How messages travel

A network of nodes that store and forward what they can't open.

Nodes

Pigeon's nodes are deliberately simple servers. They hold sealed envelopes and hand them back to whoever can prove they may collect them. They never see what's inside, who sent it or which conversation it belongs to.

Mailboxes, not accounts

A message waits in a mailbox that belongs to a conversation, not to a person, and its address changes as the conversation's keys change. Nodes keep no list of accounts, contacts or who talks to whom.

Several copies

Each mailbox lives on several nodes. A message counts as sent once a majority have stored it, and your device reads from all of them and fills any gaps, so a node going down doesn't lose anything. See delivery and outages.

Who runs it

Pigeon operates the nodes. Because they hold only sealed envelopes, running them doesn't give us your messages; what they could reveal is on the encryption page.