Drdesh Private beta Get the beta

Private messenger · iPhone & Android

The server forgets.

Drdesh encrypts your message on your phone, and our server keeps it only until your recipient's device picks it up. Then its copy is deleted. There is no readable history on our side — nothing archived, nothing we can open.

Get the private beta How a message travels

When the beta opens: TestFlight on iPhone · direct APK on Android · not in the app stores yet

  • Sign up with an email and an @username
  • Signal Protocol encryption, keys only on your device
  • No ads, no trackers, no analytics, no data sale

An illustration of the app, not a screenshot.

The whole idea

Our server is a corridor, not a warehouse.

Most messengers keep your conversation so they can sync it back to you. We decided not to have it at all. The privacy is in the plumbing, so you never have to think about it — but here is the entire journey anyway.

  1. Step one — your phone

    Sealed before it leaves

    Your message is encrypted on your device with the Signal Protocol, using Signal's own libsignal library. The keys that can open it exist on your phone and your recipient's phone. Nowhere else — we have never had a copy of them.

  2. Step two — our server

    Held, delivered, deleted

    What reaches us is ciphertext in a short-lived queue. We can't read it and we don't archive it: the moment the recipient's device collects the message, the server's copy is deleted. If someone seized the machine tomorrow, there would be no readable conversations on it — only ciphertext still waiting for delivery, which nobody there can open.

  3. Step three — their phone

    Opened only there

    The message is decrypted on the recipient's device and stored on it. Chat history lives on phones, not in a cloud, which is why the app can offer read receipts, replies, reactions and delete-for-everyone without us ever holding the conversation.

Our server's view

This is the whole conversation, as far as we are concerned.

Shape, size, sender, recipient, a timestamp — that is what a row in the delivery queue amounts to. The words are not redacted after the fact; they were never legible here in the first place, because the only keys that open them are on two phones we don't have.

A stylised illustration, not a screenshot. The message lines are blank on purpose: this is exactly as much of a conversation as our servers can see.

One honest caveat. A message we can't deliver — the other phone is off for a week — waits in that queue, still encrypted, until it can be handed over. Anything undelivered is deleted after 30 days at the latest. Our database is backed up nightly, so a message still waiting in that queue can sit in an encrypted backup for up to another 30 days — it is ciphertext there too. Profile details and your list of connections do live on the server, because the app needs them to work; the privacy policy spells out exactly what those are.

Encryption

Signal's protocol. Signal's own code.

We did not invent our own cryptography, and you should be suspicious of anyone who has.

Drdesh uses the Signal Protocol through libsignal — the library Signal publishes and maintains — vendored into the iOS app and pulled from Signal's own Maven artefacts on Android. Same ratchet, same forward secrecy, same deniability properties, no home-made layer wrapped around it.

Every device generates its own identity key pair. The private half never leaves the phone. The public half is published alongside your public prekeys, so someone can start a conversation with you while your phone is asleep — and so the two of you can compare safety numbers in person. A private key is the one thing our server has never been able to hold.

Notifications carry nothing

A push tells your phone that something arrived — not what. The payload is content-free; the text on your lock screen was decrypted on the device a fraction of a second before you read it.

Encrypted end to end

  • MessagesOne-to-one and group chats.
  • Voice and video callsOne to one, peer to peer where the network allows.
  • Photos and videoEncrypted before upload; the storage bucket holds noise.
  • Voice notesRecorded, sealed and sent like any other message.
  • Replies and reactionsSent as encrypted control messages, not server state.
  • Read receiptsSent inside the encrypted message payload, so we never learn what you have read.
  • Delete for everyoneAn encrypted instruction to the other phone to remove it.

One thing is deliberately not on that list: typing indicators. They are relayed live between two connected devices and never stored, never queued and never pushed — but unlike a message, the server routes each one, so it can tell that you are typing to someone.

The argument

A phone number is an identity document that happens to ring.

