Vault is a messenger with no server behind it. not a small server, not a federated one: none. there is no company to subpoena, no directory to query and no account to close, because none of those things exist in the design. it is built for people whose adversary is a state, and every trade-off is settled in favour of anonymity.
what it does not have
- no phone number, no email address, no username, no registration.
- no directory anyone can search, seize or fake an entry in.
- no analytics, no crash reporting, no telemetry of any kind.
- no plaintext anywhere but your own device.
how it works
on first launch your device generates a key pair, and your address is derived directly from it. address and public key are the same thing, so nobody can hand your contact a substituted key for an address they already know, however hostile the network is. there is nothing to look up because there is nothing to resolve.
traffic never leaves the device outside of tor or a local mesh, so neither side learns the other's ip address and an observer of the network cannot tell who is talking to whom. messages are encrypted end to end, the local database is encrypted at rest, and deleting really deletes: the key is destroyed, which makes the data unreadable regardless of what the flash chip still physically holds.
under the hood
a Rust core with hard boundaries between its layers: the crypto layer cannot do input or output at all, and the transport layer never sees plaintext. those rules are enforced by the build, not by discipline. no home-grown cryptography: only established primitives through established libraries. windows and linux come first, android alongside them, and ios with limits that will be stated honestly rather than papered over.
the design is settled and written down; the core is being implemented against it.
in developmentlicence
Vault is released under the PolyForm Noncommercial License 1.0.0. private, academic and non-profit use is free, including changes and passing it on, as long as the licence and the copyright notice travel with it. commercial use or distribution needs an agreement first: licence, commercial terms, [email protected].
privacy
Vault collects no user data. read the full privacy policy.