Seven layers, zero infrastructure.
Every layer of FLVSH, from identity and encryption to the radio, the relay and storage, runs on the phone in your pocket. This is the whole stack. There's nothing behind it.
- layer 1
Keypair identity
X25519No Phone NumberNo AccountYour identity is an X25519 keypair generated on your device the moment you open the app. No phone number, no email, no signup, no verification code. Nobody issued your identity, so nobody can revoke, subpoena, or impersonate it.
The public key is what peers see; the private key never leaves your device. Change your name or avatar any time — the keypair underneath stays the same, so your conversations survive every profile edit.
More detailLess detail
Blocking someone is cryptographic, not cosmetic: packets from a blocked key are dropped before decryption. There is no server-side account to ban, recover, or socially engineer — the key is the whole story.
- layer 2
End-to-end encryption
PQXDHX25519 + ML-KEM-768Double RatchetChaCha20-Poly1305Every chat starts with a PQXDH handshake: X25519 key agreement combined with ML-KEM-768, so the session stays secret unless an attacker breaks both. Messages are then sealed with ChaCha20-Poly1305 under keys from a Double Ratchet. Only the recipient's device can open them, not relays, not bystanders, not anyone sniffing the radio.
Authenticated encryption means tampering is detected, not just hidden: a modified ciphertext fails authentication and is discarded. Voice notes ride the same pipeline as text.
More detailLess detail
The Double Ratchet gives every message a fresh key and discards used ones, so a stolen phone can't read past messages, and a leaked state heals once the conversation moves on. Relay nodes in the mesh forward ciphertext they cannot read. A hop count is all they learn.
- layer 3
Bluetooth transport
BLE 5.0GATTDual-RoleFLVSH speaks directly over Bluetooth Low Energy — no cell towers, no Wi-Fi, no internet anywhere in the path. Every phone runs both roles at once: advertising so others can find it, scanning so it can find others.
Discovery, identity exchange, and messaging all run over one GATT service. iPhones and Androids interoperate on the same protocol, byte for byte.
More detailLess detail
The link negotiates the largest MTU both sides support and sizes every packet to it, so throughput adapts to the hardware instead of assuming it. Connections are acknowledged end to end — Sent means written to the radio, Delivered means the other device confirmed it.
- layer 4
Fragmentation protocol
MTU-Sized ChunksGroup IDsReassemblyBLE moves small frames, so FLVSH splits large packets into MTU-sized fragments and reassembles them on arrival. Voice notes and long messages cross the radio as ordered, deduplicated chunk streams.
Each fragment carries an index, a total, and a random group ID, so two messages in flight at once can never interleave into garbage.
More detailLess detail
Retransmitted fragments are detected by index and dropped. A stream missing pieces is held, not guessed at — reassembly completes only when every fragment is present, or not at all.
- layer 5
Mesh relay
Store & ForwardTTL HopsDedupOut of range of the person you're texting? Any FLVSH phone between you relays the encrypted packet, hop by hop, until it arrives. Relays forward ciphertext they cannot read.
A TTL bounds how far a packet travels, and every relay remembers what it has already forwarded, so the mesh never floods itself.
More detailLess detail
Acknowledgments and read receipts ride the mesh back the same way, so a sender two hops away still sees Delivered. Each relayed message records its hop count — you can see how far the crowd carried it.
- layer 6
Offline queue
RetryTimeoutDrain-on-ConnectSend to someone who just walked out of range and the message queues on your device. The moment they're reachable again — directly or through the mesh — the queue drains and the message goes out.
Every send is tracked to an outcome: Sent, Delivered, Read, or Failed with a retry button. Nothing silently disappears into the void.
More detailLess detail
Pending messages settle by acknowledgment, not hope: a write that was never confirmed times out and is marked Failed so you know to resend. Reconnecting to a peer drains their queue automatically.
- layer 7
Local-only storage
On-Device SQLiteDisappearing MessagesZero CloudConversations are stored in a local database on your device and nowhere else. There is no cloud backup, no sync server, no analytics endpoint — because there is no server at all.
Disappearing messages expire on a per-conversation timer and are deleted from the database, not just hidden from the list.
More detailLess detail
Wipe the app and the data is gone everywhere, because everywhere was your phone. What never leaves the device can never leak from a breach you didn't cause.