Tacendumprivate // messaging, rooms, calls, agents
No feed·No directory·No contacts uploaded
the only place your words exist in the clear
02 // the name
A conversation is
not content.
What is said inside a conversation belongs only to those invited into it.
A lawyer telling a client what their options really are.
Two parents working out something about their kid.
Friends of thirty years who don’t need an audience for any of it.
Somewhere along the way, talking to a few people started to feel like talking to everyone — chats grew audiences, messages became posts.
Tacendum goes back to the older idea — a conversation, whole, between the people in it.
//what it does
Two people, or twelve. Never an audience.
The difference between a room and an audience: somebody chose, and it was not us.
//what you can say
-
Text, end-to-end encrypted with libsignal — the Signal protocol.
> libsignal · edit · delete · reply · react · @mention · a location you choose
-
A room is one conversation for the people you choose, and everyone in it sees everything said in it from the moment they join. Only the person who made it can ever add or remove anyone — and only they can hand a new arrival the history from before, deliberately, and the room is told when they do.
The name and everything said in it are hidden from us. The member list is the part encryption does not hide — we see who each copy goes to.
> max 12 · one encrypted leg per member · name and contents: not ours · roster: visible to us
-
Encrypted video calls with relay privacy — your address stays yours.
Video one to one; voice one to one, or in a room with up to six on the call — a room’s call is voice only. End-to-end encrypted either way. The first call with someone new is relayed by default, so a stranger does not learn your IP address; one switch keeps every call that way. The relay carries encrypted media it cannot decrypt.
> video 1:1 · voice 1:1, or six in a room · group video: none
-
Encrypted on the phone with a key generated for that one photo, and the key travels inside the encrypted message rather than beside the file. What our storage holds is a blob of ciphertext with a random name.
> a key per file · random name · deleted 30 days after upload (a superseded copy, up to 7 more)
-
The things you keep re-typing to one particular person — a door code, the Wi-Fi password, a login — kept in the conversation they belong to instead of in a message you both have to scroll back for.
It is stored and sent exactly like a message: same encryption, same database, same lock on the phone. Which is also the honest limit — it is not a password manager. There is no separate password and no recovery key, and the title and body sit in ordinary text columns beside your messages.
> encrypted like a message · no second password · not a password manager
//what it does not do, and does not have
-
Screenshots are announced
Take a screenshot inside a conversation and the other person is told — always; there is no setting that turns it off.
-
Safety numbers
Every pair of people has one, and both see the same one — a changed number is always serious, so verify in person before you send anything else.
-
What the lock screen says
Your choice, and there are three answers: name and message, name only, or nothing at all.
-
App Lock, and one code with two doors
Your code opens your conversations, and the same code entered backwards opens a decoy instead — while the real ones stay sealed.
-
No sign-up
A keypair made on the phone is the account — no phone number, no e-mail, no username required, ever. Link one later only if you want to be found. No recovery of messages or keys: lose the phone and its history is gone, by design; a linked e-mail can win back only which devices are yours and whether you can be found.
-
Nothing kept on our side
There is no archive to breach and none to subpoena; undelivered ciphertext clears within thirty days.
The long version, including what does not protect you, is on How it works.
There is also a command line.
Machines and agents can hold an account of their own and speak the same protocol from a script. That is a separate document.
//the quiet part
Encryption hides what you said. Not that you said it.
What our servers can still see is written out in the Privacy Policy; How it works covers the mechanics, including the parts that are on you.
//principles
Asked, answered.
- Why is a room capped at twelve?
- Because a room is a conversation, not a channel. Every message is encrypted separately for each member, so twelve people is twelve deliveries — past that it stops being a room.
- Can I use it for confidential work?
- That’s a judgement for you and your professional obligations, not a badge we can hand out — we hold no compliance certification. What we can tell you is the mechanics: your messages are end-to-end encrypted, we cannot read them, and we keep no archive to hand over. How it works spells out exactly what that does and doesn’t cover.
//release
One email, and that’s all.
Tacendum is coming to iPhone. Leave an email and you’ll get one message from us — the one that says the door is open.
no newsletter. no “community updates.” the privacy policy says exactly what we do and don’t do with your address.
ⓘ what this page loads and sends
nothing on this page loads from anywhere else while you read it — the only thing it ever sends is this address, to us, when you press the button. if that press can’t be told from a bot’s, your browser answers one spam check from our host before it goes.