Why we keep your messages on your device

The first big decision we made about NatChatt was where messages live. Not whether to encrypt them — that was already a given — but where the actual conversation sits when nobody is reading it. The choice was between our servers, or the phones of the people in the conversation. We chose the phones.

This makes some things harder. It’s the right call anyway.

What this means in practice

When you write a message in NatChatt, it’s encrypted on your phone, sent through our network to the recipient, and decrypted on their phone. Both phones keep a copy. We do not keep a copy. If both phones lost their copy of the message, the message would be gone from the world; we couldn’t fetch it back for you.

That’s the trade. You get a messenger where the only people who have your conversations are the people in them. You don’t get the comfort of opening a fresh phone and seeing five years of chat history magically restored from a cloud you never thought about.

An on-device export tool is something we want to build — so you can take a backup yourself, encrypted with a passphrase you choose — but we haven’t shipped it yet. When we do, the passphrase will be yours alone; we won’t hold a copy, so losing it would mean losing the backup.

Why it matters

A messenger that knows what you’re saying in two languages would, in the wrong hands, be an extraordinary surveillance tool. Most of the messengers people use every day store their content on servers, in encrypted form sometimes, in plain text more often than they like to admit. The legal regimes those servers sit under shift over time. The companies running them get acquired. The interns who happen to have access to a database at 3am are human.

Our way of staying out of that is to not have your messages on a server in the first place. We can’t hand over what we don’t have. We can’t be hacked into a database we don’t maintain. We can’t be lawyered into producing what we never collected.

This is not a unique stance. Signal, for example, takes a similar position for the messages they protect. We’re building in good company, and we’ve learned from people who’ve done it before us.

Where the translation fits in

This is the question that usually comes next. If you don’t store messages, how does translation work?

Translation is the moment of the request. Your phone sends the contents to be translated to Google’s Gemini API, gets the response, hands it to the other phone, and we move on. We don’t store the request or the response on our end. Google does process the request at the moment it’s made, and per their paid API terms, doesn’t store it past that or use it for training. We talk about this in more detail on the privacy feature page.

It’s a meaningful exposure, and we want to be honest about it. If a translation has to happen, the contents of that one message pass through a third party in that moment. The difference from most cloud messengers is that nothing is being kept anywhere afterwards, by Google or by us.

The cost

Storing messages on devices means we can’t do some of the things cloud messengers do without thinking. We can’t restore your account fully if you lose your phone and your backup. We can’t offer a polished web client where you log in fresh and see everything, because the messages aren’t in a place we can fetch them from. We can do a paired web client that mirrors what’s on your phone, and we’re working on that, but it has different ergonomics.

We can’t use your conversations to improve search, recommend stickers, or train any model. We think that’s a benefit, but it does mean some shiny features are off the table.

What we’ll keep telling you

We will tell you when this position changes, if it ever changes. We will tell you, in the same plain words, what the change is and why we made it. We’d rather warn you than win you over.

For now, the answer to “where are my messages?” stays simple. They’re on your phone, and the phone of the person you’re writing to. Nowhere else.