How theSHFT works, in detail.

Direct messages

A new chat starts with X3DH key agreement, using identity keys, signed prekeys and one time prekeys, so it works even when the other phone is offline. From then on the Double Ratchet gives every direct message its own key, so one leaked key doesn't open earlier or later messages. The cipher is NaCl box: Curve25519, XSalsa20 and Poly1305.

Post quantum layer

Direct messages are wrapped in both Curve25519 and post-quantum ML-KEM-768 (NIST FIPS 203) whenever the recipient's device has published a post-quantum key; an attacker then has to break both. A device without one gets a classical Curve25519 session. Group chats and calls don't have this layer.

The ML-KEM-768 code is the PQClean reference C library, compiled natively on iOS.

Group chats

Groups use the Sender Key protocol over X25519. When someone joins or leaves, each member moves to a new sender key before their next message.

Calls

Voice and video calls are end to end encrypted with AES-256-GCM through Agora. The two phones agree on the call key over X25519. Calls use classical cryptography only.

Padding

Before encryption, message text is padded with random bytes up to a multiple of 256 bytes, so the size of a message gives less away.

When the countdown starts

A timed message starts its countdown when it is read, on your phone and on theirs. Our server stamps the expiry when it sees the read. In a group, each member's copy counts down from when that member reads it.

Timer lengths

New chats start at 10 seconds. Free accounts can pick Off, 10 seconds or 30 seconds. Pro adds everything from 5 seconds up to 24 hours. Either person can change a chat's timer and the other side follows.

Messages nobody opens

If a timed message is never opened, your copy leaves your phone 72 hours after you send it, and in a group an unread timed message is removed 72 hours after it was sent. An unopened direct message waits on our server, still encrypted, for up to a year before cleanup removes it.

Legal holds

When valid legal process requires us to preserve specific messages, cleanup skips them. That's rare. Direct messages and group chats stay encrypted either way, and we don't have the keys to them.

Routing data

To deliver messages, our servers see who a message is from and who it's to, when it was sent and how big it is. They can't read your direct messages, group chats or calls. Your contact list lives on our servers too, so it comes back when you restore your account.

Notifications

Message notifications carry generic text, like "New notification", on your lock screen. Each push also carries a small routing payload that reaches Apple and our delivery provider. For calls, group adds, mentions and reactions that payload includes a username or group name. Message content is never in it.

Crash reports

Crash and stability reports go to Sentry after keys, tokens and account IDs are scrubbed out. They include your device model, iOS version, app version, session start and end, app hangs, and for a sampled 10 percent of sessions the names of the screens you opened. You can turn them off in Settings, under Privacy, with Send crash reports.

What the app never asks for

There are no advertising or product analytics SDKs in the app. theSHFT never asks for your address book or your location.

Link previews

A link preview is made on the sender's phone before encryption and travels inside the message, so the recipient's phone never contacts the linked site.