SimpleX Chat

SimpleX's claim is narrow and absolute: it says it is the first messaging network with no user identifiers of any kind — no phone number, no username, not even a random number — and everything else it offers follows from that. Its home page puts the promise as being free in your network, and says each contact and group lives on your device rather than in a server's database. It is open source, anyone can run a server, and the company says large channels and communities will pay for theirs so that the project can stay independent. Its own scale claims are modest beside the rest of this batch — more than two million downloads is the figure it gives — and the funding comes from investors, donations and an equity crowdfunding round rather than from users.

You connect by sending someone a one-time invitation link or a QR code, and the link holds only public keys and works once, which is what makes it safe to send over any channel at all. If you would rather be reachable without handing out a fresh link each time, you use an address instead; either way the other side has to ask your client before a connection is made, and you can refuse. Both parties must be online at the same moment to complete that first connection, which is the price of having no server-side identity, and once it is made neither has to be present at the same time to talk. Groups run on five roles from owner to observer, and the app exists for phones, desktops and the command line, with optional self-hosted servers and Tor support.

Nothing is sold today: there is no price list and no paid tier, and the app is free on both stores. What is unusual is that the company says so as a temporary state rather than a principle. Its FAQ calls the business model a work in progress, sketches a planned freemium model and does the arithmetic in public, and its policy says the intention is to charge for optional features in a transparent and fair way. The Play listing already carries an in-app purchase range with no items attached to it, which is the only hint of what may be sold. Money today comes from private investors and venture capital alongside donations, and the company is running an equity crowdfunding round for anyone who wants a stake in the unfinished plan.

The age floor is 13, stated in the conditions of use with the caveat that it may be higher where you live, and no age gate is described anywhere. Encryption is set out in more detail than on any other platform in this batch — a double ratchet with forward secrecy, messages padded to a fixed size so that their length reveals nothing, files split into chunks — and the company's claim is that servers cannot decrypt content or even see the size of what passes through. Retention is published with numbers rather than assurances: messages are irreversibly removed from the preset relay servers as soon as they are delivered or after 21 days, files after 48 hours, with the honest caveat that other operators may keep logs. The metadata statements carry both halves, which is rare. Preset servers do not log the IP addresses of the devices connecting to them, and the same policy says servers can temporarily store data that could link to a device, including IP addresses and location, and that hosting and network providers keep their own logs. Two disclosures cut against the marketing and are worth quoting: the company's push notification server can see how many message queues a device has notifications enabled for and roughly how many messages each receives, and a directory bot stores search requests and the contents of groups registered with it. Abuse is handled architecturally rather than editorially, since nobody can contact you without an invitation, and operators who cannot read messages can still remove links and files from their servers. The project also publishes audits of both its implementation and its protocol design, which almost nothing else here does.

People who will not hand over a phone number or an email address, and who would rather have an address nothing can be found by than a username someone can search for. It suits anyone comfortable with manual backups and with one device per profile, since a second device cannot quietly take over the first, and it is aimed at the privacy-minded rather than the casual: setting up a conversation means exchanging a link, and the first connection only completes if both sides are online together. The same design limits how you use it — one profile cannot run on two devices at once without disrupting conversations, and linking a phone to a desktop means having both on the same network to do it.

The strongest technical claim in this batch and the most careful accounting of what it does not cover. No identifiers, no central store, servers that cannot read what they carry — and then, in the same documents: a notification server that sees how many queues you have and roughly how many messages arrive, a directory bot that keeps what is asked of it, and relay operators who may log what the preset servers do not. Set against the marketing, those sentences are what make the rest credible, because a platform making a smaller claim and keeping it is worth more than a larger one left vague. The retention rule is published in days rather than in assurances, the audits are named and dated, and the business model being openly unfinished is the last honest thing on the page: nothing is being sold yet, and the company says what it intends to sell when it starts.