Sotvo questions, answered quietly

Sotvo is anonymous in one exact sense: it never learns who you are. There is no account to create, and the app never asks for a phone number, an email address, or a name. A room opens with a single-use room code, which makes the two of you anonymous to us and fully known to each other; you invite one person you already know, and we can identify neither of you. If the phone number is the part you want gone, we keep a full comparison of messaging without a phone number.

No. Messages and calls are end-to-end encrypted, and the keys never leave your two phones. Both devices derive them from the room code itself, so what our server receives is sealed envelopes and nothing that opens them. If someone demanded a conversation from us, we would have nothing to give. The full chain, from six-character code to per-message keys, is laid out on the full security page.

Your IP address reaches our server the same way it reaches any server your phone connects to. It is never logged, never stored. The only thing derived from it is a set of rate-limit counters keyed to a hash, and the hashing secret rotates daily, so the counters can’t be linked from one day to the next. They expire on their own. The raw address is never written to logs or to disk.

Three narrow records, all temporary. First, the rate-limit counters described above. Second, an opaque push mapping if you turn notifications on, deleted the moment its room ends; a notification says only that a room had activity, never the sender, the content, or the code. Third, a one-time check of your Apple receipt when you unlock. No messages, no call audio, no contact lists, no identities. We see that a room exists, never what’s inside.

A stolen phone gives up less on Sotvo than on any messenger that keeps history, because there is nothing stored to find. Messages live in memory only, so once a room ends, no trace of it remains on the device. There is no archive to scroll and no account to take over. App Lock puts a Face ID check in front of the app itself. The honest limit: someone who can unlock your phone while a room is still open can read that open room, the same as any app on the screen.

There is nothing to browse on Sotvo: no directory, no search, no suggested contacts. A room opens only by invitation, when someone you already know hands you its code, so the one person who can reach you is the person you chose. The absence has a quiet benefit. A user list that doesn’t exist can’t be breached or sold. Sotvo is built for two people who already know each other, and nothing in the app can introduce you to anyone else.

When a room ends, everything inside it goes with it. A room can end two ways: it runs out the time you both agreed on, or one of you burns it. Either way, the outcome is identical. The room’s state lived in memory only, nothing was archived on your device or ours, and the code died back when the room sealed, so nothing can reopen it. Messages don’t wait that long unless you turn fast-vanish off: it is on by default, and each one clears two minutes after it is sent. On the pre-release build (July 2026), burning a room drops both phones to the same end screen: the room is gone, and nothing remains.

Screenshots can’t be prevented — so they’re never silent. If either of you takes one, the other is told, every time, and the alert can’t be turned off by either side. Saving a photo works the same way: the other person is told, and saved copies don’t expire. Detection can’t stop a screenshot, and we won’t pretend it can; it also can’t stop a second phone pointed at the screen. What it guarantees is smaller and real: nothing is captured in silence.

Calls are relay-only so that neither phone learns the other’s IP address. A direct connection between two devices requires them to exchange addresses, and an address can place a person on a map. In Sotvo, each phone talks only to the relay, which passes along encrypted audio it can’t decrypt and keeps no record of the connection. The trade-off is real: the extra hop can add a small delay to a call. We accept the delay. The address stays where it belongs.

Joining rooms is always free. Entering a code someone sends you will never cost anything, and neither will opening a standard room that lives up to an hour. Longer-lived rooms, and running up to five rooms at once, will be part of the unlock: a one-time $6.99 purchase, no subscription, nothing that renews.

Apple handles the payment — we never learn who you are.

Sotvo is coming soon to the App Store. There is no public date yet; when there is one, it will be on this page. At launch, Sotvo will be initially available in the US, Canada, Australia, New Zealand and most of the EU. If your country isn’t on that list, the app won’t show up in your App Store on day one. Availability can widen after launch, and this page will change when it does.

There is no Android version, and none is planned for launch; Sotvo is built for iPhone. If you are on Android and want private messaging today, Signal is the closest thing to a default recommendation, and Session drops the phone-number requirement. Both exist now, and neither asks you to wait for us.