Windpost

What it does

Only the phones in a conversation can read it	Words, photographs, voice, video, documents and calls are encrypted end to end on the phone that sends them. The keys stay on the phones; the relay that passes everything on holds no key and cannot read a word.
Kept on your phones	Messages, photographs and documents are kept on the phones in the conversation, in a sealed store. The relay holds each one, sealed, only until every phone it is for has it — at most thirty days for a phone that is switched off — and then deletes it. An event album's photographs stay until thirty days after the event closes.
Nobody can find you	There is no directory, no search, no phone number and no way to be contacted by a stranger. A contact starts from a code or a link handed over by a person, and a family or group is joined only by an invitation from someone already in it.
For adults only	Everyone making a Windpost account is asked to confirm being 18 or older. There are no accounts for children: children appear in photographs, never as users.
Families and groups	A family or a group, with smaller circles inside it. Must-read messages that each person answers with Got it, and anyone in the family can be messaged or called directly.
Albums that are kept	A photograph or a video sent to a family goes into its album unless the sender chooses “just for the chat”, and stays on the family’s phones; photographs go at full size. A baby album adds ages and milestones; an event album lets guests share photographs until a closing time.
Plans made together	In a family or a group: polls where everyone sees who chose what, events with Going, Maybe and Can’t and a reminder on your phone, and birthdays shared with your families only if you choose to. An @ and a name tells that one person.
Admins keep order	The owner and admins of a family or group can pin up to three messages, write a few lines about it, choose how long its messages stay, and make a chat where only admins write. In a family, Help me and SOS always get through.
Everything can be exported, free	A family, a group or a chat can be saved as one ZIP that opens on a computer without the app. A chat's export leaves out view-once messages and anything the sender did not let you keep. The screen says so before you make it: a copy outside Windpost is not sealed.
You choose what does not stay	Disappearing messages, per conversation: off, a day, a week or a month, on both phones. A photograph, a video or a voice message can be sent view once: it opens one time and is then gone from both phones.
You can take a message back	Delete for everyone removes your message from your phone and from the other phone, even after it has been read. It cannot reach a copy that was already saved or photographed.
You can check who you are talking to	Sixty digits or a QR code, compared once in a room. If a verified key ever changes, the app says so plainly rather than carrying on quietly.
Calls that do not give away where you are	Voice and video calls, phone to phone, with up to five people. Every call passes through a forwarder that holds no keys, so neither phone learns the other’s address, and nothing said is recorded anywhere. During a call, a heart or a laugh can float up on everyone’s screen; a call nobody answers can be followed by a voice message; and Recent calls lists the calls kept in your conversations.
Safety, sent and never taken	Share where you are once, or live for a time you choose while Windpost is open. Ask for help, or hold SOS for two seconds. Nobody can turn your location on for you, nothing is shared in the background, and Windpost does not call emergency services. If someone is in danger, call your local emergency number.
Getting back in after a lost phone	Turn on a recovery code or family recovery, and a sealed backup of what the phone keeps goes to the relay, which cannot open it. A new phone gets it back with your recovery code, or with two of the relatives you chose and a day’s wait that any of you can stop.
Documents, as real files	PDF, Word, Excel, PowerPoint, Pages, Numbers, Keynote, OpenDocument and CSV, up to 500 MB. Pages can be scanned into a PDF with Windpost’s own scanner, and My documents keeps your own papers sealed on your phone only, never on the relay and never in the backup.
Big files, trimmed videos, moving photographs	Documents and videos up to 500 MB, in chats, families and groups: sealed on your phone in pieces and sent a piece at a time, so a dropped connection is waited out and carries on where it stopped, and a send can be stopped. A video of up to thirty minutes can be trimmed before it is sent. A moving photograph taken on an iPhone or an Android phone goes with its few seconds of movement, which play while it is held, and a round video note of up to a minute is recorded in the chat like a voice message.
A signature that shows a change	Sign a PDF with your finger, or seal it with a digital signature made from your own key: a PDF reader can then tell whether it changed after it was signed. It is not a certified signature.
A message can be fixed	Your own words can be edited for a day after sending. Both phones show the new words as edited, and the earlier words are not kept.
Chats that keep up	Copy, forward, pin up to three messages for both of you, star messages on your own phone, and search a chat on the phone itself, where nothing is sent. Words can be bold, italic, struck through or monospace, a reaction can be any emoji, a message can be up to 20,000 characters, and every photo, video, document and link of a chat is on one page. A view-once message is never forwarded, and neither is anything the sender did not let you keep.
Link previews made by the sender	When you send a link, your phone fetches its title and a small picture and sends them sealed with the words; the phone that receives it never contacts the site. A tap on a link shows the real address and asks first. Previews can be turned off in Profile and chats.
Keep what matters in a disappearing chat	In a chat whose messages disappear, either of you can keep a message past the timer on both phones, and its sender can let it go again. New chats can start with a timer you choose, and notes about a contact stay on your phone and are never sent.
Where you are, in a chat too	In a one-to-one chat, share where you are once, or live for 15 minutes or an hour while Windpost is open. Only you can send it, nothing is shared in the background, and SOS and Help me stay with families.
Introduce one relative to another	From a contact's page, or a chat's +, introduce one contact to another. The person introduced is asked first, on that person's own phone, and only a yes makes a one-time invitation, valid for a day. No phone number is shared.
Search every chat, on the phone	Words, captions and documents' names are found across all your chats, families, groups and notes, and a tap opens the message. The search runs on your phone over what it keeps; nothing is sent and nothing typed is kept.
Opens without a connection	On a plane or in a basement, Windpost opens with your chats, families, albums and documents as this phone keeps them, and joins the relay when the connection comes back.
A lock of its own	Windpost can ask for your fingerprint, face or phone PIN before it opens, and single chats can be locked away from the list. The phone does the asking: no fingerprint, face or PIN reaches the app.
Notes to yourself	A chat with yourself for words, photos, voice and documents, kept sealed on this phone and never sent.
A backup you hold yourself	The sealed backup can be saved as a file on your own computer or drive, and brought back with your recovery code.
Screen readers and large text	Buttons and pictures have names your phone's screen reader can say, in your language, and a new message in the open chat or a call that connects is said aloud. Words follow your phone's text size and the main screens still fit at twice the size, every colour look keeps words clear against the background, buttons are big enough for a finger, and Windpost keeps still when your phone asks for less motion.

