Frequently Asked Questions

SecureChat is a messaging app that keeps your conversations truly private. Every message is encrypted on your phone before it leaves. We use XChaCha20-Poly1305 encryption — the same kind used by security professionals. Your identity is tied to Kaspa, a decentralized blockchain, not to your phone number. There is no central server. No one can read your messages. Not even us.

The service is designed not to receive message decryption keys. Message content is encrypted on the device and the relay handles an opaque payload. This limits server access to content, but it is not an absolute security guarantee; client, dependency and device vulnerabilities remain part of the threat model.

No. You do not need a phone number, email address, or any personal information. When you open SecureChat for the first time, it creates a unique identity on your phone. You share it with friends using a simple QR code. That is all it takes to connect. No sign-up. No account.

SecureChat is available as an Android alpha APK for testing. The current build is v0.1.7-alpha with core encrypted messaging, QR contact exchange and server-signed StealthX activation tiers. Paid availability remains launch-gated, and broader store distribution plus privacy-relay expansion remain on the roadmap. You can download the APK from GitHub Releases.

Yes. SecureChat source is visible on GitHub for transparency and security review. You may inspect the encryption and verify the architecture, but building, running, distributing, rebranding, hosting, or using SecureChat requires prior written permission from Vendetta Labs.

Message content is encrypted end-to-end and is not stored by the current online-delivery handler. The central signaling service nevertheless processes network address, connection timing, sender and recipient sx_ identifiers, delivery state and activation requests. Operational logs may include routing identifiers and timestamps. See the privacy policy for the current data flow.

SecureChat is built by Vendetta Labs in Greece. The privacy policy describes the current data flow and contact channel. Regulatory compliance and data-subject requests are handled according to the data actually processed; encrypted content and signaling metadata are not the same thing.

Chameleon has no internet permission. It cannot send data anywhere, even if it wanted to. Everything stays on your phone. Your rules, your encrypted files, your settings — all stored locally in an SQLCipher encrypted database. The source code is on GitHub so you can verify this yourself.

Four layers work together. XChaCha20-Poly1305 provides authenticated message encryption, X25519 handles key agreement, the Double Ratchet advances message keys, and Argon2id provides memory-hard password derivation. Correct implementation, device integrity and key handling still matter; algorithm names alone are not a security guarantee.

Onion routing is a planned transport in which a message would pass through multiple relays. It is not implemented in the current release. Current network messages use the central StealthX signaling relay and must not be treated as Tor or multi-hop onion traffic.

Tap 5 times. Everything is gone in under a second. All messages, all keys, all contacts, all local data — wiped instantly from your device. No confirmation dialog. No undo. Designed for situations where you need your data to disappear immediately. It is like a self-destruct button for your entire chat history.

No. The public GitHub source is for inspection and security review only. Official app access, tiers, license keys, and StealthX services are controlled by Vendetta Labs. IFR is never used as an in-app unlock.

IFR is an Ethereum ERC-20 token. The Android app does not connect wallets. Eligible holders can prove wallet ownership in the browser before purchase for a 50% checkout discount; checkout remains fail-closed when the secure payment backend is unavailable. Details: IFR Token

The StealthX Suite is a planned bundle of SecureCall, SecureChat and Chameleon access. Current price, included versions, support scope and availability are controlled by VLABS. It is not sell-ready until every component and bundle gate passes.

Chameleon is a privacy layer for your entire phone. It runs quietly in the background and encrypts text in any app — automatically. It uses Android's AccessibilityService to read what is on screen, encrypts it with XChaCha20-Poly1305, and puts the encrypted version back. Think of it as a Privacy OS that makes your messages invisible to anyone looking over your shoulder. It is part of the SecureChat ecosystem. Learn more →

No. Chameleon uses Android's AccessibilityService, but only locally on your device. It never connects to the internet. It has no internet permission at all. Everything it does stays on your phone. The source is available on GitHub for transparency and security review.

No. Each app works perfectly on its own. SecureChat handles encrypted messaging. Chameleon handles overlay encryption across all apps. But together, they form a complete privacy layer. Chameleon can automatically protect your SecureChat conversations with an extra encryption layer, hide content when someone is looking, and switch to decoy mode based on your location. They are stronger together — but neither requires the other.