (missed, declined, duration) and stored only on your device. The relay has no call log to keep.
Sealed group chats, group calls — and Echoes, spaces defined by what is said.
Groups are end-to-end encrypted with per-member sealing — the relay cannot even tell a group apart from busy 1:1 traffic. A group holds up to 64 members today (256 is the target once fan-out timing is measured), with group calls at 8 (audio) and 4 (video). Create one from the chat list; the member picker has search built in.
Groups carry up to 64 members for messaging today (256 is the target once fan-out timing is measured on real phones), 8 for group audio calls, and 4 for group video — the call caps exist because calls are true peer-to-peer encrypted mesh, where every participant connects to every other and quality is protected by honest limits. The relay never learns a group call happened at all.
An Echo is a space defined by what is said, not by who is in it — its name is :::handle. You ATTUNE to follow it (nobody is told), post a RESONANCE, reply with a REVERB, turn a post up with AMPLIFY (counted, never who), and FADE to stop. Inside an Echo you speak under a wave-mark that is yours there alone. Two kinds: a PRIVATE Echo, entered only with the Acoustic Key its Conductor (Pro+) shares and sealed to the people attuned; and a PUBLIC Echo, found in Discover and readable by anyone including us — we say so — where nobody can see who is attuned and every read and post rides an anonymous token, never your account. A group admin can attune a whole group to a private Echo; each member can fade with one tap and that choice is remembered.
The phone in your hand is part of the threat model.
A short checklist, in order of what matters most. 1) Your twelve words ARE the account: keep them offline, never in a screenshot, never in a cloud note — anyone holding them is you. 2) Turn on App Lock, so a lost or borrowed phone shows nothing. 3) Verify the safety number with the people who matter, in person or by voice, once. 4) If you might be forced to unlock, set a Second passphrase and decide what it shows — read its one honest limit when you set it. 5) Leave requests from strangers unanswered; ignoring them tells them nothing. 6) On a shared or risky network, remember the relay never sees your words, but it does see that your device connected; calls flow peer to peer. 7) When a device is lost, revoke it from Settings → Devices on any other device you hold. 8) Diagnostics exports carry no message content — they are safe to send us when something breaks.
App Lock is in Settings: unlock Spojiti with Face ID, Touch ID or your fingerprint, with the device passcode as fallback and your recovery phrase as the last resort. The message database itself is encrypted at rest (SQLCipher) regardless.
If you are made to unlock this phone: Settings → Second passphrase. You choose a second passphrase and mark which conversations may be seen under it. Unlocking with that passphrase opens a separate, real session holding only those conversations — nothing is faked and nothing is destroyed; your real store stays sealed and is never opened, written to or timestamped while that session is active. Every copy of Spojiti carries two encrypted stores from first run, so having one proves nothing about you. The honest limit, said once: if someone knows you talk to a particular person and that person is absent from what they see, this does not save you. App Lock (closes the database and drops the key) and revoking a device from Settings → Devices are the other two tools. Never paywalled, on any tier — safety is not something we sell.
Protect my content (chat ⋮ menu) lets YOU decide what happens to what you send: block saving, copying and forwarding of your messages and media on the receiving side. Consent over your own content is free — it is a safety control, and safety is never paywalled.
Two separate things: as a SENDER you can protect your content, and the recipient’s device blocks capture of it whatever their tier. Taking screenshots of your own chats is unlocked from Pro. Honesty note: iOS does not let any app truly block screenshots, so where blocking is impossible we say so instead of pretending.
Notifications are under Settings → Notifications: choose All, only when the app is closed, or Off — and toggle message previews separately. Pushes that wake the app carry NO content and no sender: the words only ever exist decrypted on your device.
Notification cards can show the sender’s photo in Spojiti’s scalloped frame — decrypted in memory on YOUR device from your own sealed store; the push itself still carries nothing. Prefer plainer cards? Settings → Notifications → Sender photo, off.
The Notification Centre (bell icon) keeps a first-in-first-out history of recent cards, so a dismissed banner is never a lost message. It reads from your device only.
On iPhone, check three things: iOS Settings → Notifications → Spojiti (allowed, banners on), Spojiti’s own Settings → Notifications policy, and Focus/Do-Not-Disturb. A freshly installed build needs one app open to register for pushes. If cards show without message text, that is the previews toggle — ask me about “rich previews”. Still stuck? Settings → Diagnostics exports a content-free log that pinpoints it.
On Android the usual thief is battery optimization: exempt Spojiti (Settings → Apps → Spojiti → Battery → Unrestricted) so the system does not strangle the connection. Check the notification channel is enabled and no Focus mode is filtering. Spojiti’s transport self-heals aggressively, but no app can outrun a system that puts it to sleep.
Keeping your history yours, and the app current.
Settings → Backup exports an encrypted archive that only opens with the SAME recovery phrase — useless to anyone else. Restore it from Settings on any device after entering your phrase. Manual backup and restore are free (recovery is never sold); Pro+ adds automated encrypted relay backup and per-chat export.
Chat export (Pro+) writes your conversation out on-device, under your control, for your own keeping — the relay is never involved and never could be, since it holds no history to export. Your data was always yours; export just hands it to you in portable form.
