How Disavow Works
Disavow is a lightweight instant messenger built to give you exactly what you need and none of the things you don't. It works just like an authentication app, where two devices use a shared seed to calculate the same values at the same interval, over and over again. Disavow is built on three core mechanisms:
Explicit Trust: Contacts are added exclusively through an in-person, digital handshake. There is no search bar or user directory, meaning you are completely invisible to the network. Every message you receive is mathematically guaranteed to come from the specific person you performed a handshake with.
Pairwise Rotating Addresses: There are no phone numbers, usernames, accounts, profiles, or static identifiers of any kind. Disavow uses daily-changing inbox addresses derived from the shared seed exchanged during your initial handshake. Disavow's servers route messages to these temporary addresses but have no way of knowing who they belong to or who is talking to whom.
Blind Licensing: We use “blind licensing” to collect a monthly subscription without knowing anything about you. When you subscribe, your app receives an anonymous purchase token from Google, which your app then forwards to our licensing server along with a sealed license request generated by your device. Our server then cryptographically stamps your license request after independently verifying the purchase token with Google. Your device then unseals your stamped license and uses it to register your daily inboxes. This flow allows us to know you are real (preventing spam) and that you paid without knowing anything about you.
Disavow also gives you the unique ability to unilaterally destroy an entire conversation or a single message end-to-end. The namesake Disavow feature lets you swipe left on any contact to instantly erase all message history, encryption keys, and shared seeds from both your device and theirs, without any consent from the other party. Before releasing device memory, it is overwritten with garbage data, leaving absolutely no trace that the conversation ever occurred.
Other key features include:
End-to-End Encryption: Every message is encrypted on your device before it ever leaves, using a Double Ratchet protocol that derives a unique key for each message. Disavow's servers only ever see opaque ciphertext—they cannot read your messages.
Nightly Rollover: Each night, your app independently calculates and registers new inboxes for every one of your contacts alongside a new anonymous "push token" from Google (used to notify you that you have new messages). This means that our servers have no way to know which inboxes and push tokens are associated with the same user across any two days. Because the inbox IDs are 32-byte hexadecimal addresses calculated independently on your device, it is mathematically impossible to graph your social network even with full access to our servers. Combined with our blind licensing and explicit trust mechanisms, this is what makes Disavow the most secure and anonymous messaging app on the market.
24-Hour Message TTL: Messages live only in working memory (RAM) and are never written to disk, nor are any logs ever saved. They are held on Disavow's servers for a maximum of 24 hours. Once retrieved by the recipient, they are immediately deleted. Any message not collected within 24 hours is permanently discarded.
Complete Invisibility: There are no search bars because there is nothing to search for—you cannot be found on our network. The only way to chat with someone is to conduct a handshake with them in person or over a video call like Zoom.
No Tor Routing: We do not use the Tor network. This means messages are sent through legitimate infrastructure, arrive instantly, and won't flag your device on ISP monitors.
Cliques : How they Work
For group messaging, Disavow supports Cliques. In graph theory, a 'clique' is a group where every single person is already directly connected to every other person. In the context of Disavow, this means a clique is a group chat where every single member has already established a direct, pre-existing cryptographic trust relationship (a 1-on-1 handshake) with every other member.
Because of this strict full-mesh constraint, a clique is the most secure form of a group possible. You cannot add a stranger to a group, nor can you be added to a group with people you haven't explicitly verified in person. This guarantees that no transitive or proxy trust is ever used. There are no group administrators, no central group servers, and absolutely no metadata mapping who belongs to what group.
How group routing works without a central server:
Dedicated Group Inboxes: To prevent group messages from contaminating your private chats, Disavow mathematically derives a unique, separate inbox ID specifically for the clique. Furthermore, Disavow's servers have absolutely no way to know whether an inbox ID is associated with a standard 1-on-1 P2P connection or a group chat.
Client-Side Fan-Out: When you send a message to a clique, your device encrypts the message once, and then individually transmits copies of that ciphertext to the dedicated clique inboxes of every other member. The server simply holds the ciphertext in those inboxes until the members retrieve it.
Clique Management & Transparency:
Roles & Options: Creators can add members, kick specific members, or dissolve the entire clique. Members can choose to leave the group at any time.
Independent Connections: A clique is a separate communication layer. Leaving a clique, or kicking a member from it, only destroys the group chat on that device. It does not sever the underlying private 1-on-1 connection with those members (which must be disavowed separately).
Group Healing: When membership changes (e.g., someone leaves or is kicked), the remaining members automatically 'heal' the group by regenerating a new shared clique inbox and synchronizing it with the new roster, instantly cutting off the removed member.
Transparent Membership: Every member can click the info icon on the clique to see a complete list of all other members, just like the creator.
Locally Managed Profiles: There are no central group profiles. The names of the members in the clique are displayed using the private, local labels you already assigned to them during your 1-on-1 handshakes.
Trust Cascade: Because Cliques are built entirely on explicit 1-on-1 trust, if you individually disavow a P2P contact, your device will automatically withdraw you from any cliques where you both share membership. Disavowing a peer implies the fundamental foundation of trust is broken, so all derivative group access with that individual is instantly severed.
This architecture requires your device to do more work and does not scale well to massive groups. However, we assume our target users will be communicating in small, tight-knit groups anyways. We explicitly reject transitive (proxy) trust models because they are inherently less secure, opting instead to enforce the most secure type of group possible. By refusing to route messages through a central group server or introduce metadata-heavy group profiles, the most hardcore and secure way to build a group chat is to use a clique—and that's exactly what we support.
