How it works
Privacy and security, in plain words.
What Pigeon does with your messages, what our servers can and can't see, and what isn't finished yet. Engineers will find the same story, in detail, in the technical pages.
Sealed on your device
Your message is encrypted before it leaves your device, with keys that only the people in the conversation hold.
Carried blind
Five of our servers each hold a sealed copy. They can't open it, and the envelope names no account, sender, recipient or group.
Opened by them
The people in the conversation collect it and open it. Once it's delivered, the servers delete their copies.
Who can read your messages
Only you and the people in the conversation, in one-to-one chats and in groups. Not Pigeon, and not the servers that carry the messages: they only ever hold sealed envelopes they have no key for. Groups use MLS, the open standard for group encryption (RFC 9420). Photos and files are encrypted on your device the same way.
No phone number, no email
Pigeon doesn't ask for a phone number, an email address or your name. Your account is a set of keys made on your device. People find you by a handle you choose, or by a code you share with them.
Your seed phrase is your account
When you sign up, Pigeon shows you 24 words, once. Write them down and keep them somewhere safe. They take your account back if a device is lost or stolen. Nobody else holds a copy, so nobody can reset them for you: not us, and not anyone pretending to be us. Pigeon will never ask you for them.
Outages don't lose messages
Each message is written to five servers, and counts as sent once three of them have stored it. If servers go down, messages wait and arrive when enough are back; one that has been accepted is never dropped. We test this by crashing, wiping and cutting off servers on purpose (the measurements).
What our servers do see
Being honest about this matters more than sounding perfect. Our servers see sealed envelopes, their size and the time they arrive, and your IP address while your device is connected. They don't write your IP address to disk or to their logs. Someone who can watch a lot of internet traffic could still use addresses and timing to guess who is talking to whom; Pigeon doesn't hide that yet. The privacy policy lists everything, with how long each thing is kept.
What isn't built yet
- An independent security audit. Until there's been one, don't rely on Pigeon where your safety depends on it.
- Signed installers, and automatic updates.
- An option that hides your IP address from our servers.
- Reporting a message from inside the app; until then, by email.
Found a weakness?
Tell us: the security page says how, and promises safe harbor for good-faith research.