HomeChat

HomeChat is a secure messenger with full end-to-end encryption.

Private one-on-one and group chats — no channels, no public spaces.

Who HomeChat is for:
- Family and loved ones
- Lawyers, doctors, entrepreneurs
- Crypto traders
- Anyone who doesn't trust big platforms

PRIVACY

HomeChat encrypts everything — text, media, reactions, and call signals — directly on your device. The server does not store messages and never has access to your conversations. Decrypting data without the keys on your device is impossible. HomeChat includes a built-in proxy tunnel — a fallback channel used when the direct connection to our server is unavailable. When needed, the app uses an internal secured route to reach HomeChat's own server. It does not affect other apps and is not a system VPN. It can be enabled manually with a single tap.

- No phone number, email, or personal data required to register
- No ads or third-party analytics
- No personal data collection
- Encrypted media files are automatically deleted from the server after 7 days
- Delete your account at any time with one tap
- App PIN — independent cryptographic protection, separate from the phone passcode. Without the correct PIN, app content is inaccessible even on an unlocked device
- Panic code — instantly and irreversibly destroys all data within the app with no trace and no possibility of recovery

FEATURES

- Text messages, photos, videos, audio, documents (max file size — 100 MB)
- Video messages (video circles)
- Voice calls
- Video calls
- Group chats with manual invite approval
- Message reactions
- Statuses: sent → delivered → read
- Presence indicators: online / offline / removed from contacts
- Custom stickers, ringtones, and wallpapers
- Light and dark theme support
- Ability to chat during a call

SECURITY

Encryption protocols:
- X3DH + Double Ratchet (Signal protocol) on Apple CryptoKit
- AES-256-GCM for all data types
- Ed25519 for signing, X25519 for key exchange
- Forward Secrecy — compromising one key doesn't reveal past conversations

Calls:
- WebRTC over self-hosted STUN/TURN servers
- Direct P2P connection via STUN (when possible), TURN as a fallback channel
- Call signaling (IP addresses, SDP) is additionally encrypted
- DTLS/SRTP protection for the voice stream

Transport:
- WSS (WebSocket Secure) + TLS + Certificate Pinning (SPKI) — protection against MITM attacks

On-device data:
- Messages stored in an encrypted SQLite database
- Session keys in the iOS Keychain (ThisDeviceOnly)
- Media files excluded from iCloud backups
- Session rollback protection (used encryption keys are destroyed immediately and cannot be recovered)

Push notifications:
- Message content never enters the push payload
- VoIP Push only carries the caller's identifier

NOTES
- Works in Russia
- Push notifications and VoIP calls work in the background
- Supports iPhone and iPad