The security model, honestly

The one-sentence model

Your circle’s phrase is computed on each member’s own phone from a shared secret that our servers never hold, so the thing scammers would need to steal simply isn’t on the internet.

What our servers store, and what they can’t read

We store what you’d expect of any app: your account, your circles’ names, who’s in them. We do not hold your circle’s secret or its phrase. The secret is created on a phone, travels inside invites in a sealed form (the key that unlocks it rides only in the invite link itself and is never sent to us), and lives in each iPhone’s secure hardware. Personal invite videos, verification videos, and challenge answers are all encrypted on the sender’s device so that only the intended person can open them. If our servers were breached, the attacker would find ciphertext they cannot decrypt.

This has a real cost, and we accept it: if you delete the app or lose your phone, we cannot restore your circle keys, because we never had them. You rejoin with a fresh invite. We think that trade is exactly right for a safety product.

What each check actually proves

• A matching phrase on a call proves the caller can see your circle’s current words right now, which means they hold a circle member’s phone.
• A passed SafeText or SafeVideo challenge proves the person behind that specific conversation holds the claimed member’s signed-in phone. Nobody else’s phone can answer for them.
• A personal invite video with matching check words proves the invite came from the face and voice you recognise, made for that exact invite.
• In-person verification proves the strongest thing of all: same words, two screens, one room.

The limits, stated plainly

Deepfakes exist. A determined attacker can fake a face and a voice. Check words force any fake to be made freshly per invite, which kills mass scams, but a targeted attacker with time is not stopped by any video alone. That’s why the app keeps repeating the same advice: unexpected contact means call the person on a number you already have.

A stolen, unlocked phone is the holder. Every check ultimately trusts the member’s phone. If that phone is in the wrong hands, use the tools built for exactly that: freeze the member, then rotate the circle key. Minutes, not days.

We’re one layer, not the only layer. SafePhrase makes “check it’s really them” take five seconds instead of feeling awkward. It works best alongside the habits it encourages: expect verification, never rush, and when in doubt, hang up and call back on a number you trust.