A circle, not a public feed
Invite-only access for direct conversations and small groups. No public people directory or phone-number discovery.
Local-first messaging · Invite-only beta
Invite-only encrypted messaging for trusted circles.
Private direct conversations and small groups, with the product and engineering open for review.
No account needed for the tour. Already invited? Start here.
Inside the web companionCaptured beta interface
History close to you
Device-local message history and private-content search, with a hosted relay for delivery rather than a universal message archive.
Native clients. Web companion.
Android, Windows and Ubuntu clients for everyday use, with a browser companion for onboarding and messaging.
Built in the open
Look beyond the interface.
Explore the delivery architecture, local-state decisions, shared protocols and release workflow. The engineering case study links directly to the code and documented tradeoffs.
- Clients
- Next.js · React Native / Expo · Tauri
- Delivery
- Cloudflare Workers · Durable Objects · WebSockets
- Storage
- Device-local state · D1 metadata · R2 attachments
- Contracts
- TypeScript and Rust protocol definitions
Current scope
Know what the beta supports.
A feature in source is not the same as a verified production rollout. Client support, recovery and privacy boundaries matter.
- E2EE direct messagesAvailable in beta
- Encrypted mailbox delivery across the active beta clients, with device-local history.
- Small group messagesAvailable in beta
- New groups use device-encrypted history. Legacy group history and relay-hosted communities and rooms have different boundaries.
- Attachment encryptionIn source
- Current client source encrypts conversation attachments before upload. End-to-end key custody applies to device-encrypted conversations, not relay-hosted rooms or legacy groups; deployment and installer parity need separate verification.
- Invite-only onboardingAvailable in beta
- Invitation-based access with email bootstrap and self-attested 18+ eligibility; no public registration.
- Device-local searchAvailable in beta
- Private-message content is searched on the device, not indexed by the relay.
- Account recoveryPartial support
- Restoring account access does not guarantee recovery of lost device-local keys or message history.
- Passkey sign-inIn source
- Present in web and relay source. Native-client UX and authenticator validation remain incomplete; source availability is not a production-rollout guarantee.
- iPhone clientPlanned
- Planned after the initial native clients are stable; not listed as a released beta client.
Direct messages and new encrypted groups are not the same as relay-hosted communities, rooms or legacy group history. Read the privacy boundaries before choosing where to share sensitive information.
A few useful answers.
Is EmberChamber pure peer to peer?
No. Phones need reliable delivery when they are offline, so EmberChamber uses a hosted relay for metadata, delivery, and attachment storage. The privacy goal is to keep that role narrow, not to pretend the relay does nothing.
Do I need a phone number or Google account?
No. The beta uses invite-only email bootstrap. Your email handles identity and session recovery — it doesn't link your account to Google, Apple, or a carrier.
Will group chats be encrypted?
New groups in the active beta runtime are created with device-encrypted history. Relay-hosted communities, rooms, and legacy groups use different history and attachment-key boundaries. Current client source encrypts conversation attachment bytes before upload, but production and published-installer parity require separate verification.
Who is this beta for?
People who want a genuine private space for their trusted circle — and who are tired of messaging apps that treat conversation history as an asset.