Handing one over is the default first step in almost every messenger. It is worth asking what you are actually handing over — and then noticing that there is no field for it here.

What we never ask you for

Phone number

Your contact list

What the account actually is

you@example.com

@yourname

An email, a handle, a one-time code. That is the entire sign-up. A stylised illustration of the form, not a screenshot.

  1. It isn't really yours

    You rent it from a carrier that knows your name, your billing address and your SIM. It can be ported away from you, and it can be handed over without you.

  2. It's the master key

    The same number resets your bank and your email, and it is short enough to guess. Every service you type it into is one more place it can leak from, and one more way an account gets matched to a person for good.

So we removed the field. There is no number to store, leak, sell or hand over — because it was never collected.

Getting started

Three steps. And no stranger in your inbox.

Three things stand in for a phone number, and none of them belong to a carrier.

  1. Enter an email

    Sign up with any address you like. We mail you a one-time code, you type it back, you're in. No SMS, no SIM, no carrier in the loop, and no contact-list upload.

  2. Pick your @username

    Your handle is your whole address here. It also has a plain link you can send anyone: drdesh.app/u/yourname

  3. Add people

    Look someone up by their exact @username, or scan their QR code in person — the one route that skips the request queue entirely.

@yourname My code
Scanned in person, a code is consent — the connection opens on the spot. A stylised illustration, not a working code.

A stranger cannot message you

Someone who finds your @username can send one request. Until you accept it, anything they send is dropped on the server — the consent gate is enforced there, not politely hidden in the app. The sender sees an ordinary single tick and learns nothing about you. Block them and their queued messages are purged immediately, and you can switch new requests off entirely.

The directory can't be crawled

@username lookup is exact-match only and rate-limited. There is no contact-book upload, no "people you may know", and no way to page through the user list.

An optional lock on your account

You can set a registration-lock PIN in Settings. After that, the PIN has to be entered before your account can be recovered on a new phone or its email address changed. It is hashed with argon2id and rate-limited hard — and we cannot reset it for you, which is the point.

Trade-offs, on purpose

What Drdesh doesn't do

A privacy product that only lists its strengths is hiding the bill. Here is what you give up by using this one.

One device at a time
An account lives on a single phone. Signing in somewhere new signs the old device out — deliberately, so that a second copy of your keys can't quietly exist. Multi-device is on the list; it is not in this version.
Your chat history doesn't move with you
Switch phones and you get your profile, your connections and your group memberships back. You do not get your old conversations, because they only ever existed on the old phone. Lose it and they are gone.
No cloud backup of your messages
The same trade, stated plainly. We cannot restore a conversation for you, help you into a locked account, or recover a forgotten registration-lock PIN. Convenience of that kind requires someone holding your data, and nobody here is.
Your profile photo isn't end-to-end encrypted
It has to be shown to people you connect with, so it sits on the server like your @username and display name. Everything you actually send inside a chat is encrypted.
We can still see some metadata
We know an account exists and the email address it is anchored to, plus its @username, display name and profile photo, when it connected, who it has accepted, and which groups it belongs to — the server has to enforce the consent gate. We never see message content, and we don't build profiles or sell anything. The privacy policy is specific about all of it.
It isn't in the app stores yet
Drdesh is in private beta. There is no App Store listing and no Google Play listing today, and we would rather say so here than fake a badge.

Availability

In private beta

The apps are built and running on both platforms. They have not shipped to the stores yet, and the beta is not open for testers yet either — write to us and we will tell you when it is. This is how the builds will reach you when it opens.

  • iPhone

    TestFlight

    A native SwiftUI app. When the beta opens, invited testers will get it through Apple's own beta service.

  • Android

    Direct APK

    A signed build you will install yourself, outside the Play Store. Android 8.0 and later.

Ask about a beta invite Read the privacy policy

Not on the App Store or Google Play yet. When that changes, this page will say so — and until it does, there are no store badges here to click.