Tech Overview

What Hubyn is

A private messenger and collaborative workspace for iPhone and Mac with its own identity system. On the Mac, full CRDT pages, an audio workspace with on-device transcription, and Jimmy intelligence sit beside messages and calls. Jimmy runs on the shared Neutron Engine foundation also used by Neutron Studio. No phone number, no contacts upload, no tracking tools riding along. The iPhone owns your account. The Mac is a linked companion — it can join, but it can never create or recover an account on its own.

• CRDT workspaces allow collaborators to edit shared pages and converge their changes without turning the page into a static chat attachment.
• Audio recordings and their on-device transcripts remain organized inside the workspace.
• Jimmy works locally with the workspace material available on the Mac; private workspace content is not sent to a cloud AI service for inference.

How we build it

Five rules decide every argument inside the product.

• No homemade encryption. Message secrecy comes from libsignal, the same protocol family behind Signal.
• Fail closed. When something is missing, broken, or ambiguous, the app refuses instead of guessing.
• Infrastructure stays blind. Relays and servers never hold readable content or unilateral control of your identity.
• Privacy is the default, not a setting you have to find.
• Honest boundaries. What we don't protect against is written down, not buried.

Identity without a phone number

You are a durable handle plus a PIN — in the spirit of BBM, but the trust underneath is cryptographic. Your keys, not a carrier record, prove who you are. Devices are listed in a signed set, retired device slots are never reused, and a removed device cannot quietly return.

Hubyn PIN

Reachable handle

Signed device set

Keys prove ownership

Your devices

Retired slots stay retired

Recovery you hold, not us

Recovery takes two things: a recovery code only you hold, and an encrypted envelope synced on your behalf that we cannot open. There is no operator bypass. Lose every device and the code, and the account is gone — support cannot restore it. Today that code plus envelope is permanent root authority and cannot be rotated, so treat a copy of it as a copy of your account.

Recovery code

Held only by you

Encrypted envelope

Synced, unreadable to Hubyn

Recovered account

Both are required

Adding people, with consent

Nothing arrives until you allow it. Connection requests are explicit, blocks are enforced, and content is refused unless sender, route, and consent all line up. First contact comes in two strengths, and the difference is real:

PIN or code

Request only

Explicit review

Accept or decline

Conversation route

Created by consent

• Scanning a code is strong. The code commits to a specific key, so a hostile directory cannot swap someone in — the add simply fails.
• Typing a PIN alone is weaker. It relies on directory integrity plus verifying your safety number in person or by voice.
• One honest note: a party who can resolve your handle can tell that someone tried to reach you — never who you talk to or what was said.

Messages are sealed before they leave

One-to-one chats use X3DH, the Double Ratchet, and PQXDH for post-quantum hardening. Groups of up to 16 use Sender Keys with explicit invites, and both routing and group keys rotate whenever someone joins, leaves, or is removed. Delivery, acknowledgment, and key advancement commit together, so a crash never loses or duplicates a message.

Readable message

On your device

Sealed envelope

Encrypted before transit

Recipient device

Opens locally

Relays that cannot read

Our relay stores sealed records under rotating tags and random names. An operator sees opaque identifiers, rough timing, and sizes — never content, identities, or who talks to whom.

Sender

Seals content

Blind relay

Opaque IDs, timing, sizes

Recipient

Decrypts content

• Deleting a record needs a secret, not an address. Knowing where a record lives authorizes nothing.
• Nearby devices can hand off the exact same sealed envelope over a direct local link, with no ID, key, or contact exposed during discovery.
• A local handoff carries messages. It never grants identity, membership, or recovery authority.

Two locks on the device

The local database is encrypted with SQLCipher, and every message record is sealed again with a key that never enters an iCloud or device backup. A fully restored backup is still locked without that key, which stays on the device only. If part of the database is damaged, it is quarantined rather than quietly treated as empty — and there is no message history recovery after device loss, by design.

SQLCipher

Encrypted database

Record seal

Second device-only key

Device

Key excluded from backup

Photos, files, and voice notes

Attachments up to 25 MB are encrypted in authenticated pieces under a key unique to that file, stored as random-named ciphertext, and expire after seven days. Voice transcription and the Mac audio workspace run on your device only — if on-device speech isn't available, the note simply sends without a transcript. There is no cloud transcription, ever.

Linking your Mac

Linking is an explicit, user-confirmed scan. The Mac receives revocable, scoped authority — not ownership. Apple's hardware attestation exists on iPhone and has no Mac equivalent, so the Mac fails closed on operations that require it instead of quietly accepting a weaker check.

iPhone owner

Confirms the scan

Scoped authority

Revocable, not ownership

Linked Mac

Fails closed when required

Defaults that protect you quietly

Notification previews show only "Hubyn — New message" until you opt into more. Read receipts are off until you turn them on. If a preference record is missing or unreadable, it resolves to the most private option — never silently back to open.

How this compares

Signal-grade message cryptography is not the differentiator — everyone serious uses it. The combination is: that cryptography with no phone number, no contacts pipeline, no telemetry, a backup-excluded local seal, and relays holding only opaque ciphertext under deletion secrets they never see. Unlike cloud-backed messengers, history is unrecoverable after full device loss — on purpose.