PockyAPP has no ads, but that isn’t what this is about. The goal is that your messages don’t reach even us.
Encrypted from the first message
Every new chat and group you create is end-to-end encrypted right away. We use the standard Matrix encryption (Olm and Megolm), the same as the Element app. A message is encrypted on the phone and arrives at the server as an unreadable jumble of characters. Only the devices of the people in the conversation can decrypt it. You recognise an encrypted chat by the lock next to the name, in the chat list and in the header.
What the server sees and what it doesn’t
Encryption protects the content, but not everything around it. The server still sees so-called metadata: who writes to whom, when and how large the messages are, typing and read status, names and profile photos.
Text, replies, reactions, photos, videos, voice notes, files and location are encrypted.
Notifications without snooping
For messages to reach you with the app closed, Android needs Google’s Firebase service. In most apps the sender’s name and a piece of the text travel through it. Not in PockyAPP: the server sends only a signal that something arrived, with no name, no chat title and no text. The phone then fetches the message itself and decrypts it with your keys.
You choose what shows on the lock screen: the full text, the text only on an unlocked phone, or just “New message”. On phones without Google services the app checks for messages on its own, without Firebase.
Verification and key backup
When you sign in on a new device, verify it with one you already have. Both show the same row of emoji, you compare them and confirm. Verified devices pass keys to each other, so you also see older encrypted messages. You can verify with Element too.
Keys live only on your devices. If you lose all of them, you can’t get back to old messages without a backup. PockyAPP therefore offers a key backup. You get a recovery key that you save in a password manager or write on paper, and enter it on a new phone. The server keeps the backup only encrypted and without the key it’s useless to it.
In Me → My devices you see everywhere you are signed in and you can sign out an unknown or old device remotely.
Choices that stay on the device
Whether others see that you are online or typing, how precise a location you send and what notifications show is stored only on the phone, not on the server. And it works both ways: if you don’t show your online status, you don’t see it for others either.
You’ll find the details on the Encryption and safety page.