The version for people who check.

Where your content lives

Ping is not a service that stores your library. Posts, photos, videos and messages live on the devices of the people they were shared with — yours, and your friends'. There's no account database, because there are no accounts. There's no media store we can browse, because we don't have one.

How it's sealed

Your identity is generated on your iPhone the first time you open the app. The owner key is a P-256 key held in the Secure Enclave and it is non-extractable — it cannot be exported by you, by us, or by anyone with the device in hand. Your signing key (Ed25519) and agreement key (X25519) sit in the Keychain and certify from it.

Every object gets its own content key. The body is sealed with ChaChaPoly, and that key is wrapped separately for each recipient device using HPKE over X25519. Keys are per-object and per-recipient, never a shared group key — which is what makes it possible to revoke one thing for one person rather than rotating everyone. Objects are addressed by SHA-256 of their own header and ciphertext, so an object's name is a proof of its contents.

All of that happens before anything touches the network, including the local radio.

What the relay does

Two phones are rarely awake at the same moment, so we run one relay — a single Linux server with a fixed address, compiled into the app. It accepts sealed parcels and hands them to the recipient device when it next connects. It's a post box, not a filing cabinet.

Your device authenticates it by pinning its certificate exactly — the 65-byte public point, not a name in a chain, so a mis-issued certificate from any authority on earth doesn't get you a connection. Nothing moves until the calling device signs a challenge.

When two phones are on the same network they connect directly and the relay is not involved at all.

What it cannot see

• The content of anything it carries. It receives ciphertext and forwards ciphertext.
• Your name, your friends' names, or your profile picture.
• Your friends list, which never leaves your device.
• Whether a parcel is a post, a message, a reaction or a reply, or what it attaches to. Those fields live inside the ciphertext, deliberately — in cleartext they would turn the stream into a labelled interaction graph readable by every relay that ever touched it.

What it necessarily sees

Any system with a server has a shape, and pretending otherwise is how privacy claims fall apart. The relay observes:

• A routing header of seven signed fields: an object id, the sending device's public key, a timestamp, a reconciliation domain id, a size class, a link to that device's previous object, and a signature. No names, no recipients, no type, no content.
• That a device connected, roughly when, and how much encrypted data moved.
• The IP address of the connection, as a property of networking rather than a choice.
• A push token per device, so a sleeping phone can be woken.

That's metadata, and it's real. We minimise it, we don't combine it with anything, and we don't pretend it's zero.

How delivery works

Posts and messages land in seconds. The relay holds a sealed parcel and asks Apple to wake the recipient's phone, which reconciles, decrypts, and writes its own notification locally.

The push payload is empty. One content-available flag and nothing else, ever — not because we withhold the content but because the relay has none to give. Every word you read on a lock screen was composed on your own device from something only it could read. The cost, stated: Apple learns that a device token was woken and how often, and nothing about by whom or what.

Anything over 16 MB — video, in practice — never goes near the relay. It transfers directly between devices over Wi-Fi, at the quality it was shot at.

The relay holds a parcel for 29 days, and caps any one namespace at 256 MB. After that it's deleted, whether or not it was collected.

Taking something back

Three different things, kept deliberately distinct:

• Deleting removes content from your device. It's local, nothing is transmitted, and your friends keep their copies — the app says so rather than implying otherwise.
• Retracting is signed by the author, travels, and removes the content at every holder.
• Revocation is ours, for content reported to us. Every object carries an attestation with an expiry, and a signed revocation set is published that every client downloads whole and queries locally. Downloading the entire set is the point: we never learn which object anybody asked about, so we can't reconstruct the graph by watching lookups.

No ranking, structurally

There is no engagement score anywhere in Ping, and no surface that could carry one. The timeline is ordered by time. This isn't a setting we've defaulted off — nothing in the product computes a ranking, so nothing can be switched on later.

The one call we make to someone else

Searching for a GIF in a chat sends your search text and your IP address to GIPHY. That's the whole disclosure, and it's the only outbound request Ping makes to a service that isn't ours.

The GIF you choose is downloaded by your phone, sealed like any other media, and delivered as bytes — never as a link. Your friend's device never contacts GIPHY, and GIPHY never learns that anyone received anything. A URL in a message would have made every reader's phone announce itself on open, which would have been the actual privacy failure. Nothing is remembered: no history, no recents, no cookies, no cache. There's no GIPHY SDK in the app; it's a plain HTTPS request. It's chat-only, and if you never open the picker the call is never made.

Memory

Memory raises two numbers — how long the relay keeps what you authored, and how much of it — from 29 days to three years. That's the entire change. It's the same ciphertext in the same place, held longer, and we still hold no key that opens it. The key that opens a restore lives in your iCloud Keychain, which is end-to-end encrypted by Apple, so neither Apple nor we can read it and you have nothing to write down.

One honest limit worth naming: a friend paying for Memory doesn't extend what you can pull back. Reconciliation is bounded by the 29-day window on both sides regardless of how long the relay keeps something.

One trade, named

To receive a post while your phone is locked, the app's database uses iOS protection that permits access after the device's first unlock — the same setting every messaging app that delivers notifications must use. Transport encryption and per-object keys are untouched. The alternative is an app that cannot open its own database at exactly the moment a message arrives.

Found a flaw?

We want to hear about it first. Write to security@pingworld.co.