End-to-end encryption

End-to-end encryption (E2EE) is the reason we can honestly say only you and the people you message can read your conversations. This page explains what that means, how OvateChat does it, and how you can verify it yourself.

In one sentence: your messages are locked on your device with keys only your recipients hold, travel through our servers as unreadable scrambled data, and are unlocked only on the other person's device — so no one in between, including us, can read them.

The idea

Most apps encrypt messages in transit to the company's servers — but the company can still read them there. End-to-end encryption goes further: the message is encrypted for the recipient the moment you hit send, and can only be decrypted by the recipient. The "ends" are the two devices; everything in the middle only ever sees ciphertext.

How it works in OvateChat

1 · Keys on deviceWhen you set up OvateChat, your device generates your encryption keys. The private keys never leave it.

2 · Public keys sharedOnly the public halves are uploaded, so others can start a conversation with you — like publishing an address that only you hold the key to.

3 · Locked & sentYour app encrypts each message for the recipient's keys. Our server relays the scrambled result.

4 · UnlockedOnly the recipient's device can decrypt it. The server never holds the keys.

Built on advanced, proven encryption

OvateChat uses advanced, independently-audited end-to-end encryption of the kind the world's most trusted private messengers rely on — for all one-to-one and group messages, calls and files. Two ideas do the heavy lifting:

A secret only the two of you share is established the first time you connect, using keys your devices published in advance — so you can message someone securely even if they're offline.
A fresh key for every message. This provides forward secrecy (a key compromised today can't unlock yesterday's messages) and self-healing (the conversation re-secures itself going forward).

For the technically curious: your device publishes only public keys; a sender fetches them to set up the shared secret, and from then on every message is locked with a new key. Our servers only distribute those public keys and relay encrypted envelopes.

What is protected

End-to-end encrypted

Text messages
Photos, videos and files
Voice notes
Shared & live location
Group messages
Your optional cloud backup (encrypted with your own key)

Not message content

Operator announcements — the read-only "OvateChat" channel is a broadcast from us, so it isn't E2EE (and the app labels it as such).
Some routing metadata — to deliver a message and show receipts, our server necessarily handles which devices are involved and when. We keep this to the minimum and don't retain the content itself.

Zero-knowledge — and the trade-off

OvateChat holds no copy of your private keys and no "master key." There is no key escrow and no back door. This is what makes your messages genuinely private — but it has one honest consequence:

If you lose your recovery phrase, no one — including us — can restore your account or messages. Please store your recovery phrase somewhere safe when you set up the app.

Encrypted on your device, too

Encryption doesn't stop at the network. Your message history is stored in an encrypted database on your device, unlocked from your device's secure storage. If encryption can't be enabled, OvateChat refuses to store your messages in the clear rather than fall back to plaintext.

Don't just trust us — verify

You can confirm that your conversation is encrypted directly with the right person, with no one impersonating them in the middle, using a Safety Number:

Open a chat and tap the contact's name to open Contact details.
Tap Verify Safety Number.
Compare the number (or scan it) with your contact in person or over another trusted channel. If they match, your session is verified end-to-end.

Why it matters

Private conversations are a basic expectation, not a premium feature. Because OvateChat can't read your messages, we can't hand them over, lose them in a breach of our servers, mine them for advertising, or train anything on them. Privacy isn't a setting here — it's the architecture.

Want the technical details?

For the full picture — how keys are kept, exactly what our servers can and cannot see, and our honest limitations — read the Security overview.

Read the user guide → · Privacy Policy → · Security overview →