Security in layers.
Privacy you can verify.

Key change notices

If a contact’s safety code changes, for example because they moved to a new phone or reinstalled Yupzap, your chat with them shows a notice. Every key change is also written to the public log, so a key cannot be swapped quietly. If something feels wrong, compare safety codes again before you share anything sensitive.

Proof of deletion

Once a message has reached every phone it was sent to, the Yupzap server deletes its copy. Guardian then writes a receipt for that deletion into a public log. Your phone checks the receipt against the log on its own and updates Message info to show “Removed from Yupzap servers, verified”.

While a message is still waiting for a phone, for example because the other phone is offline, Message info shows “Removal pending”. Guardian never shows a removal that has not happened.

A public log that can only grow

The log is append-only. A line, once written, cannot be edited or removed without it showing. The log is regularly sealed with a signed summary that covers every line written so far.

Independent witnesses keep their own copies of these signed summaries. If anyone ever tried to show one version of the log to you and a different version to someone else, the copies would no longer match and the change would be caught. You do not have to take our word for it: you can check it yourself. The record only shows that a copy was deleted, never what the message said.

What the log contains

• A fingerprint of each deletion receipt. A fingerprint cannot be turned back into a message.
• Key change records, made from public keys only.
• The time each record was added.
• Signed summaries of the whole log, which the witnesses copy.

What the log never contains

• Messages, photos, voice notes or any attachment.
• Names, usernames or phone numbers.
• Who talked to whom, or when a particular person was online.
• Contact lists, locations or IP addresses.

Hidden sender

For one-to-one chats, who sent a message travels inside the encrypted message, not on the outside of the envelope. Yupzap delivery servers see where a message needs to go, not who wrote it. The other person’s phone learns who sent it only after opening it.

Reporting that works with encryption

Encryption does not stop you from asking for help. When you report a message, your phone sends Yupzap a copy of that message together with a proof that it really arrived in your chat. Reviewers can act on genuine reports, and a message cannot be forged to get someone else into trouble. Only what you choose to report is shared. The rest of the conversation stays locked.

Hardware-locked keys and backups

Your Guardian keys are created on your phone and kept in its secure hardware where your phone supports it, so they cannot simply be copied off the device. If you turn on a backup, it is encrypted on your phone before it is uploaded, with a key that Yupzap does not hold.

Tamper-checked app

Before Guardian sets up keys or connects a call, it checks that it is running inside a genuine Yupzap app installed from an official app store, on a phone that has not been tampered with. This makes it much harder for a modified copy of the app to pretend to be you or to listen in.

What Guardian protects

Guardian protects one-to-one chats and one-to-one voice and video calls. Public posts, profiles, Zaps and Loops are shared on purpose and follow their audience settings. No encryption can protect a message on an unlocked phone, or stop the person you send it to from keeping a copy, so keep a screen lock on and share with care.

Requests for your messages

Because Yupzap does not hold the keys to Guardian chats and calls, no request, from anyone, can get readable message content or call audio from us. Basic account information is handled as described in our Privacy policy.