CarrierPony for journalists
A phone number is a name. An account is a record. CarrierPony has neither. A source pairs with your key, you verify a safety number, and everything after that travels sealed through a relay that deletes what it delivers.
The problem with number-based messengers
Even excellently encrypted messengers usually bind identity to a phone number. For a journalist that has two costs: your number becomes a lookup key connecting you to every source in your contact graph, and a source who messages you has now tied their number to yours in someone's records. Content encryption doesn't help with either, because the association itself is the leak.
What CarrierPony changes
- No identifiers to correlate. Identity is a keypair generated on the device. There is no number, no email, and no username, so nothing joins your professional graph to a source.
- Pairing you control. Hand a source your invite in person, print it, or send it through whatever channel the situation allows. Then verify the safety number and the channel is confirmed.
- A relay with nothing to give. Envelopes are ciphertext with opaque routing identifiers, deleted on delivery. There is no message archive, no contact list, and no account database behind it.
- Documents, not just words. Files up to 50 MB travel with the same encryption and the sender's signature, so material arrives provably unaltered.
- Verifiable crypto. The OpenPGP engine is open source (PGPonyCore, Apache-2.0) and checkable against GnuPG, so anyone can audit the claim.
Limits
CarrierPony is not an anonymity system: like every messenger, the relay sees connecting IP addresses at the network level, so pair it with a VPN or Tor if network-level anonymity matters. It has no forward secrecy, so protect the endpoint, keep backups encrypted, and treat device security as part of the job. And it requires both parties to run the app, on iPhone or Android, so it's a channel you establish, not a tip line strangers can find.
Suggested workflow
- Pair with the source in person when you can; verify the safety number either way.
- Lock the app behind Face ID, and keep your identity backup encrypted somewhere the phone isn't.
- For anonymous first contact from unknown sources, use the tools built for that, then move the ongoing relationship somewhere paired and verified.
Get CarrierPony
Free private messaging and file transfer for iPhone and Android. No accounts, no tracking, no phone numbers.