Operalytix Private chat. No phone number. An end-to-end encrypted messenger for iPhone with post-quantum key exchange, Tor transport and relays you do not have to trust.
No account, no e-mail, no directory. Your identity is created on your phone, your messages travel through Tor in sealed envelopes of one fixed size, and the code is open source.
Why Operalytix
A messenger that treats every server as a possible adversary, and says plainly what each one still learns.
No phone number, no account
Your identity is a set of keys created on your phone, backed up by a 24-word recovery phrase that never leaves it. People add you with a contact code you choose to share. There is no directory to search.
Hybrid post-quantum messages
Message keys are agreed with ML-KEM-1024 together with classical P-384, and signed with ML-DSA-87 together with Ed25519. Someone recording traffic today has to break both halves to read or forge it later.
Relays you don’t have to trust
Relays store fixed-size sealed envelopes in mailboxes that change over time. They never see message content or who sent a message, and the app reaches them through Tor. Anyone can run one.
Features
A complete messenger, built around privacy.
Chats, groups, calls and attachments, with the controls you would expect, and some you might not.
Chats and groups
One-to-one and group chats on the MLS standard (RFC 9420). Photos, videos, voice notes and files are encrypted too.
Voice and video calls
Encrypted calls for up to 4 people, routed through Tor by default. New keys for every call.
Disappearing messages
Set a timer per chat. Expired messages, their attachments and related call records are deleted from your phone.
Safety numbers
Compare a safety number in person or over another channel to make sure nobody sits between you and a contact.
App lock and duress code
Lock the app with Face ID, or with a passphrase of its own. An optional duress code erases everything at once.
Safety tools
Message requests, blocking, muting, a content filter on your phone, and reports that send only what you choose.
How it works
From your phone to theirs, sealed at every step.
Each layer protects something different, and each one is open to inspection.
Encrypted on your phone
MLS encrypts the message for the chat’s members with hybrid post-quantum keys.
Sealed and padded
It goes into a sealed-sender envelope of exactly 16 KiB. Relays can’t see the sender or the kind of message.
Sent through Tor
Every request to a relay uses its own Tor circuit and is sealed again for that relay.
Stored by a relay
The relay keeps the envelope in a mailbox for up to 14 days. Relays have no accounts, and the reference setup keeps no request logs.
Opened by the recipient
Their phone fetches it through Tor and is the only place it is decrypted.
What reaches a server
No messenger hides everything. Here is what Operalytix does and doesn’t.
We list what each party can still learn, so nobody relies on more than the code provides.
Protected
What stays private
Your messages, files and calls
End-to-end encrypted. Relays and we only ever handle encrypted data.
Who sent a message
Sealed-sender envelopes do not tell a relay who wrote them.
Your IP address, on message traffic
Relay traffic goes through Tor, so relays and network observers do not see your IP address on it.
Your history on a locked phone
The message database, keys and recovery phrase cannot be read from storage while the phone is locked. Notification previews, off by default, are the exception.
Still visible
What others can still learn
Relays see mailbox activity
Which of their mailboxes are read and written, when, and how many envelopes a message takes.
Push, if you turn it on
Push is off by default. When on, our push gateway holds your push token, and it and Apple see when pushes arrive.
Fast call mode shows your IP address
Calls go through Tor by default. If you choose fast mode, the call server’s operator sees your IP address.
Messages are signed
Anyone you write to can prove to others that you wrote a message. Operalytix offers no deniability.
Security status
Pre-release, and honest about it.
Two internal, AI-assisted security audits and a follow-up check found 204 issues. Most are fixed; the rest are being worked on. An independent human audit has not been done yet and is planned before version 1.0.
Pre-release software. Operalytix has not had an independent security audit, and most of its code was written by AI models. Do not rely on it where a failure could put people at risk. Read the security summary.
Open source
Read it, build it, run your own relay.
The app, the cryptographic core and the relay are free software under the GNU Affero General Public License v3.0 or later.
Inspect the code
Every source file carries its licence. The cryptography uses only established libraries, and the specification is part of the repository.
Open source and licenceRun a relay
Relays are untrusted store-and-forward servers. Anyone can run one, as a normal HTTPS server or as a Tor onion service.
How to run a relayDo I need a phone number or e-mail address?
No. There is no account. Your identity is created on your phone and backed up by a 24-word recovery phrase. People add you with your contact code, which you share yourself; nobody can look you up by phone number.
Which devices does it run on?
iPhone with iOS 26 or later. There is no Android, iPad, desktop or web version.
Can I use it today?
Not yet. Operalytix is pre-release software and is not on the App Store. A TestFlight beta is planned; the download page will link to it when it opens.
Has the code had a security audit?
Not an independent one. Two internal, AI-assisted audits and a follow-up check found 204 issues; 148 are fixed and reviewed and the rest are being worked on. An independent human audit is planned before version 1.0. Until it is done and published, do not rely on Operalytix where a failure could put people at risk.
Can relays read my messages?
No. A relay stores sealed envelopes of one fixed size and can neither read them nor see who sent them. It does see which of its mailboxes are read and written, when, and how many envelopes a message takes, and it could drop or delay traffic.
Are calls protected against quantum computers?
Only in part. The secrets for each call are exchanged with post-quantum protection, but call audio and video use WebRTC’s classical encryption (AES-128 inside DTLS-SRTP). Someone who records a call today and later has a large quantum computer faces only that classical layer.
Can someone prove I wrote a message?
Yes. Every message carries a signature, so anyone you send it to can prove to others that you wrote it, even after it has disappeared from your phone. Operalytix offers no deniability.
What happens if I lose my phone?
You can restore your identity on another iPhone with your 24-word recovery phrase; it then appears to your contacts as a new device. Without the phrase your identity cannot be recovered, so write it down when the app shows it.
Can I run my own relay?
Yes. The relay is open source and runs in a container. Put it behind an HTTPS reverse proxy or a Tor onion service, then add it in the app under Settings > Relays.
Private by design. Honest about its limits.
Operalytix is not available yet. Check the download page for the beta, or start with the security summary.
iPhone · iOS 26 or later · No phone number · Open source