We built a company around not knowing you.
Founder-led and self-funded. No venture capital, no board, and no data business — which is the point, because a data business is a set of records somebody can come and ask for.
Do not claim what you have not checked.
That is not a slogan. It exists because of a specific, recurring, humiliating defect: a defence that is designed, implemented, documented, tested — and called by nobody. Eighteen instances were found in a single day's review. Every one had passing tests, because the tests called the code even when nothing else did.
Cover traffic. The transparency log. The signed relay directory. The two-relay split. The passphrase lock. At one point, persistent storage itself. Each was, at some moment, described somewhere as working.
Three habits came out of that, and they govern this website exactly as they govern the code.
Name the adversary next to the claim.
Never "the server cannot learn X". Say who cannot learn it, from what they observe. The single most productive question anyone asks here is "which adversary does this test model?" — and the answer has repeatedly been weaker than the one the specification defined two files away.
Assert the property, not something that implies it.
If the claim is that a key left memory, scan memory — do not check that a flag flipped. If the claim is that a seizure yields nothing, scan the file's bytes — do not query the columns.
Watch it fail before you trust it.
A regression test nobody has seen fail proves nothing. And there is a step zero people skip: confirm the break you introduced was actually applied, because a no-op edit and a correct test produce identical output.
When a claim turns out to be false we correct it in place, with the mechanism, and record why the wrong version looked right — that last part is what stops the next person reintroducing it. Several comments in this codebase are longer than the code they describe for exactly that reason.
It is not a historical anecdote either. While this page was being written, another person working on the site found that four places said the second relay "is live" — a present tense nobody had re-checked against the deployment notes, which say the machine was smoke-tested on one dated day and never audited since. All four now carry the date. That is the process working, on the same afternoon, on this website.
One of our own documents once promised something was "cryptographically impossible to prove". A person who believed that sentence might have held out under coercion on the strength of something that was true about a data structure and false about a phone.Why an overstated claim is worse than none
How we build.
Audited foundations.
Message encryption is unmodified libsignal, including its post-quantum ratchet. We do the new work around it, never inside it. Rolling your own cipher is how amateurs are identified.
Say what we can't do.
We publish the threat model, the residual leaks, and the list of claims you cannot verify. Those pages go in the navigation, not in a footer.
A good refusal beats a fix.
Some features cannot be built without breaking the product. We would rather write the argument down than ship the feature and describe it carefully. The list →
Usable or it doesn't count.
Security only an expert can operate protects only experts. If it is not effortless it is not finished — and every trade-off on this site is measured against a person, not a specification.
Small, independent, and hard to lean on.
Money goes to infrastructure — relays, bridges, domains. There are no salaries and no agencies, no outside investor, no board, and nothing that could be acquired without the founder agreeing to it.
Being small is part of the threat model, not a stage we are hoping to grow out of: less to subpoena, less to acquire, less to lean on. It is also a genuine weakness in other directions, and here is that half: one operator, one jurisdiction actually in use, no legal counsel yet, no organisational shield between the founder and an order, and an anonymity set that is currently very small.
One consequence we state rather than leave implied: every key that matters — the release signing identity, relay access, the domain — sits with one person. Every failure mode in our own threat model that begins "a state compels the operator" currently resolves to one laptop and one person, and there is no threshold signing and no independent witnesses. That is written down internally as a gap, not as a design.
The messenger is free, and cover traffic is free with it.
There is no advertising, nothing is sold, and there is essentially nothing that could be sold — the data does not exist.
Cover traffic being free is a deliberate reversal of an earlier decision to sell it, and the argument is not generosity. A privacy lane you have to buy marks the people who bought it. If only subscribers carry constant traffic, a relay reads the constant rate straight off the queue and does not need to break anything to find them — and people who pay for anonymity are, on average, people with more to hide. Anonymity is a property of a crowd, and a crowd you buy your way into is not one.
If a paid tier exists it will sell things that do not change your traffic shape.
There is nothing to buy, no wallet, no token and no billing in Avano today. The blind-signature primitives that would let a payment be verified without being linked to a payer exist in the codebase and are tested — and nothing in the application calls any of them, which on our own terms makes this a design rather than a capability. There is no coin, no fundraising token, and no plan for one; you will never be prompted to buy something in order to send a message. The payment rail is genuinely undecided: the primitive an earlier plan depended on is no longer maintained upstream.
The unresolved part, stated rather than skipped
Cover traffic consumes bandwidth per user per unit of time, not per message. A free user's cost is therefore a floor that never falls, however little they use the product. The volume is measured rather than estimated — 748 MiB per device per month, tapped at the socket at a thirty-second slot. What we have not done is turn that into a price. Every sustainable free tier in this market is either close to zero marginal cost or explicitly boxed in, and the closest analogue to a constant-bandwidth-per-user business charges a flat monthly fee and has no free tier at all. We have committed to cover traffic being free anyway, because the alternative marks the people who paid. Saying this here is cheaper than discovering it later.
A further open question, and it goes to counsel rather than to engineering: what withdrawal, refund and cancellation rights attach to a purchase when we deliberately do not know who the customer is. That has to be answered before anything is sold, not after. The register of questions counsel has not answered →
This one ends with the balance sheet.
What exists and runs
A pre-release Android build carrying the full messaging flow over Tor, and an iOS build that compiles and runs. A relay in Germany, onion-only, holding nothing on a disk. A metadata design that is genuinely ahead of the field, with the engineering documentation behind it. Post-quantum message encryption at parity with the best available. One-to-one voice calling, built and reachable — its media relayed so a contact never learns your address, with call audio not yet verified on real handsets. And cover-traffic polling actually running, free and on by default — its inbound half; the outbound decoy half is not built yet.
What does not
A release signing key — every build we have made is signed with a development key. Published source, a published build manifest, and a public log, so nobody can verify anything. An independent audit of any of our own work. The two-relay routing switched on. A legal entity, counsel, and every legal document on this site in a reviewed form. And users: a privacy product with few users offers little privacy, and only growth fixes that.
Both columns are maintained on limits and proof, which are the two pages we would rather you judged us on.
Write to hello@avano.app.
Questions, press, early access, security reports and legal process all go to the same address, because it is the only one we have confirmed a human reads. An address that silently drops mail is worse than no address — the reasoning is on the proof page, and it is the same reason our security.txt lists hello@ rather than a security@ nobody has tested.
We are not hiring
There is no payroll, so this is not a job posting and we are not going to dress it up as one. If you work on metadata-resistant systems, mobile cryptography, release integrity or relay infrastructure and you want to talk anyway, the address above is the address. Tell us what you have broken.