Security
Built to keep your conversations yours.
NV is designed so that your private messages belong to you — not to us. Every layer, from the crypto in your DMs to the padlock on your phone, exists to make that true in practice, not just in a privacy policy.
What actually protects you
Personal chats use the same family of cryptography as Signal: X3DH for key agreement, a Double Ratchet for forward secrecy, and XChaCha20-Poly1305 to seal every message. Your device and theirs hold the keys — our servers never see the plaintext.
Your phone number and email are stored encrypted with AES-256-GCM, not in plain text — even a database snapshot doesn't hand them over. Lookups run against a separate one-way hash, never the raw value.
Lock NV behind Face ID or Touch ID so opening the app — not just your phone — needs to be you. Your chats stay closed to anyone who picks up your unlocked phone.
Add a second password on top of your login code. Even someone who intercepts an SMS or email code can't get into your account without it.
Settings → Devices lists every session on your account in real time — model, location, last active — with a one-tap remote sign-out for any device you don't recognize.
We don't run ads and we don't sell what you say or who you say it to. There's no business model here that depends on your data being worth something to someone else.
How the encryption actually works
When you message someone for the first time, your devices run an X3DH key exchange — a one-time handshake over public keys that only the two of you can turn into a shared secret. From there, a Double Ratchet advances the encryption key with every message, so a single compromised key never exposes past or future messages. The messages themselves are sealed with XChaCha20-Poly1305, an authenticated cipher that also detects tampering. Group and channel messages currently travel over TLS in transit rather than this end-to-end scheme — that's next on the roadmap.
Found a security issue?
We take reports seriously and respond fast. Email us directly — no bug bounty bureaucracy, just a real conversation with the team that ships the code.
support@thenv.org →