The security model.
What protects your messages, what the threat model is, and where the boundaries are, stated plainly, because security you can't understand isn't security.
Cryptography
- Message and file encryption: OpenPGP with modern keys — Curve25519 for encryption and Ed25519 for signatures. Every message and every file is encrypted for the recipient on your device before it goes anywhere.
- Signed, always: every envelope carries the sender's Ed25519 signature. The receiving app verifies it before showing you anything, so tampering in transit is detected rather than trusted.
- The engine: the cryptography is PGPonyCore, the same open-source (Apache-2.0) OpenPGP core that powers PGPony, interoperable with GnuPG.
Pairing and verification
Two people pair by exchanging an invite — in person via code scan, or over any channel they trust. Pairing exchanges public keys only. After pairing, both sides can compare a safety number derived from the two keys. If the numbers match, there is no one in the middle. Your conversation is bound to that exact key: a different key is simply not your contact — its messages cannot verify and are never presented as them.
The relay
Because phones sleep, lose signal, and change networks, messages travel through a store-and-forward relay at api.carrierpony.com. The relay's job is deliberately boring: hold a sealed envelope until the recipient's device picks it up, then let it go. It never has names, message contents, or key material. What it stores is ciphertext it has no way to open. A push notification can wake the app to fetch — the plaintext of a message only ever exists on the two paired devices.
Keys on your device
Your identity is generated on your phone and stays there. The private key never leaves the device except inside an encrypted backup that only your passphrase can open. You can additionally lock the app behind Face ID. Imported keys that were passphrase-protected stay passphrase-protected.
Threat model
CarrierPony protects the confidentiality and integrity of messages and files between two paired devices, against network attackers and against the relay itself. It assumes iOS and its secure hardware behave as documented. It does not defend against malware on a compromised, unlocked phone, or against someone who can read your screen. Pairing is trust-on-first-use until you verify the safety number — comparing it is what rules out a man in the middle.
Minimal server surface
There are no accounts, so there are no passwords to steal and no profile database to breach. The relay holds transient ciphertext and the minimum needed to route it. See the privacy policy for exactly what does and does not exist server-side.
Open to inspection
The crypto core is open source under Apache-2.0. You don't have to take the encryption on faith — read PGPonyCore and check the behavior yourself.
Reporting a vulnerability
Found something? Email NorseHorse@norsehor.se — encrypted with this PGP key if you prefer. Reports go straight to the developer, and fixes ship fast because there is no committee in the way.