Relim

Pre-release · Android and iOS

A messenger with nothing to hand over.

No phone number, no email, no account. Your identity is a key on your phone, and it stays there.

Download
No identifier
No phone number, email, name or address book. Signing up asks for one passphrase.
No telemetry
No analytics, no crash reporting, no advertising, no attribution SDK.
30 days
Undelivered mail expires on the relay. Collected mail expires on the same clock.
MIT or Apache-2.0
App, core and every server — run the whole stack yourself.

On your phone

  • Are you still at the station?16:31
  • Platform 4, the far end.16:32

On the relay that carried it

tag
a41d0c73 … 9b62 rotating, derived from a secret the relay does not hold
seq
4192
deposited_at
2026-09-07T16:32:08Z
blob
ciphertext, padded to a fixed size
Those four fields are the entire row a relay stores. There is no sender field and no recipient field, nothing is named, no key is held, and the row is deleted after 30 days whether it was collected or not. What an operator can still infer is written down rather than left out.

What it is, concretely

Four decisions everything else follows from

  • One encryption engine

    Message content, the files you send and call audio are all end-to-end encrypted. Every conversation — one-to-one, group and call media — runs on MLS, through the audited OpenMLS library; Relim implements no ratchet, no AEAD and no handshake of its own. The key exchange is hybrid post-quantum, so traffic recorded today cannot be opened later by a quantum computer.

    MLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519

  • The keys never reach the screen

    A Rust core owns keys, storage, transport and sync. The interface only renders what the core hands it, and key material never crosses into the UI layer. Your 24-word recovery phrase is generated on the device and is never sent to any server.

  • Minimal servers, not zero servers

    Relays hold encrypted mail for people who are offline and help two devices find each other. They are interchangeable and self-hostable, and a deposit on the wire is the rotating tag and the padded ciphertext above — nothing else.

  • Offline is a normal state

    You can write with no connectivity at all. “Queued” is shown as normal, not as an error, and it sends when a connection comes back.

The app

It looks like a messenger, and it tells you the truth about the network

Chats. Compare safety codes with the other person to verify a conversation — the app keeps asking until you have.
Network. Which relays you are on, what is queued, and what your wallet is doing. A switch here stops the traffic — it doesn't just change an indicator.

What works today

This is what the shipped app does, not what is planned

  • One-to-one and group text, with replies, reactions, edit and delete
  • Photos, files and voice messages
  • Disappearing messages, set per conversation
  • Safety numbersCompare a code in person to confirm you are talking to the right person, and not to someone in the middle
  • One-to-one voice calls
  • Group calls, up to 8 seatsThe newest thing here and the least tested — expect rough edges
  • Groups of up to 20 members
  • Tor and Shadowsocks, as optional per-feature transports
  • An optional, non-custodial Zcash walletRestored by the same recovery phrase as your identity
  • Delete everythingOne action that destroys the keys, and with them the data on this device
  • A network panelWhich relay you are on, whether your path is direct or relayed, and what is queued

What is not there yet

We'd rather you read this before installing than discover it afterwards

  • not yetOne identity is one device

    There is no device-linking flow. Relim's data model carries a device identifier from day one, but multi-device sync is not built — your account lives on one phone.

  • not yetNo message-history backup

    Your recovery phrase restores your identity and your wallet. It does not restore your conversations, your contacts or your message history — those stay on the device that holds them. If you reinstall, every conversation has to be set up again.

  • Push-to-talk channels, broadcast channels, and on-device transcription of voice messages
  • The VLESS/REALITY obfuscated transportTor and Shadowsocks ship; the traffic-shaping layer for heavily censored networks does not
  • A duress passcode that opens a decoy accountIt is designed and it is not built. The only destructive gesture that exists today is the explicit “delete everything”
  • Reproducible buildsWhat is honestly true about that
  • Interoperability with other protocolsThe driver slots exist; no other network is wired

Relim is not a finished product

It has not been through an external security audit. Treat it as software that is still being tested, not as something to trust a life with. If your safety depends on a tool, choose one that has been audited.

This page

Nothing on this page came from anywhere else

No web fonts, no scripts, no analytics, no embeds, no third-party images — and no JavaScript at all. The whole site is four pages, a not-found page and one stylesheet. The phones and the relay row above are drawn in CSS and SVG from the app's own colour tokens; nothing was fetched to render them.

A privacy policy claiming a site phones nobody is worth exactly as much as the site's ability to prove it. So the check that proves it lives in the same repository as these pages, and it runs over them.

Support

Questions, problems, feedback

Email k@alvorado.co. Tell us the app version (on the About screen), your phone and what happened. Relim has no account on any server, so there is nothing we can look up or reset for you — and a forgotten recovery phrase cannot be recovered by anyone.

Found a security problem? Please follow Reporting a vulnerability instead.

Read next