Pocket Radio is designed so that you don't have to trust us. The server is a relay and a noticeboard; the things that matter – your voice and who may join your channel – are controlled by the phones in the channel. Here's exactly what that means, including what the server can see.
Each channel has a secret key, created on the owner's phone. It's given only to approved members, locked so that only that member's phone can open it. Your phone encrypts your voice with it (AES-GCM) before it leaves the phone; the server passes on audio it cannot decrypt. Nothing is recorded – not by the server, not by the app. When someone is removed, the owner's phone makes a new key that they don't get, so they can't hear anything said afterwards.
Joining needs an invite, the channel password and – if the owner wants – their approval. Every membership is a pass signed by the owner's phone, and the channel key only reaches a member wrapped and signed by the owner – phones reject keys the owner didn't sign. So the server can't give the channel key to anyone the owner hasn't approved, and without the key there's nothing to hear.
There's no sign-up: no name, email address or phone number. Your phone is known only by a random-looking ID derived from a key it creates for itself – not your phone number or any hardware ID. You choose your callsign, and you can change it.
| The server can see | The server can't |
|---|---|
| Your callsign and the channel names you're in | Hear what anyone says |
| Which phone IDs are members of which channels, and when they're connected | Give anyone the channel key without the owner's approval |
| Your IP address while connected (needed to send you audio) – never logged | Learn channel passwords (only one-way hashes are stored) |
| When people talk (encrypted audio passing through) | Identify you from its logs (see below) |
The server keeps short technical logs to fix faults: what kind of request was made and whether it worked. They never contain IP addresses, phone IDs, callsigns, channel names, phone models or anything you say, and they're deleted within 7 days.
Technical details for the curious: P-256 keys generated in each phone's Android Keystore; channel keys wrapped per member with ECDH + HKDF + AES-GCM; membership passes and wrapped keys signed by the owner; voice via WebRTC with LiveKit frame encryption, keyed per channel-key epoch. Questions: support@pocketradio.net.