How encryption works
PockyAPP uses the Matrix protocol’s end-to-end encryption, the same as the Element app. Each of your devices has its own encryption keys, which never leave it unencrypted. A message is encrypted right on your phone and travels to the server as unreadable gibberish. Only the devices of the people in the conversation can decrypt it, not even we can read it.
PockyAPP creates new chats and groups encrypted from the start. You can tell an encrypted chat by the lock next to its name in the header and in the chat list.
What is encrypted and what isn’t
EncryptedOnly people in the conversation can read it
- Message text, replies, edits and reactions in encrypted chats
- Photos, videos, voice messages and files
- Location and live location coordinates
- The backup of your encryption keys, locked with your recovery key
Not encryptedThe server can see it
- Who talks to whom, when, and how big the messages are
- Typing, read and online status
- Names, profile pictures, group names and descriptions
- Your status, like “💻 At work”
- That you’re sharing live location and until when, not where you are
- Conversations where encryption isn’t turned on
Verifying devices
After signing in on a new device, verify it with another of your devices: both show the same row of emoji, you compare them and confirm. Verification works with Element too. Verified devices share keys with each other, so you’ll see older encrypted messages as well.
Recovery key and backup
Your keys only exist on your devices. If you lose all of them, you can’t get your old encrypted messages back without a backup. Turn on the backup in the app, you’ll get a recovery key, and on a new phone you enter it. Keep it in a password manager or write it down and store it somewhere safe. Never send it to anyone, not even us.
Notifications
So that messages reach you with the app closed, the server sends your phone only a signal through Google’s Firebase Cloud Messaging that something arrived. Who wrote, in which conversation and what is not in it. Your phone fetches the message and decrypts it with its own keys; neither Google nor our server sees the text. What shows on the lock screen is your choice in settings: the full text, the text only when unlocked, or just “New message”.
Location
Approximate location (about 500 m or city about 5 km) is rounded by your phone, so the exact spot never leaves it. You can stop live location any time in the notification, in the chat or on the map, and it ends on its own after the time you chose.
How to keep everything safe
- Turn on key backup and keep your recovery key somewhere other than your phone.
- Verify your own devices so they trust each other.
- Check your signed-in devices in Me → My devices and sign out anything you don’t recognise.
- Choose what notifications show: if someone else might pick up your phone, keep the text for when it’s unlocked, or hide it.
- Share your location approximately whenever the exact spot isn’t needed.
- Use a strong, unique password for your account that you don’t use anywhere else.
- Only download the Android app from pokecio.com and install the new versions the app offers you. The app itself checks that an update is signed with our key; you can check the first install by the certificate fingerprint on the Download page.
- Don’t get fooled: PockyAPP will never ask for your password or recovery key, not by email and not in a message.
If you lose your phone
Sign in on another device, sign out the lost phone in My devices and change your account password. If you have a key backup, you’ll get your history back on a new device. We’re happy to help at privacy@pokecio.com.
PockyAPP is in beta. It uses Matrix’s standard encryption, but the app itself hasn’t had an independent security audit yet. For truly sensitive matters, we recommend using a mature Matrix client alongside PockyAPP.