iOS
An iPhone application with encrypted messages, groups and files. Calls integrate with the system CallKit interface; the local vault supports Apple biometric protection.
CallKit · KeychainOUR WORK / 01
Hush Messenger.
Private messaging. On iOS, Android, macOS and the Web.
Encrypted messages and files, audio and video calls, invitations and conversations with a chosen lifetime. Hush brings three native applications and a Web client together on a shared communication foundation.
Application available in
- English
- French
- Spanish
THE CONTEXT
A conversation can have an end.
Founded by Gabriel Genoni, Hush Messenger serves personal and professional exchanges that do not need to remain accessible indefinitely. The project combines on-device encryption, participant admission and access expiry. Its design spans Web, iOS, Android and macOS, with a synchronized conversation list and device-local histories.
01 · Applications
iOS, Android, macOS.
Three native clients. One shared approach to private conversations.
Android
An Android application for messaging, attachments and calls. Telecom/ConnectionService and call notifications work alongside a vault protected by the Keystore and strong biometrics.
Telecom · KeystoremacOS
A desktop application with native screen capture, calls and actionable local notifications. Touch ID protects the vault when the application’s signature and provisioning profile support it.
Screen sharing · Touch IDThe Web complements these three applications: access from a compatible browser, with no installation for guests. Screen sharing is available in supported desktop browsers and on macOS, not on mobile.
Invite.
A link or a QR code. Your guest joins without creating an account.
Talk.
Messages, participants and remaining lifetime in one thread.
Share.
The attachment stays in the conversation, ready to download.
Clients developed. The 8 October 2026 whitepaper describes official distribution in preparation, with physical-device validation still to complete. iOS APNs/PushKit and Android FCM require operator configuration; macOS has no remote wake-up when its process is closed.
02 · Encryption & trust
Content stays between you.
Messages are encrypted on-device before passing through the relay.
Your deviceEncrypts content
The Hush relayRoutes ciphertext
The recipientDecrypts locally
Verifiable identities
The owner signs the exact device identities admitted to a conversation. Safety numbers can be compared over another channel. Changes to a previously pinned contact key block invitations until resolved.
An on-device vault
The password produces a derived authentication key. A strict vault uses an independent master secret and separate recovery key. Native vaults start locked, mask private content in the background and require a fresh unlock on return.
Explicit boundaries
Content encryption does not hide all account, invitation or network metadata. Exported copies, backups and compromised devices remain outside conversation cleanup. Capture protections vary by operating system.
03 · The conversation
The whole conversation, considered.
From the invitation to the last file, journeys are designed to work across clients.
Messages & groups
One-to-one and group conversations, participant names, sent / delivered / read states and typing indicators. Messages and control signals are end-to-end encrypted.
Simple invitations
A complete link, QR code, copy or system sharing lets a guest join without an account after owner admission. A targeted username invitation enables automatic admission by the online owner client.
Encrypted files
Each attachment gets a unique key before upload. One download per recipient device recorded at upload, with confirmation; the server copy is removed after the last expected acknowledgement or at expiry. Devices joining later do not receive earlier files.
Audio & video calls
In compatible Pro conversations: frame encryption, camera preview, group gallery, participant selection, microphone and camera controls, Web full screen and a minimized call view. Web calls remain active when switching discussions.
A chosen lifetime
Free creates 30-day conversations. Pro offers 1 hour, 24 hours, 7 days or 30 days, plus early closure by an authorized creator. Expiry stops API access; actual cleanup depends on the server and device execution.
Find your conversations
Local name search, favorites, renaming, unread counts and remaining lifetime. The conversation list syncs through an encrypted vault; message history stays local to each device. Drafts remain while the conversation workspace stays mounted.
04 · Platform & quality
Beyond the message thread.
Accounts, subscriptions, diagnostics and interoperability belong to the same product.
Account & recovery
Username and password, with no required phone number or email. Optional recovery email, password change and account deletion. An email password reset cannot reconstruct a strict vault without its master secret or recovery key.
Free, Pro & billing
The creator’s plan sets a conversation’s capabilities; guests need not buy Pro. Monthly and annual subscriptions, an eligible trial and renewal management use the website and Stripe. Native apps refresh the account plan.
Languages & accessibility
French, English and Spanish; light, dark or system appearance and responsive interfaces. Selected motion, contrast and accessible-control support is implemented, without claiming full accessibility certification.
Diagnostics & operations
A local technical journal to inspect, export or clear, with no automatic upload. A separate admin console provides metrics, diagnostics, TOTP and room purging. Technical logs filter content and secrets; operational metadata has its own retention.
APIs & interoperability
Shared messaging relay and account APIs for Web and Flutter, with Reverb WebSocket notifications and HTTP fallback. Invitations, receipts, files and call keys cross between clients. The API has no message-decryption or history-export endpoint.
Verification & quality
Account-free security self-checks, PHP, Web, Flutter and interoperability tests. The whitepaper reports 752 Web tests and 712 server tests passed on 8 October 2026. Independent review, physical devices, load and distributed releases remain separate validations.
Next: independent review, real-device testing, signed distribution, professional pilots and a future post-quantum key exchange. The whitepaper describes these as further work.
Project documents
The vision. The details.
Founded by Gabriel Genoni, the project plans a Qatar base and presents a proposal to the Startup Qatar Investment Program. The pitch covers the product, professional use cases, launch strategy and US$1.1 million sought. Application, selection and funding are not presented as secured.
Based on the 8 October 2026 whitepaper and the October 2026 pitch. The described capabilities and reported tests concern that project version; they are not an independent audit of the deployed service.