Messages dissolve like ink in water — no trace on your screen, no readable trace on our servers. UMBRA is designed so even our servers can't link who you talk to. No phone number.
Encrypting what you say is a solved problem. What's left exposed is who you say it to, how often, and when — the map of your whole life. As laws like the EU's “Chat Control” push toward scanning private messages by default, UMBRA is built to minimize that pattern by design — so there's far less for anyone to collect in the first place.
Your identity is a key on your device. Share a contact with a QR code or a one-time link — nothing ties the app to the real you.
End-to-end encrypted on unmodified, audited cryptography (libsignal) — with post-quantum protection on every message, both the key exchange and the ongoing ratchet. Only the other device can open it.
Servers hold sealed packets under random codes — they can't see who talks to whom, and the two sides of a chat never touch the same server.
Messages fade on their own, on your device and in transit. Keeping one is a deliberate choice — never the default.
No jargon. Just the small, quietly amazing things UMBRA does for you.
Send a photo or a document — and the server that carries it can't tell how big it is, what kind of file it is, or who it's for. It's shredded into identical locked pieces under random names, and only the person you sent it to can put them back together.
Reading your messages is already off the table. But most apps still see who you message, when, and how often — the quiet map of your whole life. UMBRA is built so even our own servers can't draw it.
Phone lost, or taken from you? Everything on it stays locked behind your passphrase. Someone who forces it open finds only noise — not your chats, not your contacts.
Your messages are spread across separate, independent servers run by different operators — no one of them ever sees both ends of a conversation, or holds enough to piece your life together.
| UMBRA | Signal | ||
|---|---|---|---|
| End-to-end encrypted | Yes | Yes | Yes |
| No phone number | Yes | No | No |
| Servers can't see your contacts | By design | Partial | No |
| IP hidden for all messages, by default | Built in | Calls only | No |
| Disappearing by default | Yes | Optional | Optional |
| Post-quantum encryption | Yes | Yes | No |
| Locked if your phone is seized | Passphrase | No | No |
| Open source | Yes | Yes | No |
Most “private” apps promise the impossible. We won't. On iPhone, to wake your phone for a new message, Apple's push system can see when your device receives something, and which device — never from whom, never what. That's a limit of the platform, not a hole we hide.
So we will never call UMBRA “untraceable” or “invisible.” We call it metadata-minimizing, we will publish our threat model in the open, and open-source the code so anyone can check the claim. Threat model — published at launch.
UMBRA is in active development. For the first builds only — nothing else, no tracking.