Security is easier to understand when you can see the pieces. Here's how Emily's messaging architecture protects content, handles keys, and gives you practical controls.
A MESSAGE'S JOURNEY
Readable on your device.
Encrypted in between.
Your deviceCreate & encrypt
Encrypted deliveryRoute ciphertext
Their deviceDecrypt & read
An illustration of the one-to-one message flow. Registration, delivery metadata, and an intentional report follow different data paths.
01
Encryption between the people talking
Emily's one-to-one messaging implementation uses libsignal to encrypt a message on the sending device and decrypt it on the receiving device. The message-delivery service handles encrypted envelopes. Reading a chat on your own unlocked device is a separate step from delivering it over the network.
A closer look
The implementation uses PQXDH session setup and Double Ratchet through libsignal. Session changes and message state are committed together to reduce the risk of reusing state after an interruption.
02
Keys stay close to your device
Keys are what let a device turn encrypted content into a readable conversation. Emily stores local conversation and protocol state in an encrypted database. The database key is protected using Android Keystore, which helps keep key handling separate from ordinary application files.
A closer look
Room and SQLCipher provide the local storage layer. A randomly generated database key is wrapped using AES-256-GCM with Android Keystore. Hardware-backed protection depends on the device; it is not identical on every Android phone.
03
Check who you're speaking with
A safety number gives you a way to compare a contact's cryptographic identity through another channel you trust, such as an in-person conversation. A key change is something to pay attention to, especially when you are sharing sensitive information.
A closer look
Viewing and comparing a safety number is distinct from automatic key verification. The latter also needs transparency proofs and independent monitoring, and belongs to the development roadmap.
04
Files have their own protection
The attachment flow encrypts supported files before upload. The file's key travels inside the encrypted message rather than alongside the stored attachment. Receiving a file involves obtaining the encrypted bytes and decrypting them on the device.
A closer look
Each attachment uses a separate random key. File integrity, length, and context are authenticated. The storage and transfer services may still see encrypted file size, object references, and access timing.
05
Transport security adds another layer
HTTPS/TLS protects the connection between a device and a service. End-to-end encryption protects the message content between participants. The two layers have different jobs: a protected connection alone does not make every piece of information end-to-end encrypted.
A closer look
Emily uses gRPC for application operations and a separate WebRTC/RingRTC media path for calls. Relays can observe connection and traffic information; call and media capabilities are described with their development status on the features page.
06
The information around a message
Delivering a conversation requires some information beyond its text. Services can handle routing identifiers, encrypted envelope sizes, and timing. Phone registration also involves your phone number and verification provider. Those details should not be confused with encrypted message content.
A closer look
Push notifications are used as wake-up signals for synchronization. The notification implementation avoids selecting message bodies for its notification projection. Android permissions and your notification settings affect what reaches the lock screen.
07
A timer for the conversation
Disappearing messages help reduce how much conversation history remains. The timer applies to new messages after it is set. Sending starts the sender's countdown; first reading starts the recipient's. Editing, replying, and restarting the app do not give the original message a new lifetime.
A closer look
Expiry is checked when content is read from local storage, with cleanup of associated message data and attachments. A timer cannot undo a screenshot, a photograph, or a copy already kept by someone else. View-once media has the same real-world limitation.
08
Personal controls, meaningful choices
Local app locking helps restrict access when someone holds your device. Contact permissions are requested when needed, and unwanted contact can be blocked. These controls complement encryption by helping you manage who can reach you and who can open the app.
A closer look
Device compromise, an untrusted keyboard, malicious accessibility software, or an unlocked recipient device can expose readable content. Keep your operating system current and protect access to your phone.
09
Reporting is a deliberate choice
A report is different from normal message delivery. When you choose to report, the report flow prepares selected report content for the review process. Treat that action as intentionally sharing the selected material for review, rather than assuming it stays only inside the original conversation.
A closer look
The report implementation uses a separately encrypted report envelope and a dedicated reviewer boundary. Ordinary message-delivery operators and the report-review process have distinct access paths.
10
Your visit to this website
This marketing website does not ask you to sign in, upload contacts, or submit messages. It saves your Arabic or English preference in this browser when local storage is available. You can change that choice from the header or remove it by clearing site data.
A closer look
The website has no added analytics tracker or advertising script, and fonts are served from the same site. Standard hosting access logs can include request and connection information. Website storage is separate from the Android app's storage.
Good questions about privacy.
Does encryption hide everything?
No. Message content, registration information, routing metadata, and data deliberately submitted in a report have different protection boundaries. The explanations above describe those differences.
Can disappearing messages stop screenshots?
No. Timers reduce retained history inside the supported app flow. They cannot prevent a recipient from taking a photograph or keeping a copy outside that flow.
Where can I check feature availability?
The features page distinguishes the development version's functionality from the roadmap. The Android public download will be linked from this website when it is available.
A NEW SPACE FOR YOUR CONVERSATIONS
Your next hello
is getting closer.
Emily for Android is on its way. Come back here for the public release.
emily