Settings → Backup & restore → Storage on this device shows what Spojiti weighs here — the encrypted database, media, files, profile pictures — all measured as the sealed bytes the disk actually holds. Compact rebuilds the database so space from deleted and expired messages returns to your device. Nothing about your chats changes.
Settings → Diagnostics can export a session log to help troubleshoot — it lives on your device, contains no message content and no PII, and is only ever shared if YOU choose to send it. Nothing is ever uploaded on its own.
Security-critical updates are enforced: the relay can require a minimum app version, so a device missing a protection cannot quietly keep talking as if it had it. About in Settings shows your exact version and build.
What is free forever, what each tier carries, and how paying stays anonymous.
Free is a complete private messenger: sealed chats and groups, voice notes, stickers and GIFs, polls, search, stories viewing, honest receipts — and every safety and privacy protection. Pro adds calls, media sending, view-once, location pin, vanish-delete, and seeing & controlling online status and last-seen. Pro+ adds a second device, story posting, live location, export, backup automation and the full call toolkit. Plans in Settings has current pricing — or see spojiti.world/subscribe.
Free is a complete, safe messenger: sealed chats and groups, voice notes, GIFs and stickers, polls, disappearing messages, honest read receipts, encrypted calls with post-quantum protection, App Lock, on-device search — the full security architecture, forever. What Free does not include: sending media, view-once, location sharing, presence controls (Free always shows its own presence, and does not see others’), and the Pro+ expression set. Full comparison: spojiti.world/subscribe.
Pro adds the everyday conveniences: send photos, files, and camera shots; set your avatar; view-once messages; pin your location; see others’ online status and last-seen, with full presence controls over your own; and vanish-without-trace delete — your unsend removes the message from the other side without leaving a tombstone. Details and pricing: https://spojiti.world/subscribe.
Pro+ is the expression tier: post stories, share live location, chat export, encrypted relay backup, call noise cancellation, and caller-identity privacy. Everything in Pro is included. As always, nothing in Pro+ is a safety feature — those are free for everyone. Current pricing lives at https://spojiti.world/subscribe.
Every new account starts with a welcome Pro+ trial — the whole toolkit, unlocked, minted once at registration with no card and no identity attached (we could not attach one if we tried). When it lapses you keep everything Free includes, which is the entire private core.
Current prices always live at https://spojiti.world/subscribe — I keep numbers off this device on purpose, so an old app version can never quote you a stale price. What I can promise here: a real free tier forever, and paid tiers that buy convenience, never safety.
Subscriptions use blind signatures (an open IETF standard): the relay can verify your device holds a valid subscription without ever learning which purchase — or which person — it came from. Even at checkout, we cannot connect money to messages.
Send a payment REQUEST card in any chat (free): the other person taps it to pay through their own UPI app, and can mark it paid. Spojiti never touches the money and never sees the transaction — we just carry the sealed card.
Your plan’s remaining time shows as a live countdown ring on the Plans screen, down to the minute near the end, with a renewal nudge in the final days. Timing is tracked in month-grain windows on purpose — exact expiry seconds would make you more identifiable, and even our billing protects the crowd.
Iron rule, written into how we build: safety, privacy, and cryptographic strength are NEVER paywalled. Free gets the same double ratchet, the same post-quantum protection, the same zero-knowledge relay, App Lock — everything that keeps you safe. Paid tiers buy convenience and expression: media, stories, live location, presence controls. Never protection.
The official chat, the assistant, and the rest.
This is the official Spojiti channel, key-verified by the app itself. Right now your questions are answered ON YOUR DEVICE from a built-in help guide — they are not sent anywhere to be read. A smarter assistant for free-form questions is coming, and it will say clearly what changes before it does.
I am :Spojiti — the product’s own guide, and I am not an AI model. Every answer I give is written in advance by Spojiti’s CTO and stored ON your device: no model is consulted, your question is never sent anywhere to be answered, and I work in airplane mode — try it. When the answer is not in my book I say exactly that and point you at the full guide, instead of guessing.
Calm mode (Settings) freezes ambient animation, dims the glow and stills moving text — built for motion sensitivity and migraine, free because accessibility is never a tier. The system reduce-motion setting is honored on top.
Settings → Appearance follows your system theme or pins dark / light. More palettes — including low-stimulation ones — are on the roadmap, and they will be free when they land.
Spojiti speaks multiple languages — pick yours in Settings. Translation of the app is local; nothing you write is ever sent anywhere to be translated.
Spojiti runs today on Android, iPhone and Mac, with one identity model everywhere. Windows and a desktop web experience are on the roadmap — honestly not here yet, and we would rather tell you that than promise a date we might miss.
We want it: write to spojiti@spojiti.world, and attach a Diagnostics export (Settings → Diagnostics) if it is a bug — the log is content-free and PII-free by construction, so sharing it costs you nothing. Every report is read by the people who actually build this, because there is no one else.
The roadmap is honest and alive: free-form assistant answers, desktop for Windows, deeper theming, contacts portability, and a long privacy audit trail we publish as we go. No dates promised here — a date I might miss is a small lie, and this channel does not tell those. Announcements land at spojiti.world.