Private by design, not by promise
PeerFlow is built so the server can’t see what you share. Here is exactly what is protected, how, and what the server does know.
Read the privacy policyWhat is encrypted
Everything you create is encrypted before it leaves your device.
- Messages: ECDH P-256 + AES-256-GCM, sealed separately for each recipient
- Calls and screen sharing: WebRTC (DTLS-SRTP), authenticated with both people’s keys
- File transfers: WebRTC DataChannels (DTLS)
- Chat history and call log on your device, and the sync-folder file: AES-GCM with a key only your password unlocks
Signing in
Your password never leaves your device — the server receives a derived secret. New accounts confirm their email with a code, and every sign-in needs a fresh 6-digit code from your email as a second step.
What the server does see
To introduce devices and deliver messages to people who are offline, the server knows your account email, name, username, photo, contacts and groups, when you were last online, and encrypted messages waiting for delivery (deleted once delivered). It never has your keys, your message contents, or your calls.
Common questions
Open the chat’s menu → Verify encryption and compare the safety number with your contact in person or on a call. If they match, nobody is in the middle.
No. Administrators can see account details and usage counts, never message contents or calls.