The messenger that keeps nothing on your phone.

zukka is a private messenger for Android built around one idea: your phone should hold nothing worth finding. There is no phone number and no email at sign-up — you create a nickname, a master password and an encryption phrase. Messages live encrypted on the server and are decrypted only on your screen, while you read them. You connect with people through disposable invite codes instead of a contact directory.

No — neither. Registration asks for a nickname, a master password and an encryption phrase. Nothing else. The nickname is used only to log in and is shown only to people you've invited; it is not searchable, so nobody can find you by guessing it. There is no SMS verification, which also means there is no phone number anywhere to leak, sell or subpoena.

An invite is a disposable code like 2612-0614-3022-4817. You hand it to someone (or publish it); when they activate it, you become contacts.

The crucial part: the invite is only the entry door, not the relationship. Deleting or revoking an invite never affects the people who already joined through it — their conversations with you continue exactly as before. Revoking only stops new people from using the code. Example: you give one invite to ten colleagues; later you revoke it. All ten keep chatting with you. The eleventh person who finds the old code gets nothing.

Yes — that's a core use case. Publish a public invite where people can find you: your site, your bio, a flyer. Anyone interested activates it and reaches you directly.

When spammers eventually discover it, you simply rotate the code: revoke the old invite and publish a fresh one. Every real contact you made keeps talking to you, and the spammers are locked out instantly. Compare that with a phone number: to escape spam you'd have to change it — and lose everyone. Invites can also carry limits (how many activations, until when), so a public door is only as open as you choose.

No message history, no photo or file archive, no readable contact list. Your conversations are stored encrypted on the server and decrypted locally, on screen, only while you view them. The device keeps just what's needed to log in — including one half of the split encryption key, which is useless by itself.

Practical consequence: if your phone is lost, stolen or taken, your message history simply isn't in it. And the half-key it holds cannot decrypt anything without the other half and your phrase.

Three layers work for you. First, there is no stored history on the device to read. Second, the encryption key is split — the half on the phone cannot decrypt anything alone. Third, remote kill: the server's half of the key can be destroyed, after which nothing tied to that account can ever be decrypted again, on any device.

We choose our words carefully here: we describe mechanisms, not guarantees. No app can promise what a determined adversary with unlimited resources may achieve. What zukka ensures is that your phone holds as close to nothing as we can engineer.

zukka assumes that under real pressure, people give up codes — so it's built for that. You can run multiple accounts behind different PINs on the same app. Under pressure, you give the PIN of an unremarkable account: you cooperated, they saw an account, the story ends.

Why is this better than "hidden folders"? Because hidden-folder apps betray themselves: once such an app is known, everyone knows to demand the hidden part. zukka has no account limit, so there is no way to tell whether a person has one account or several — nothing to demand, because nothing indicates more exist.

There is also a panic password: a separate password you configure in advance which, when entered at login, destroys the data. It has no undo — we state that clearly when you set it up.

The server's job is to store and route ciphertext — encrypted blobs it has no keys to open. Message content is encrypted with per-conversation keys that are themselves stored wrapped under your phrase-derived key, which only you can compute. A leak of our database would reveal neither your keys nor your messages.

We hold ourselves to honest claims: we won't dramatize, and we publish what the design does and doesn't protect. What we never do is store your conversations in readable form, log message content, run ads, or sell data — there is nothing readable to sell.

Your data is gone. There is no recovery. No reset email (we don't have your email), no security questions, no support backdoor. The phrase is the only thing that can complete the key protecting your conversations — and we never see it.

We say this loudly on purpose: any service that can "recover" your encrypted data can also open it without you. The absence of recovery is what your privacy costs. Write your phrase somewhere only you control.

Signal is excellent at encrypting messages in transit — but it requires your phone number, and it stores your message history on your device. WhatsApp likewise requires a number and keeps local history, and it lives inside an advertising company. Telegram requires a number and doesn't even encrypt chats end-to-end by default.

zukka's difference is the focus: it is designed for the moment the device itself falls into the wrong hands. No phone number to identify you, no local history to extract, a split key that's never whole in one place, multi-account plausible deniability and a panic password. If your threat is "someone reads my traffic", several apps do well. If your threat includes "someone takes my phone", that is what zukka is built for.

The traveler: crossing borders where phones get inspected. There is no message history on the device to scroll through.

The journalist and the source: each source enters through their own invite. Cancel one invite or contact and only that thread disappears — no address book ever links them together.

The family that wants quiet: parents and kids connected only to each other. No number means no scam calls, no "you won a prize" messages, ever. Each family member gets their own notification sound, so you know who needs you without looking.

The professional with a public face: publish a public invite as your "line" — clients reach you directly. When spam starts, rotate the code: clients stay, spam dies.

Anyone whose work pressures their privacy: a separate account behind a separate PIN keeps the sensitive line invisible inside the everyday one.

Yes — encrypted one-to-one voice and video calls, plus groups (up to 20 members) created the same way everything happens on zukka: through invites. Messages support photos, videos, files, voice notes and locations; photos and documents are stripped of hidden metadata (GPS, author, timestamps) before they're encrypted and sent.

zukka is launching on Android first — both on Google Play and as a direct APK download from this site, with a published checksum so you can verify what you install. An iOS version is on the roadmap after the Android launch settles.

That instinct is exactly who zukka is built for — and we're engineering it so you need to trust us less and less.

Today (live): our server stores only ciphertext it has no keys to open. A database leak would reveal neither your keys nor your messages.

At launch — Master mode (the "Master (advanced)" account type in the app): you run two devices. One — the master — stays somewhere safe with a good connection and holds all your data: contacts, messages, files. Your everyday phone holds nothing, as always. And our server? It stores nothing at all — it becomes a blind courier. When your everyday phone needs something, the request is relayed to your master; the master answers from its own storage; the answer is relayed back. Your data — even in encrypted form — never lives on our infrastructure. (A direct device-to-device link is theoretically possible if you can set it up, but today's networks make that hard — that's what the relay solves.)

Planned — Self-hosted: a ready-made package that runs the entire zukka backend on your own server, for a fully autonomous closed network — zukka the company is no longer part of the picture. The trade-off: it connects only your own circle.

For organizations and government security agencies, custom deployments are on the longer-term roadmap.

Healthy instinct — keep it. We try to earn trust the only way that works: by claiming less, precisely. Notice what this site does not say: it never promises you are "untouchable", "invisible" or "safe at any checkpoint". It explains mechanisms — what is stored where, what each half of a key can and cannot do, what is unrecoverable and why. Where there is a limit, we state it (see What we won't promise you). Bold claims are cheap; precise ones can be checked.