Own your conversations
Your conversations are a campfire deep in a night forest — heard only by those sitting around it.
Today your conversations mostly live on someone else's servers: the platform owns your identity and your social graph, and can read, censor, block, or even sell it. Accounts get suspended, data gets subpoenaed, rules change overnight. Cinderous inverts that — your identity is a key that exists only on your device, messages are encrypted before they ever leave, and delivery rides on relays anyone can self-host. No company sits between you and your friends; control over your conversations returns to the people having them.
Your identity is a key, not a platform account. No one can suspend, block, or sell it; lose all your devices and the account simply ends — there is no central record to seize.
Plaintext never leaves your device; everything is end-to-end encrypted. Message senders are hidden behind one-time keys, so relays have no conversations to browse. Want even the metadata in your own hands? Self-host your own relay.
No central server, no single entry point. Delivery rides on relays anyone can host plus peer-to-peer links; this forest is held up by many small fires — put out any one and it stays lit.
AGPL-3.0 licensed and fully auditable. No ads, no selling accounts, no cut of any transaction; it runs on voluntary donations and self-hosted nodes — not on your data.
Whichever version you use, plaintext and your private key stay on your device — no central database, no account to subpoena. The only difference is how the private key is kept.
The private key is held in the OS keychain (Windows Credential Manager / macOS Keychain / Linux Secret Service); messages and contacts sit in AES-256-GCM–encrypted files on your local disk. Plaintext never touches the cloud.
A browser has no OS keychain — the private key is wrapped with your local password (Argon2id) and stored in the browser; messages and contacts are encrypted in the browser (localStorage / OPFS), scoped to the site and kept on your device. The hosting site only serves code and stores zero user data. Clearing site data or forgetting the password erases the identity — back up your nsec / rescue login code.
Across all versions: relays can't see your data — Relays only briefly hold ciphertext offline messages (capped and auto-expired), seeing neither content nor sender. Only if you enable multi-device state sync does an encrypted state snapshot live on your relay — still ciphertext; the relay never sees plaintext.
This forest is held up by many small fires. Anyone can self-host a Cinderous relay node — a relay only forwards ciphertext; it sees neither your message content nor who talks to whom.
Donations fund official node operations and some contributor bonuses. All links below are external and handled by your own third-party account or wallet.
This site has no in-app wallet, no custody, no cut, and no Zaps. Donating is entirely voluntary.