FlickerTalk
How it works
FlickerTalk is built so that there is as little as possible to keep. This page says what travels where, what our server keeps and, just as important, what others can still see.
Your identity
When you open FlickerTalk for the first time, your phone makes a pair of keys. The private key stays in the phone's secure key store (Android Keystore or the iOS Keychain) and never leaves it. Your FlickerTalk ID is derived from the public key. There is no phone number, email or password.
You add someone by scanning the code on their screen or opening the link they share. That code is a contact card signed by their key. We have no directory of users and never see your address book.
Sending a message
A message is saved on your phone first. If the other phone can be reached, it goes straight there over an encrypted WebRTC connection, and it is also encrypted end to end with the Olm protocol (a Double Ratchet, from the Matrix project's audited vodozemac library). The other phone saves it and confirms, and only then is it marked as delivered.
When the other phone is off
Our server wakes the other phone with a push notification that carries no message and no sender: only “wake up”. If a direct connection is still not possible, the message goes to the recipient's mailbox on our server, encrypted end to end so that we cannot read it. It is deleted as soon as the recipient picks it up, and after 7 days at the latest. The mailbox keeps no sender and is never backed up.
The mailbox is on by default. Either of you can turn it off in Settings; then messages wait on the sender's phone until the two phones can talk directly.
Files and calls
Files and calls never go through the mailbox. They travel over the direct connection between the phones, or through our relay when a direct path is impossible, still encrypted.
What our server keeps
| Data | Why | For how long |
|---|---|---|
| Your device ID and public key | To check that requests really come from your phone | Until you erase the phone in the app |
| A hash of your contact card's routing code | So that only your contacts can wake you or leave you mail | Same |
| Your push token, encrypted with a key kept outside the database | To wake your phone | Same, or until Google or Apple say it expired |
| Messages that could not be delivered, encrypted end to end | To deliver them later | Until picked up, at most 7 days |
Nothing else: no contacts, no conversations, no call history, no access logs and no history of IP addresses.
What others can see
- The person you talk to
- When your phones connect directly, each can see the other's public IP address: that is how peer-to-peer works. In Settings you can make calls always go through our relay, which hides your IP address from the other person during calls.
- Our relay
- When a direct connection is impossible, our relay carries the encrypted traffic. It sees the IP addresses of both phones and how much data flows, never the content, and it keeps no logs.
- Google and Apple
- They deliver the wake-up notifications, so they see that your phone got a push and when. The push never contains a message or who sent it.
- Our server
- It sees the IP address of a connection while it is open, to route it and to stop abuse. It does not keep it: the abuse limits use a salted hash that lives only in memory for a minute.
- Your network provider
- Like with any app, your internet provider can see that you use FlickerTalk and when.
What no app can protect
FlickerTalk protects your conversations from our servers, from a breach of our database and from the push services. It cannot protect you from a phone that is compromised or unlocked in someone else's hands, from malware, from screenshots, or from the other person copying what you send.