Skytale encrypts every message on your device before it leaves. The server relays ciphertext it has no key for — not to be trusted, but to be unable to help. Voice and video calls go peer to peer.
One email when Skytale hits the stores. Nothing else, ever.
We store the address and the date. No IP, no tracking, no third parties.
How it works
Named after the Spartan cipher rod: a strip of parchment that reads as nonsense unless you hold a rod of the matching diameter.
Your identity keypair is generated on the device and the private half never leaves it. It is held in the secure enclave-backed keystore, not in app storage.
Starting a conversation runs X3DH against a batch of one-time prekeys you published in advance. Each is used once and destroyed, so the session can be set up while you are offline.
Content is encrypted with AES-256-GCM under a key derived from that handshake. What reaches the server is a blob it cannot open, and the same is true for attachments and voice notes.
Your local message database is encrypted at rest with SQLCipher, keyed from the device keystore. A copied phone backup is not a readable transcript.
What is actually inside
Standard, well-reviewed primitives from the noble libraries. Nothing here was invented for this app.
| Purpose | Primitive |
|---|---|
| Session establishment | X3DH |
| Key agreement | X25519 |
| Signatures on prekeys | Ed25519 |
| Key derivation | HKDF-SHA256 |
| Message & attachment encryption | AES-256-GCM |
| Local database at rest | SQLCipher |
| Calls | WebRTC (DTLS-SRTP) |
Forward secrecy currently covers session setup, not every individual message: the Double Ratchet is implemented in neither client nor server yet, so compromising a device's long-term key would expose that conversation's history. It is the next piece of work, and it is listed here rather than quietly omitted. Skytale has also not had an independent security audit. Until it has, treat it as promising rather than proven.
Device checks
A message is only as private as the two devices holding it. Software attached to a running app reads what you type before it is ever encrypted, and no protocol can prevent that. So each device examines itself and tells the person on the other end what it found — this is the list, in full, including what it cannot see.
| Check | What it means | Where it runs |
|---|---|---|
| Jailbreak / root | The protections keeping other apps out of Skytale are gone | iOS & Android |
| Root management apps | Magisk, su binaries, test-keys builds, writable system paths | Android only |
| Runtime instrumentation | Frida, Xposed or Substrate attached to running apps — reads messages after they are decrypted | Android only |
| App on removable storage | Installed where other apps can reach its files | Android only |
| Debugger attached | A debugger reads process memory, which holds decrypted text | iOS & Android |
| USB debugging | Switched on — a computer can reach data normally sealed in the app | Android only |
| Developer settings | Development mode active on the device | Android only |
| Screen lock | No passcode or biometric — anyone holding the phone opens the chats | iOS & Android |
| Operating system age | Old enough to be missing security fixes | iOS & Android |
One finding in the first four marks a device compromised and says so to whoever it is talking to. The rest are warnings. Nothing is shared beyond these fixed labels: the raw measurements stay on the device, because a detailed report of someone's phone is itself a fingerprint, and it would hand an attacker a checklist of exactly which probes to defeat.
Apple's App Attest and Google's Play Integrity are the hardware-backed way to prove a phone is genuine and the app unmodified. Skytale sends those tokens, but they are not yet verified on the server — that work is unfinished, so today every verdict comes from the heuristics above, which a device reports about itself. A thoroughly compromised phone can lie about all of them.
iOS has no instrumentation check at all: an iPhone reporting nothing there means the question was never asked, not that the answer was no. Screen recording and keyboard extensions are not examined on either platform. Read the badge as "this phone's own self-check found nothing", not as proof the device is clean.
Progress
Skytale is in active development and not yet released. This list is kept honest on purpose — it is the same list the developers work from.
Support the work
Two people on different networks often cannot reach each other directly, and the call needs a TURN relay in between. Relays are bandwidth, and bandwidth is the single largest running cost here. This is the immediate hardware need.
Encryption nobody independent has examined is a promise, not a guarantee. Funding a review by people with no stake in the answer is what turns one into the other.
Per-message forward secrecy is the largest remaining piece of cryptographic work, and the difference between good and properly good.
If you or your organisation fund privacy infrastructure, we would like to hear from you at support@skytale.site.