Security

Privacy depends on both what we encrypt and what we choose not to keep. FlickerTalk uses established cryptographic protocols and libraries, keeps no activity logs and publishes its app and server source code for inspection.

Building blocks

• Messages: end-to-end encrypted with Olm (Double Ratchet), using vodozemac, the Matrix project's audited Rust implementation. In a circle, each member gets their own encrypted copy over the Olm channel they share with the sender.
• Transport: WebRTC between the phones (DTLS for data, DTLS-SRTP for calls); TLS to our server.
• Identity: an Ed25519 key per phone; every request to our server is signed with it.
• Keys at rest: sealed by the phone's secure key store (Android Keystore, iOS Keychain). When you move to a new phone, they travel directly between your two phones over an encrypted connection, never through our servers.
• Server: push tokens encrypted with a key kept outside the database; the mailbox holds only end-to-end encrypted messages and is never backed up.

No trackers

No advertising, analytics, third-party crash-reporting services or activity logs in FlickerTalk. This website also uses no cookies or trackers and keeps no access logs.

Threat model

FlickerTalk is designed to protect against a breach of our database, anyone running our servers reading chats, central collection of messages, exposure of a cloud history (there is none), and push services reading messages.

It cannot fully protect against a compromised phone or operating system, malware, screenshots, the people you write to copying messages, someone holding your unlocked phone, or network metadata held by third parties. How it works lists who can see what.

Open source

The app and the server are published under the AGPL-3.0 licence.

Report a security issue

Please report suspected security vulnerabilities privately through the app or server repository's “Report a vulnerability” option, or by email to info@flickertalk.com.

Include the affected version and steps to reproduce the issue where possible. Do not include private conversations, private keys or other people's personal information.

We do not keep activity logs and cannot reconstruct a user's past conversations or connections.