Sealwire

Why another messenger

Encryption is not the hard part any more; several messengers do it well. What still goes wrong is everything around it. A message is encrypted in transit and then sits in two phone backups, in two chat histories, and in whatever a forensic tool can pull off a seized handset. That is where messages are actually read, and no amount of encryption addresses it.

Sealwire is built for the few messages that must not become anyone's archive: a privileged document, a medical image, an unreleased design, something personal. You keep your usual messenger for everything else. This is the sealed envelope beside it.

What it does

Shown, never delivered	A message becomes pages on the sender's phone. The reader's phone fetches one page at a time and holds it only while it is on screen. No message, image or document is written to storage, so there is no file to find afterwards.
The window belongs to the sender	One look, a few minutes from first open, a day from sending, or until recalled. The rule is enforced on the relay: when it closes, the pages are deleted there. Expiry is a fact of the server, not a setting in an app.
Recall, even after opening	The sender can revoke at any moment. The next fetch finds nothing.
No history, anywhere	Nothing scrolls back, because no message is kept. No backup, no export, no archive tier, ever. The only thing the app stores is the encryption key material each conversation needs to continue: a small file, encrypted with a key held in the phone's secure hardware, carrying no names and no text.
No identifiers	No phone number, no email. An account is a random identifier and a key generated inside the phone's secure hardware. Contacts arrive by a QR code in the room or a single-use link.
Nobody can reach you uninvited	There is no directory and no cold contact. Images and documents need the recipient's explicit consent, per person, per direction.
Captures come out black	Screenshots, screen recordings and casting are blocked by the phone itself on both systems.
Filmed pages carry a signature	Every page is marked for the person reading it, so a photograph of a screen names its source.

What the relay holds

One machine in Canada, administered by us. It holds encrypted pages for the length of their window, public keys, and random identifiers. It has no message table, no conversation table and no contact graph: the row that says who sent what to whom is deleted with the page.

The client will be open source with published builds, so the claims on this page can be checked rather than believed. A warrant served on us produces what exists, and what exists is described here in full.

What it cannot do

Every messenger's marketing stops before this part. Ours does not.

A second camera. Nothing stops someone photographing a screen with another phone. The page signature is the answer to that, not prevention.
A phone that is already fully compromised. Spyware with system-level access can read the one page on screen. No application can close that; short windows and no history keep it to one page instead of a history.
The fact that a message happened. The relay sees an address connecting and the timing. Apple's notification service sees that an empty notification went to a device, never its content.
Offline reading. There is nothing stored to read offline. That is the point, and it is a real cost.
Perfect invisibility on a seized phone. No messages are stored, but the encryption keys a conversation needs are, in encrypted form. An examiner with your unlocked phone could tell that you have conversations, though not with whom by name, how many messages, or a single word of them.

The messenger that keeps nothing.

Why another messenger

What it does

What the relay holds

What it cannot do

Deliberately absent

Price