Frequently Asked Questions

What happens if the entire server gets hacked or leaked?

Even in a catastrophic worst-case scenario where the entire server database is leaked or compromised, attackers will see nothing but random IDs and scrambled text across the entire database.

Here is exactly what exists on the server database vs. what attackers see:

Random Room IDs (No Room Names): The database stores only random cryptographic Room UUIDs (e.g. a3f89021-...). Your real human-readable room names (like "Private Chat" or "Family") exist only on your phone's local storage.
Random PairCrypt IDs: You are identified on the server only by a random UUID string. There are no names, emails, phone numbers, or passwords anywhere in the database.
Scrambled Messages (ciphertext & nonce): Messages exist on the server as unreadable, random strings of characters (AES-256-GCM payload and random nonce). To unlock or read them, an attacker would need the secret key—but that key only stays inside your device's storage and is never uploaded anywhere.
Unlinked Receipt Tokens: For paid subscribers, the database stores payment receipt tokens to confirm active subscriptions. However, these tokens are completely separated from your PairCrypt ID and Room IDs using blind cryptography (VOPRF).

What if Google Play or Apple App Store is also hacked (Double-Breach)?

Even if attackers compromise both our server and Google/Apple payment databases to cross-reference receipts, they still cannot link your payment identity to your PairCrypt ID or chat rooms when Tor is enabled:

Signal 1 Stream Isolation (IsolateSOCKSAuth): Subscription verification (Signal 1) uses a special isolated Tor stream with unique credentials, forcing Tor to build a dedicated circuit with a completely different exit IP address. Signal 2 and chat traffic use your main app Tor circuit.
Automatic Safeguard: The app actively checks both IP addresses before verifying receipts—if the IPs ever match, the request automatically aborts to protect your privacy.
Different IP Timestamps: Even if attackers attempt to match timestamps and IP logs, they see completely different IP addresses.

The Bottom Line: The only thing an attacker could ever know is that a Google/Apple account paid for the app—that's it. They can never discover your PairCrypt ID, or which rooms you created, joined, or use.

Does PairCrypt store text messages on the server? How long do they stay, and how does history sync work if there is no chat history on the server?

No. We never store your readable messages on our servers. All messages are locked on your device before they are sent.

1. Your Messages Are Locked Before Leaving Your Device

When you type a message, your device locks it using a secret key (AES-256-GCM encryption). The server only sees scrambled gibberish (ciphertext). Because your secret key stays strictly on your device and is never uploaded, nobody—not even us—can read your messages.

2. How Long Messages Stay On The Server

Encrypted messages are processed as temporary transit payloads (transient relay buffer):

Delivered Messages: Deleted immediately from the server as soon as your friend's device receives them.
Undelivered Messages (Friend Offline): Held temporarily for up to 3 days maximum while waiting for your friend to open the app.
Expired Messages: If undelivered after 3 days, automated server cleanup routines (TTL maintenance scripts) automatically delete them permanently from the server.

3. Getting Older Chat History

Our server does not keep a permanent cloud backup of your old messages (centralized chat database):

If you need to load older messages (or if a new person joins the room), both you and an active friend who has the past chat history need to be online in the room at the same time for a moment.
Your friend’s device will automatically copy the missing past messages directly from their device storage (local encrypted database vault) over to your device.
Just stay on the chat screen for a few seconds to let the history transfer complete!

In Short: Recent messages pass through a temporary waiting room on the server so you can text anytime. Older messages live only in your storage and are copied directly from device to device.

What happens if I forget my Passlock PIN? Can you reset it for me?

No. We cannot reset your Passlock PIN. The PIN is stored locally on your device. There are no master admin passwords, recovery emails, or reset links on any server. If you forget your PIN, the only recovery path is to reinstall the app, which permanently erases your encrypted local vault.

If I delete a room or message on my phone, does it delete it from my friend's phone too?

No. Deleting a room on your device erases local database records on your physical device. It does not forcibly delete local database copies already saved on your friend's device. Each member's device holds an independent local vault. To block someone from receiving future messages, you must Kick them, which rotates the room's master key and revokes their relay access.

Why do Online Rooms require a subscription? Is this a paywall?

Operating real-time relay servers, WebSockets, and bandwidth costs money. Instead of selling user data or running tracking ads, PairCrypt uses optional subscriptions. At least one user in an Online Room must hold an active subscription to maintain relay access. Offline Rooms remain free and private by design with no message limits because they run entirely on your local phone without using server infrastructure.

How does subscription verification protect my payment identity?

Subscriptions use an Elliptic Curve VOPRF (Verifiable Oblivious Pseudorandom Function) blind signature mechanism split into two signals. When Tor is enabled, Signal 1 verifies your Apple/Google receipt over a dedicated, single-use isolated Tor circuit (IsolateSOCKSAuth) with a strict pre-flight IP firewall guard, ensuring receipt verification never shares an Exit Node IP with general app traffic or your PairCrypt ID. Signal 2 redeems the signed voucher when you tap the Activate button to set your Subscription status to Active. For maximum privacy, waiting a short while before tapping Activate prevents any potential timestamp correlation between Signal 1 and Signal 2. Expiration dates are rounded to the end of the month (23:59:59) to blend your voucher into a monthly anonymity pool.

Can I use one subscription on multiple devices?

Yes. A subscription allows up to 15 purchase restorations per month to support reinstalls and device switches. You can also generate a 31-day activation code to link a desktop device. To prevent receipt-sharing abuse across large groups, exceeding 15 restores in a single month blocks further voucher requests until the next billing cycle.

What happens if PairCrypt's servers go down or shut down tomorrow?

If the relay server goes offline, real-time Online Room messaging will fail to transmit across the internet. However, all existing chat notes and history saved in your local encrypted vault remain safe and accessible on your device. Offline Rooms will continue to work normally because they do not depend on server infrastructure.

How do I know the app isn't secretly sending my keys to your server?

Your encryption keys are created directly on your device and saved in your device storage. They are never uploaded to our servers.

You can easily verify our security claims yourself using network monitoring tools (like PCAPdroid or Wireshark):

Verify Message Encryption: Inspect the message payload in PCAPdroid or Wireshark to confirm that only scrambled text ("ciphertext": "a7f8b9...") leaves your device.
Verify Tor IP Routing & Isolation: Inspect the packet IP headers to confirm that all traffic routes strictly through Tor, and that payment verification uses a separate Tor circuit with a different exit IP address.