Security, clearly.
Tinline is in alpha and hasn't had an independent security audit yet. Here is what it protects, and the few things it leaves to you. The whitepaper has the full detail, with each part marked shipped, designed or not built.
Who we assume might be dishonest
Tinline's protocol is open, so anyone can run a modified app, and Tinline can't tell it apart from its own. So we assume anyone other than you and your own devices might be dishonest: contacts, group members, hosts, people on a call, strangers and relays. Their keys are their own, so what they sign is valid. They can do anything their own keys and what you've sent them allow, and nothing that needs someone else's key.
A good rule to keep: anything you send or say to someone, they can keep and show to anyone. Messages you signed can be proved to be yours, and calls can be recorded.
None of this is special to Tinline. Every messenger relies on the other person's app: modified versions of popular messaging apps already keep deleted messages and hide read receipts, and a call on any app can be recorded. What differs is who else you have to trust. A service can ban modified apps from its servers; Tinline has no server, so nobody can ban them for you, and there's also no company in between that you need to trust.
| Guaranteed by the maths | Depends on the other person's app |
|---|---|
| Nobody can write in your name or change your words. | Deleting or editing a message asks their app to update it. A modified app can keep the original. |
| Your own devices refuse someone you've blocked. | On their side, the block is a notice their app chooses to respect. |
| Only the recipient can sign a receipt for your message. | They can choose not to send one, or mark something read that they haven't. A missing receipt proves nothing. |
| A message can't be moved to another chat or day. | Its time is the sender's clock, trusted to within the day and an hour either side. |
| A group host can't forge posts or change who belongs. | A host can read, hold back or delay what it carries, and hear the group calls it hosts. |
| Nobody becomes your contact without your yes. | Names are free text, so anyone can use a name you know. Avatars help you recognise someone; to be sure, meet them or call them. |
| Strangers can't join a call they weren't let into. | Anyone on a call can record it, audio and video, without telling you. |
Your identity
Your account comes from a root secret made on your device, shown to you as 24 recovery words. Your identifier never changes; each device you install on has its own key, signed by your account. A lost phone can be replaced from your words without anyone else noticing a change.
Messages and files
Chat runs over authenticated, encrypted peer connections. Every version of every message carries the author's signature inside the conversation, and it is checked on every path it travels, so nobody can put words in your mouth or move a message into another chat or day. Each file is encrypted under its own key, and is served only to a contact whose conversation names it.
Messages travel while both devices are online. There is no hosted mailbox: when someone is away, your message waits on your device. The marks distinguish waiting, sent, delivered and read on the other device; they do not prove a person's attention.
Both apps display recipient-signed delivered and read receipts for messages and group posts. A receipt names the exact version and can be checked later with the recipient's public key. Read receipts can be turned off per account; delivered receipts still go out. A receipt is a device's signed statement, not proof that a person read closely, and a missing receipt doesn't tell you why it is missing.
Groups
A group is hosted by members' devices that offer to carry it. Every post and every membership change is signed by its author and checked by each member, so a host can't forge a post or change who belongs. A host can read, withhold or delay the posts and group calls it carries, because group traffic is encrypted hop by hop rather than end to end between members.
Calls
Calls use peer-authenticated QUIC/TLS encryption from iroh, including when a relay carries them. Your devices connect directly when they can. Group calls are forwarded by a host, which can hear the call it forwards.
Assume any call can be recorded by anyone on it, and in a group call by the host device too. In-app recording with participant notices is planned. Another app could record without a notice, so even when those notices are available they will be a courtesy, not a guarantee. The same is true of calls on any messenger.
On your device
Your root secret and device key sit in an encrypted vault, with an optional passphrase. Your account state, conversations, groups and search index are stored in encrypted databases whose keys come from your root secret. Android remembers the vault key in the Keystore, and desktop in the system keyring, so Tinline can open and take calls in the background. Desktop requires a passphrase if no secure keyring is available. A long, unique passphrase gives the strongest protection if someone copies the app's files.
Some things stay readable so the lock screen and account switcher work: your display name, identifier and device public key, along with file sizes and which days have activity. Pictures, recordings and exports you open can also leave plain copies outside the encrypted store.
Linked devices
Linking a device sends your root secret over an encrypted connection, after both screens show the same code and you approve. That makes every linked device fully you. Unlinking stops sync and calls to that device, but it isn't revocation: a device that kept your words can still act as you.
What Tinline doesn't cover
- A device that's compromised or already unlocked in someone else's hands.
- Someone holding your recovery words, or a linked device you no longer control.
- Who you talk to and when. Public relays and lookup services see which devices connect, and devices on a direct path learn each other's address. Tinline is not an anonymity tool.
- Copies someone already has, including recordings of calls. Deleting a message asks their app to remove it, which a modified app could ignore.
- Forward secrecy for stored data, and secure deletion on flash storage.
Not for emergency calls. Keep your phone's own dialler for reaching emergency services.
Report a vulnerability
Email abe@osvauld.com with “Tinline security” in the subject. Include the version, platform and steps to reproduce. Please leave out real recovery words, private keys and anyone else's data. Email isn't an encrypted channel, so ask us for a secure one before sharing anything sensitive.