Encrypted chat
Messages travel over Tor and are end-to-end encrypted with the Signal protocol. Contacts are added by username, so there are no phone numbers and no email.
Early development, test builds only
A phone that keeps
your business yours.
Three apps. Everything encrypted. Nothing to sell. OBSIDIAN is an Android phone stripped back to what private communication actually needs, and built so that even the people running it cannot read your messages.
Runs on the Google Pixel 8. No phone number required. No account recovery. No analytics anywhere, including on this page.
Three apps. That is the whole phone.
Every app that could leak something has been taken out of the operating system: not hidden, not disabled, removed from the image.
Private browsing
Tor Browser, and nothing else. There is no second browser quietly syncing history somewhere.
Camera
Photos stay on the phone. When you send one, its location and camera details are stripped off first.
- No dialler
- No text messages
- No location
- No app store
- No Google account
- No side-loading
How a message travels
- 1
Encrypted on your phone
Before anything leaves, the message is sealed to your contact's device keys. Only their phone holds the key that opens it.
- 2
Sent through Tor
The app talks to nothing directly. Even the name lookup goes through Tor, so the server never learns where you are.
- 3
Passed on, unread
The server moves an encrypted blob between two accounts. It keeps no archive of what it moved.
- 4
Opened by hand
Messages arrive sealed. Your contact taps to open, so nothing sensitive sits on screen when the phone is picked up.
Built to survive a bad day
Emergency wipe
Hold one button for three seconds. The phone erases itself and returns to factory settings. No confirmation dialog, no waiting on a network.
Two locks
The phone has a lock screen, and the app has its own PIN and locks itself whenever you leave it. The app refuses to open on a phone with no lock at all.
Verify in person
Every account has a fingerprint and a QR code. Compare them face to face once, and you know who you are talking to from then on.
Encrypted at rest
Messages and contacts live in an encrypted database whose keys are sealed by the phone's security chip.
What it looks like
Screens from the current build.
What the server can and cannot see
Privacy claims are worth nothing without the uncomfortable half. Here is both.
Cannot see
- The words in your messages
- Your photos
- Your phone's IP address or location
- Anything after the fact, because no message archive is kept
Does know
- Which usernames exist
- Who has added whom as a contact
- Each account's public keys, which delivery requires
- Roughly when an account is connected
How OBSIDIAN earns trust
A privacy claim is worth exactly what someone else can verify. This is where each part stands today, and what the first release has to include. Nothing here is marked done until it is.
Open source In place
Every line of the app, the operating system changes and the server module is public under the GPL-3.0 licence.
Public security development In place
The work happens in the open, so fixes and mistakes are both visible as they are made.
Reproducible builds Planned
You will be able to rebuild the phone image from this source and get byte for byte the same result, so nobody has to believe our copy is honest.
Independently verifiable releases Planned
Every release will publish hashes, so the image you flash can be checked against the one we published.
Signed updates Planned
Updates will be signed with release keys generated and kept offline, so a phone accepts nothing that did not come from us.
Locked bootloader Planned
Once release keys exist, the bootloader locks, so modified software cannot be flashed onto the phone. Test builds today leave it unlocked, and say so on this page.
Verified Boot Planned
The phone will check its own system on every start and refuse to boot if anything has been altered.
Hardware-backed keys and attestation Planned
Keys sealed by the phone secure hardware, and a way for a phone to prove to you that it is running the real, unmodified OBSIDIAN.
Straight answers
If I lose the phone, can I get my account back?
No, and that is deliberate. Your keys and password exist only on your phone. If it is wiped or lost, that account ends and you register a new username. Nothing is held anywhere for an attacker, or us, to hand over.
Can it make phone calls or send texts?
No. The dialler and messaging apps are removed from the operating system. Calls and SMS travel through the mobile network, where they are logged and interceptable.
Why does adding someone need their username, not their number?
A phone number identifies you for life and links to everything else. A username on this phone links to nothing.
Why should I believe any of this?
Because you do not have to take our word for it. Every line of OBSIDIAN is open source under the GPL-3.0 licence, so any security researcher can check exactly how it works, including the section above on what the server does and does not see. Privacy you have to take on trust is not privacy.
Is it finished?
No. It is in early development. Current builds are test builds, which means they are signed with test keys and the phone's bootloader stays unlocked. They are for evaluation, not for protecting anyone yet.
Read it for yourself
Every line of the app, the operating system changes and the server module is public.
github.com/ObsidianOSx/ObsidianOS