Encrypted connections
Every connection between your device and TeleVani is encrypted, and our apps refuse impostor servers.
End-to-end Secret Chats
Messages, media and calls in Secret Chats can be read only by the two devices in the chat.
Two-step verification
Add a password on top of the SMS code, so a stolen SIM alone can't take your account.
You control your sessions
See every device signed in to your account and sign any of them out instantly.
Encryption in transit
All traffic between the TeleVani apps, the web client and our servers travels over encrypted HTTPS and secure WebSocket connections. The mobile and desktop apps also pin our server certificates, so they refuse to talk to a server pretending to be TeleVani — even on a network that tries to intercept the connection.
Cloud chats and storage
Ordinary chats, groups and channels are cloud chats: they are stored on our servers so that they sync instantly across all your devices and survive a lost phone. Photos, videos and files are kept in Cloudflare R2 storage, which encrypts everything it stores at rest. Access to our servers is restricted to the people who run the service.
Secret Chats: end-to-end encryption
Secret Chats are encrypted on your device and decrypted only on the other person's device. TeleVani's servers pass the messages along but cannot read them, their media or their calls.
- We do not write our own cryptography. Secret Chats use vodozemac, the independently audited implementation of the Olm and Megolm protocols published by the Matrix project.
- Files sent in a Secret Chat are deleted from our servers as soon as the other device downloads them, or after 7 days.
- With Send files directly, files go device to device and never reach our servers at all.
- Calls started from a Secret Chat are end-to-end encrypted too.
Signing in
You sign in with your phone number and a one-time code sent by SMS. To stop people guessing codes or flooding a number with them, requests and attempts are rate limited, and repeated wrong codes lock further attempts for a while.
For stronger protection, turn on two-step verification: then a correct SMS code is not enough to get into your account without your password.
Devices and sessions
Settings › Devices lists every phone, computer and browser signed in to your account, with when it was last active. You can sign out any of them, or all of them at once. Desktop and web clients are linked by scanning a QR code with your phone, and a device linked that way can't change your account's phone number.
Privacy controls
- Choose who can see your phone number, profile photo, last seen, bio and birthday.
- Choose who can call you and who can add you to groups.
- Lock the app with a passcode on your device.
- Block anyone, and report spam or abuse to our moderators.
- Export your data or delete your account at any time.
Reporting a vulnerability
Found a security problem in TeleVani? Please tell us privately at [email protected] before sharing it publicly, with enough detail for us to reproduce it. We will reply, fix it, and keep you informed.
How we handle your data is described in our Privacy Policy.