What it cannot do

Every messenger's marketing stops before this part. Ours does not.

What your family keeps. Anything you send can be kept by the person you send it to: screenshots are allowed, and photographs and documents can be saved at full size. Windpost keeps what your family says away from servers and the companies behind them — not away from each other.
A voice message, recorded by somebody in the room. Another phone in the room can record a voice message as it plays, like any sound. View once, disappearing messages and Delete for everyone work on a voice message as on anything else; none of them reaches a recording.
A video, while it is being made ready. A video picked from the library is made 720p by the phone before it is sent, and so are a video note and a moving photograph's few seconds — and neither Android nor iPhone will do that anywhere but a file. That file is the app's own, in its own cache, and it is deleted as soon as it has been sealed: seconds for a short video, a few minutes for a long one, which is sealed from the file a piece at a time. The video you chose is never moved or rewritten.
A big file waits on the relay. Large documents and videos, up to 500 MB, go sealed in pieces, and each waits on the relay until the phone it is for has fetched it: a week at most in a one-to-one chat, thirty days at most in a family or group. The relay cannot open one, but it does see how large each is: the padding that hides the length of a message does not hide the size of a big file.
A saved copy is an ordinary file. Once saved, a photograph or a document is a file like any other on that phone: disappearing messages will not close it and Delete for everyone will not reach it. A saved original is the sender's own file, exactly as it was sent.
An export is not sealed. An export of a family, a group or a chat is an ordinary ZIP: anyone who gets the file can open it. So is a copy sent to a computer, or saved through the phone's own share screen. The screen says so each time, before the copy is made.
Whoever holds your recovery code. Anyone with your recovery code can bring your account and its backup back on another phone, and so can two of the relatives you chose, together, after a day's wait that your phone can stop. Keep the code somewhere only you can reach.
A phone that is already fully compromised. Spyware with system-level access can read what is on the screen, and anything Windpost opens while it is there. No application can close that. Disappearing messages and view once leave less of it on the phone to be found.
The fact that a message happened. The relay sees an address connecting and the timing, and which accounts are in a family or a group together. It knows whether a message is words or a file, and is told which kind of file (a photograph, a voice message) only when the person receiving it asked for notifications that say it. On iPhone, Apple's notification service sees that a notification went to a device, never who sent it or what it says. On Android the phone keeps its own connection to our relay, and Google's push service is asked to wake it only when that connection is not open or does not answer within a few seconds. Calls, calls for help and account recovery warnings always ask Google too, so that nothing urgent is late. What Google is given has nothing in it: Google learns that a device was woken, and when.
What the relay keeps for a while. Besides messages on the way, the relay keeps a few plain facts, each only while it lasts: which of your chats you muted and until when, the time a message you chose to send later will go (the message itself stays sealed), and who an owner or admin kept out of a family or group. An account nobody has opened for 24 months is deleted, after a notification a month before.
Offline reading. Windpost has to reach the relay once, to make your account. After that it opens without a connection and shows what is already on the phone; nothing is sent, and new messages wait on the relay, until the connection comes back.
Perfect invisibility on a seized phone. Your history is kept on the phone, sealed with a key the phone's secure hardware holds for this app. Anyone who has your phone unlocked can open Windpost and read what is kept there, as with any messenger, unless Lock Windpost is on: then it asks for the fingerprint, face or phone PIN first. That stops someone who picks up an unlocked phone, not someone who can unlock the phone itself. My documents always asks first; disappearing messages and view once leave less to find, and Delete everything removes it all.

A private messenger for your family.

What it is for

What it does

What the relay holds

What it cannot do

Deliberately absent

Price