Architecture
Every component, and what it can see
A privacy claim is only worth what a reader can check. This is the full list of parts in the system, who runs each one, and what each can observe - including the one machine we run ourselves.
PrivaMesh has no account database and no message store. It does have a fee worker that sponsors each transaction, an RPC endpoint operated by a third party, and a public chain that stores ciphertext permanently. All three are listed below with what they can observe.
How a message travels
01
Your iPhone
Encrypts and pads the message, derives the one-time address
02
Fee worker
Sponsors the network fee, spends one blind token
03
RPC endpoint
Submits the transaction to the network
04
Solana
Carries the padded ciphertext to a one-time address
05
Their iPhone
Scans for its own one-time addresses and decrypts locally
What each component can observe
| Component | Operated by | What it sees | What it stores | Replaceable |
|---|---|---|---|---|
| iOS clientThe only place plaintext and keys ever exist. Keys sit in the iOS Keychain behind Face ID and never sync to iCloud. | You | Plaintext, keys, contacts | Everything, on device only | Yes |
| Fee workerSponsors the network fee so you never hold SOL. It is the one machine we run, and the honest limit of the design. Blind tokens mean it cannot link a send back to a purchase. | PrivaMesh | An account, a timestamp, a spent blind token | Operational logs only - no plaintext, no recipient | Partly |
| Solana RPCSwappable and self-hostable. This is the component most likely to see your network-level activity, and the one we have least control over. | A third-party provider | Your IP address, request timing, transactions you submit | Whatever that provider chooses to log | Yes |
| Solana networkThe transport. Everything written here is padded ciphertext addressed to a one-time key, but it is written forever. | Nobody in particular | Ciphertext, one-time addresses, transaction timing | Permanently, and publicly | No |
| StoreKitUnavoidable for in-app purchases on iOS. Blind tokens are what stop the purchase from being linkable to your messaging activity. | Apple | Your purchase and your Apple ID | Per Apple policy | No |
Why the fee worker exists
Every message is a Solana transaction, and transactions cost a network fee. Making users hold SOL to send a message would be a worse product and a worse privacy story, because funding a wallet is itself a linkable act. So a worker sponsors the fee instead.
That creates the obvious question: does the sponsor learn who is talking to whom? It does not. The app proves its subscription once and receives a pool of RSA blind signatures; each send spends one token. The worker can verify a token is valid and unspent and cannot link it to the purchase or to any other token. What it sees is that some account paid for some send at some time.
What this design does not fix
The RPC endpoint sees your IP and the timing of your requests. The chain stores ciphertext permanently. Neither is hidden by anything above, which is why both are in the table and why the limitations page exists. If your threat model includes a network-level observer, pair PrivaMesh with a VPN or Tor and self-host the RPC.
Frequently asked questions
Does PrivaMesh run any servers?
One. A fee worker sponsors the Solana network fee for each transaction so you never have to hold SOL. It sees an account and a timestamp and never sees plaintext or a recipient. There is no account database and no message store.
What can the RPC provider see?
Your IP address, the timing of your requests, and the transactions you submit. It is the component with the clearest view of your network-level activity, which is why it is swappable and self-hostable.
What happens if the fee worker goes offline?
Sending stops working until it comes back or you fund transactions yourself. Your identity, contacts and message history are unaffected - they live on your device and depend on nothing we run.
Can Apple see who I message?
Apple sees that you bought a subscription and which Apple ID bought it. It does not see your messages or your contacts. Blind tokens are what keep the purchase from being linkable to your sending activity.