Plain English Security

Real privacy.
No tech jargon.

You shouldn’t need a cryptography degree to know your conversations are safe. Here is how Tangle protects your contacts, messages, and personal space in honest, human words.

📱 Contacts stay on your phone 🔒 End-to-end encrypted chats & doodles 🙈 Phone numbers are never public 🚫 Zero ads, tracking, or data brokers

Core Guarantees

How Tangle keeps you safe, explained simply.

📱
Friend Discovery

Your address book never leaves your phone.

When you search for friends, your phone checks for matches locally. Tangle never uploads, reads, or saves your address book on our servers.

💡 Think of it like this

It’s like checking a secret handshake in the dark. Your device confirms if a friend is in the room without ever turning on the lights or showing their name to anyone else.

Under the hood (for cryptographers & engineers) ↓

Tangle implements RFC 9497 2-Round Verifiable Oblivious Pseudorandom Functions (VOPRF) over the prime-order elliptic curve NIST P-256 with Chaum-Pedersen Zero-Knowledge Discrete Logarithm Equality (DLEQ) proofs.

Client scalar blinding: B = r · H1(phone) ➔ Server evaluate: E = k · B with DLEQ proof ➔ Client unblind & match.

The server evaluates the curve point without ever observing the underlying phone number or address book graph.

🔒
Messages & Canvas

Only you and your friends can see what you share.

Every doodle, voice memo, polaroid, sticker, and chat message is locked on your device before it’s sent. Only the recipient’s device holds the key to unlock it.

💡 Think of it like this

Imagine mailing a sealed stainless steel lockbox where only you and your best friend have the keys. The postal carrier carries the box, but cannot peek inside.

Under the hood (for cryptographers & engineers) ↓

All media uploads, audio notes, and canvas elements are sealed using ChaCha20-Poly1305 authenticated symmetric encryption with ephemeral X25519 key exchanges. Keys are stored in the device’s hardware secure enclave. PostgreSQL persists only opaque ciphertext.

🙈
Account Security

Your phone number stays strictly private.

We only use your number once to text you a 6-digit confirmation code. This prevents spam bots from ruining the space. Your number is never shown on your profile and is never shared.

💡 Think of it like this

Like a bouncer stamping your hand at the door so you can re-enter, without writing your home phone number on the guest list.

Under the hood (for cryptographers & engineers) ↓

Plaintext phone numbers are never stored in the database. Identifiers are converted into irreversible, keyed blinded identity tokens: blinded_identity = H2(phone, k · H1(phone)) where server private key k resides in secure key management (KMS/HSM).

🚫
Ethics & Respect

No ads. No tracking. No selling your data.

We don’t sell your personal information to data brokers, we don’t track where you go across the web, and we don’t harvest advertising profiles. Tangle is made for genuine friendships.

💡 Think of it like this

Your living room is yours. Tangle doesn’t put billboards on your walls or listen in to pitch you sneakers.

Under the hood (for cryptographers & engineers) ↓

Zero third-party advertising SDKs, zero user tracking pixels, zero analytics brokers. All requests communicate solely with authorized Tangle TLS endpoints with strict rate limiting.

🛡️
Link Security

Safe links without spying on where you browse.

When someone shares a web link, Tangle checks if the site is known for phishing or malicious tricks—without our servers ever knowing or logging which websites you visit.

💡 Think of it like this

You can check if a book title is on a banned list without having someone stand over your shoulder reading the whole chapter.

Under the hood (for cryptographers & engineers) ↓

Threat verification uses k-anonymity with 4-byte hash prefixes against global threat feeds. The server receives only truncated prefixes, never the complete destination URL. Previews are fetched through isolated, SSRF-safe proxies.

Common Questions

Questions you might have.

Can anyone at Tangle read my chats or view my doodles?

No. Your messages, drawings, voice notes, and photos are encrypted directly on your device before they reach our network. We do not hold the keys to unlock them.

Why does Tangle ask for my phone number at all?

Phone numbers are used exclusively to send an SMS verification code when you sign up or log in. This prevents automated spam bots and keeps the space authentic. Your number is never shown to other users.

What happens when I allow contact access on my phone?

Your phone scans your contacts locally to see if any match our blinded user tokens. Your address book is never uploaded to our servers, and our team cannot see who is in your phone.

Can strangers search for my phone number on Tangle?

No. There is no public phone directory, and users cannot search by phone number. People can only find you if you choose to share your username or invite link.

How long do shared moments last?

Moments in your story vanish automatically after 24 hours. Offline messages stored on your device are kept encrypted in local storage, and you can clear your cache at any time in Settings.

How do I know this isn’t just marketing talk?

Our client cryptographic libraries, protocol specifications, and security model are completely open source. Security researchers and engineers can inspect and verify every single claim in our technical documentation.

For Security Researchers & Engineers

Want the full mathematical specification?

We believe in total cryptographic transparency. Read our complete RFC 9497 VOPRF implementation details, threat model, elliptic curve parameters, and zero-knowledge verification proofs.

View Cryptographic Spec

RFC 9497 • NIST P-256 • DLEQ Proofs