[ PRIVACY / EARLY BETA / 07 OCTOBER 2026 ]

Understand your vault.

Epyks keeps message history and contacts on your device. Encryption protects the vault while locked and encrypts messages between paired clients. This early beta has not had an independent security audit.

What persists on the relay

The application account database stores four authentication fields: your unique username, a salted password verifier, your recovery public key, and a recovery generation number. It does not store private recovery keys, contact lists, message history, device inventories, or an offline message queue.

Sessions, connection addresses used for rate limits, routing information, recovery challenges, and encrypted message handoffs are temporarily processed in memory. TLS certificate credentials are stored on the server for HTTPS. The relay must process connections to deliver messages; it cannot promise that no information exists anywhere.

Reports and bans

Reporting is voluntary. The iPhone report screen previews your handle, the reported handle, a reason, and any details or excerpts you type yourself. These fields are submitted to Epyks support for review; ordinary chats, contacts, keys, passwords and device data are not attached automatically. The separate report queue keeps submitted reports in server memory for up to 24 hours from receipt. Reports expire even if unread and are removed sooner when decided or when the service restarts. Repeating a report does not extend its expiry. Application deletion is not a guarantee of forensic memory erasure.

Reports are grouped for operator review and never automatically ban accounts. If the operator bans an account, a separate database retains only the canonical handle, reason code and ban timestamp until the ban is lifted. Deleting a report does not lift a ban. A ban stops that account connecting; it does not reliably prevent creating a different account. Personal blocked-contact lists stay in your encrypted local vault and are separate from service-wide bans.

iPhone delivery and local filtering

The iPhone app delivers while open, unlocked and connected. Backgrounding or locking the iPhone locks Epyks; this version has no push notifications or background delivery. A local English phrase filter checks outgoing text and hides matching incoming text in the iPhone interface. It never uploads ordinary messages for automatic moderation, and it can miss context, other languages and evasions. Windows builds have their own feature set.

Support contact

Contact cam.mckenzie.bush@gmail.com for help, appeals or privacy requests. General support email is voluntary, outside encrypted messaging, and handled by the support operator and Gmail under its policies. Never send passwords or recovery keys. Report contents are not automatically forwarded to email. The report queue cannot erase support email or the email provider's copies. See Support and Community guidelines.

What lives on your device

Messages, contacts, private messaging keys, recovery material, and queued outgoing messages are saved in your encrypted local vault. The local account selector also stores account handles and profile identifiers. Your device and operating system may create memory, backup, or other artifacts. A compromised or unlocked device can expose its local data.

Recovery keeps your handle and changes your password, but creates a new messaging identity with empty messages and contacts. It cannot restore the old vault history. Anyone holding your private recovery key can take over the account, so store it privately. Friends retain their own chat history and can request to add the recovered account again.

Message delivery and identity

Both people must be unlocked and connected for delivery. If your contact is offline, the encrypted outgoing message waits on your own device. Deleting or wiping that device's data can remove those unsent messages. With the updated relay, unlocked clients renew their 15-minute access credentials using a separate secret held only in memory. Both credentials rotate on renewal. No password or session credential is saved to disk or sent to the renderer. The relay retains only a renewal-secret hash in RAM, and a session cannot extend past eight hours after password login. Inactivity locking still applies, and failed renewal requires login again.

Unique handles identify accounts; they do not independently prove who controls an encryption key. Pairing uses first-contact trust. Use the optional fingerprint check through a trusted channel for additional identity assurance. MLS key updates and post-compromise recovery are not implemented in this beta.

Account deletion

The separate account deletion control removes the account authentication record and its current local vault. Other people's chat copies, voluntary support emails and any active ban record remain subject to their separate handling. Contact support for account deletion or an appeal if a ban prevents access.

Local deletion has limits

Wiping clears the app's local account data within its storage scope. It does not delete your account's relay authentication record, erase another person's messages, remove OS backups, or guarantee forensic erasure. Account recovery does not remotely wipe other devices.

Website and infrastructure

This download page has no analytics, advertising, tracking cookies, external fonts, or embedded third-party content. Its local animation script uses pointer coordinates briefly in browser memory to draw a fading trail; it does not record, store, or transmit them. The walking mascot opens the GitHub repository only when you click it. The supplied Caddy configuration omits access logs and discards its runtime logs; the relay service discards its stdout and stderr. Hosting, DNS, internet, or VPN providers may retain their own operational records. Their retention has not been independently verified.

The Donate link opens GitHub Sponsors, which applies its own policies. Epyks does not receive your payment details through the messenger.

Use it thoughtfully

Consider a VPN, avoid sharing your real name or personal information, and do not use Epyks for criminal activity. A VPN does not guarantee anonymity. Protect your password, recovery key, and device. The Windows beta is unsigned. iPhone builds distributed through TestFlight are signed. Broader testing and independent security review remain outstanding.