Straight answers
Privacy products tend to make big claims and hide the caveats. Here are ours, in the same place, at the same size.
The short version: we can’t read your messages and we don’t keep them. We can still see that you were talking to someone, and we can’t protect you from your own device.
Not a summary — the whole list. If something isn’t here, we don’t have it.
They get usernames and password hashes. They do not get messages, because there is no table that holds them. No contacts, no conversation records, no history of who talked to whom.
Live chat codes are not recoverable either — we store a keyed fingerprint of each one, and the key is not in the database.
Anyone between you and us — a coffee shop router, an internet provider, a company proxy — sees encrypted bytes. Your messages are encrypted on your device before they are sent, and decrypted on the other person’s device after they arrive.
Codes are random, short-lived, and rate-limited. Guessing has to happen from a logged-in account, only a handful of tries are allowed before a cooldown, and a wrong guess is never told whether it was close.
Every login failure returns the same message, the same code, and the same timing, whether or not the username exists. Signing up does not reveal which names are taken beyond the one you tried.
Passwords are stored using a slow hashing function designed to make bulk guessing expensive, and an account pauses for fifteen minutes after five wrong attempts.
We cannot read your messages. Not because of a policy we could quietly change, but because the keys never leave the two devices in the conversation. There is no admin screen that shows message content, because there is nothing for it to show.
This is the section most products leave out. It is the more useful one.
Malware, a bad browser extension, someone with your unlocked phone — any of these read your messages as you do, after decryption. No messaging app solves this, and any that claims to is lying.
Invisagram does not save your messages to disk and drops its keys when you close the tab. But a browser is not a vault: your operating system can page memory to disk, and can take snapshots of open tabs.
What we can honestly say is that we do not intentionally keep anything. We cannot say that no trace of it exists anywhere on your machine.
To deliver a message we necessarily learn that one session is connected to another, roughly when, and roughly how much. We do not store it — but we handle it, and someone who compromised our servers could watch it happening.
Invisagram hides the contents of your conversation. It does not hide that you had one.
Because nothing about your identity persists between sessions, there is no long-term key to compare. If someone hands you a chat code, we can confirm the code is live — we cannot confirm who is holding it.
Inside a conversation you can compare safety numbers with the other person over a channel you already trust. That is the only check that detects someone intercepting the connection.
They can screenshot it, photograph the screen, or simply remember. Messages disappearing is a property of the software, not of the person you chose to talk to.
We can be ordered to hand over what we have. What we have is usernames and password hashes, and — for at most fifteen minutes — encrypted bytes we cannot open.
We can also be ordered to change what we ship in future. No architecture prevents that, and you should assume it of every service you use, including this one.
To be installable, Invisagram registers a small piece of code called a service worker. It stores nothing — no messages, no keys, no identifier — and it deletes any cache it finds. But unlike everything else here, it survives closing the tab.
It is the only thing we leave on your device besides the login cookie. Uninstalling the app or clearing site data removes it.
You can let people ask for you by username instead of passing a code around. It starts off, it turns itself off again when you log out, and while it is off nobody can tell whether your username belongs to anyone at all — a name that exists, a person who is not signed in, and a person who ignored you all answer identically.
With it on, anyone who knows your exact username can ask to talk to you, and you decide each time. What it cannot do is stop them learning you are here: an answer is an answer. Nobody can search for you, because there is no search — the name has to be typed exactly.
A group here is not a place with a membership list. It is several private conversations at once — one with each person, each encrypted separately — introduced by a code the relay holds in memory and nowhere else. Nobody is a hub, so no member’s device forwards anybody else’s words.
The consequences are real: everyone has to be present at the same time, someone who joins later sees nothing said before they arrived, and when the last person leaves the code stops meaning anything. We could make groups persist, but only by keeping a membership list and a history — the two things this product exists not to keep.
If you turn notifications on, your browser gives us an address for your device, and we keep it so a message can reach you when the app is closed. It is the only identifier we hold. The notification itself carries no content — never the message, never the sender — because none is sent: the wording is decided on your device.
It is kept against your session, not your account, so it is destroyed when you log out or when the session expires, and it never exists at all unless you ask for notifications. The cost that cannot be designed away: Apple or Google carry the wake-up, so they learn that your device received something, and when.
Every open-source package we use runs in the same place as your keys. We keep the list deliberately short and pin every version, but this is a risk we manage, not one we have eliminated.
If you are in a situation where being discovered carries real danger, no consumer messaging app is enough on its own — including this one. Talk to someone who does digital security for people at risk, and take their advice over ours.
Last updated 4 August 2026.