Privacy

A Way has no accounts and no server that knows you. This page says what the app keeps on your phone, what the relay in the middle can and cannot see, and how long anything lasts.

No accounts

You never give A Way a name, a number or an email. The app makes its own keys on your phone the first time it opens. There is no sign-up, no password and no list of users anywhere. Your identity is the backup phrase under You › Backup; anyone with those words is you, and we never see them.

Who can see what

One service carries whispers between phones: the relay, which we run. Your phone leaves sealed envelopes in drop boxes there and collects from them. The relay cannot open an envelope, and nothing about a drop box says whose it is.

Who	Sees	Cannot see
Your phone	Everything you write and receive, inside an encrypted database behind the app lock.	Nothing is hidden from you.
A connection's phone	What you send it: your whispers, your whispers back, your posts and your shouts.	Your other connections, what you said to them, anything you read, saved or hid, whether you quieted them, or why a connection ended.
The relay	Your phone's internet address when it connects, roughly how much it sends, and the sealed envelopes and the drop-box addresses they are left in, and when. Every envelope is one of two fixed sizes, and each drop-box address is used once and says nothing about who it belongs to. Our code keeps no log and sets no cookie; the hosts it runs on, Cloudflare among them, see of this traffic what any host sees.	What any envelope says. It cannot open one; only the one phone it was sealed for can. Your name, your number or anything else about you, because the app never has them.
The people who make A Way	What you write to us, if you do. We run the relay; the next paragraph says what that means.	Anything on your phone, or what any whisper, post or shout says.

We run the relay. Because it sees both your phone's address and the drop boxes, we could, in principle, work out which internet addresses whisper to each other, and when. We keep nothing that would let us: our code keeps no log, and every envelope is deleted within a week. We could not read a whisper or a post, or learn your name, your number or anything else about you, because the app never has them and every message is sealed on your phone.

What travels, and how

Every whisper, whisper back, post and shout is sealed on your phone for one connection's phone, with keys that only the two of you share, made when you connected and changed with every message.
Envelopes are padded to one of two fixed sizes, so a long message and a short one look alike on the wire.
Your phone collects from addresses it is using and from addresses it is not, so a request looks the same whether you have one connection or many.
Sending waits a few random seconds, so a whisper's timing says less about when you tapped.
Everything to the relay travels over an ordinary encrypted connection, and inside it every envelope is sealed again, so the path carries only sealed bytes.

How long anything lasts

On the relay: a week. Every envelope is deleted after that, collected or not; the relay keeps nothing on disk in the first place, and no log.
On your phone: whispers and whispers back stay until you clear them or start over. Items on Read go after thirty days unless you save them. Whispers waiting to be sent are dropped after a week unsent.
In backups: none. The app's database is left out of iPhone and Android backups.

The check before sending

Before anything you write or shout is sent, your phone checks it. Today it looks for contact details: a phone number, an email, a link or a handle. The check runs on this phone only; the text goes nowhere for it, and no one is told. If it finds one, it stops the send and tells you why, and you decide what to do with your words. What it keeps is at most one mark per day that it stepped in, with no text and no time of day. It never keeps a history of what you wrote. Report works the same way: your phone checks the text again, nothing is sent and no one reviews it.

Read

Read shows what your connections post and shout. A post is a connection's own words. A shout is someone else's words they chose to pass on, a whisper back or something from their own Read; it is marked "Shouted out". Everything on Read came straight from one of your connections. No phone passes anything on by itself: for words to go one step further, a person shouts them. No service composes the list, and nothing is held by A Way.

Nothing on Read carries a name, and a shout says nothing about who first wrote the words.
What you post goes to your connections. Any of them can shout it to theirs, and they to theirs, one person's choice at each step. So your words can reach people you don't know, without your name on them.
A whisper back you write may be shouted onto Read by the person who received it. The composer says so before you send, and you are not told when it happens; the only place you could see your words again is Read.
When you make a new connection, it receives your last 30 posts and shouts, and you receive theirs.
Quiet sets everything from one connection aside until tomorrow: their whispers go to a Quiet section at the bottom of Listen, their posts and shouts to one at the bottom of Read, and tapping Quiet again brings it all back, with nothing marked new. Nothing is sent and the connection never knows. Silence ends the connection; they see that it ended, not why. Report does the same and keeps a private note on your phone.
Save and Hide stay on your phone; no one learns of them.
Your phone runs the same check over what you shout as over your own words.

What the app keeps on your phone

Your keys, in the phone's own key store, usable only while the phone is unlocked.
An encrypted database with: your connections, as the keys you share with each one and nothing else; whispers you wrote and received; whispers back; Read items; the queue of what is waiting to go out; your settings, such as the app lock, what you've quieted today, and the crisis line region; and a log of app events, such as a connection made or ended, with no message text in it.
No names, photos, phone numbers or contacts, because the app never asks for them. No location, ever.

The app lock is on by default and asks for your phone's unlock after half a minute in the background. Start over, under You, ends every connection and wipes its keys. Deleting the app deletes all of it.

What A Way never does

Ask for your name, number, or email.
Show anyone a list of your connections.
Count likes, followers, days, or steps.
Send what you write anywhere unencrypted.
Read what you write. The check before sending runs on this phone only.
Tell anyone whether you quieted them, silenced them, saved them, or started over.

This site

These pages set no cookies, run no scripts and load nothing from anywhere else. They are served by Cloudflare, which sees your address as any web host does, and there are no analytics on them. Writing to us by email shows us your address and what you wrote; we keep no list of who did. See Support.

Changes

This page changes when the app does. Last updated 17 October 2026. Published by MindStar Labs, LLC.