FlickerTalk
How it works
FlickerTalk is designed to deliver conversations without keeping a history of them. Your chats live on your phones. Our servers provide the minimum coordination needed to connect devices, send wake-up notifications and temporarily hold encrypted messages that cannot yet be delivered.
We keep no activity logs. Below is exactly what the service processes, what it stores and what other parties can still see.
Your identity
When you open FlickerTalk for the first time, your phone creates your cryptographic identity: a pair of keys. Your private key is protected by the phone's secure key store (Android Keystore or the iOS Keychain); we do not hold a copy on our servers. The only time it leaves your phone is when you move to a new one with “Move to a new phone”, and then it travels directly between your two phones, over an encrypted connection, never through us. Your FlickerTalk ID is derived from the public key, which lets the service and your contacts recognise your device without an email address, phone number or password.
You add someone by scanning the code on their screen or opening the link they share. That code is a contact card signed by their key. We have no directory of users and never see your address book.
Sending a message
A message is saved on your phone first. If the other phone can be reached, it goes straight there over an encrypted WebRTC connection, and it is also encrypted end to end with the Olm protocol (a Double Ratchet, from the Matrix project's audited vodozemac library). The other phone saves it and confirms, and only then is it marked as delivered.
When the other phone is off
Our server wakes the other phone with a push notification that carries no message and no sender: only “wake up”. If a direct connection is still not possible, the message goes to the recipient's mailbox on our server, encrypted end to end so that we cannot read it. It is deleted as soon as the recipient picks it up, and after 7 days at the latest. The mailbox keeps no sender and is never backed up.
The mailbox is on by default. Either of you can turn it off in Settings; then messages wait on the sender's phone until the two phones can talk directly.
Files and calls
Files and calls never go through the mailbox. They travel over the direct connection between the phones, or through our relay when a direct path is impossible, still encrypted.
In a circle
A circle is a small, closed group of contacts, up to 32 members. Its member list, with its admins, is signed by an admin and travels end to end encrypted to every member. Nobody can add themselves: only an admin adds or removes members.
A message in a circle is saved once on your phone and sent to each member separately, as its own end-to-end encrypted copy, by the same paths as any other message: directly, or through that member's mailbox when you both allow it. Our server sees separate encrypted messages that it cannot tell apart from one-to-one messages, and it keeps no record of circles or of who is in them.
Circles carry text only: no files, no calls and no read receipts. Someone who joins later does not see what was said before.
What our server keeps
| Data | Why | For how long |
|---|---|---|
| Your device ID and public key | To check that requests really come from your phone | Until you erase the phone in the app |
| A hash of your contact card's routing code | So that only your contacts can wake you or leave you mail | Same |
| Your push token, encrypted with a key kept outside the database | To wake your phone | Same, or until Google or Apple say it expired |
| Messages that could not be delivered, encrypted end to end | To deliver them later | Until picked up, at most 7 days |
Nothing else: no contacts, no circles, no conversations, no call history, no access logs and no history of IP addresses.
What others can see
- The person you talk to
- When your phones connect directly, each can see the other's public IP address: that is how peer-to-peer works. In Settings you can make calls always go through our relay, which hides your IP address from the other person during calls.
- Members of a circle
- Every member receives the contact card of every other member, so a member who is not your contact can write to you: their message arrives as a request, and they cannot call you unless you accept them. When a member's phone connects directly to yours to deliver circle messages, it can see your public IP address.
- Our relay
- When a direct connection is impossible, our relay carries the encrypted traffic. It sees the IP addresses of both phones and how much data flows, never the content, and it keeps no logs.
- Google and Apple
- They deliver the wake-up notifications, so they see that your phone got a push and when. The push never contains a message or who sent it.
- Our server
- It sees the IP address of a connection while it is open, to route it and to stop abuse. It does not keep it: the abuse limits use a salted hash that lives only in memory for a minute. If you send a suggestion from the app, it forwards the text to our mailbox without your FlickerTalk ID or IP address, and does not keep it.
- Your network provider
- Like with any app, your internet provider can see that you use FlickerTalk and when.
What no app can protect
FlickerTalk protects your conversations from our servers, from a breach of our database and from the push services. It cannot protect you from a phone that is compromised or unlocked in someone else's hands, from malware, from screenshots, or from the people you write to copying what you send.