How everything works.
The reference for CarrierPony's moving parts. For task-by-task walkthroughs, see the guides.
Identity and keys
Your identity is an OpenPGP keypair: an Ed25519 signing key and a Curve25519 encryption key, generated on-device the first time you open the app. The public half is what you share when pairing; the private half never leaves the phone except inside an encrypted backup. You can also import an existing OpenPGP key from GnuPG or PGPony.
Pairing
A conversation starts with a pairing: you send an invite, or scan each other's codes in person. Pairing exchanges public keys. Until you verify the safety number, the pairing is trust-on-first-use; after you verify, you know cryptographically that no one is in the middle.
Messaging
Every message is encrypted to your contact's key and signed with yours before leaving the device. The receiving app verifies the signature before displaying anything. Delivery goes through the relay, which holds the sealed envelope until the recipient's phone fetches it. Messages carry a 30-day lifetime: after it passes, they expire from both devices automatically.
File transfer
The Files tab handles transfers up to 50 MB — photos, documents, archives, anything. Files are encrypted and signed exactly like messages and appear in one place on both ends. See sending an encrypted file.
Backups
Settings → Backup exports your identity — the keypair itself — as a single encrypted file that only your passphrase opens. Contacts and message history are not part of the backup. Without a backup, a lost phone means a lost identity — no one can recover it for you, by design. See backing up your identity.
App lock
You can require Face ID to open CarrierPony, adding a local gate on top of the phone's own lock. See locking with Face ID.
The relay
The relay at api.carrierpony.com is a store-and-forward service: it queues sealed envelopes for offline recipients and deletes them on delivery. It has no accounts, no names, and no keys. Full details on the security page and in the glossary.
Report and block
Any conversation can be blocked with one tap, and abusive contacts can be reported. Blocking unpairs the contact on your device: nothing further from that identity is opened or shown unless you choose to pair again.