Pigeon

Endless customizable and truly private chat app

Visit the site ↗
Built with
React Native
Next.js
TypeScript
Notable features
End-to-end encryption
Encrypted on-device storage
Push notifications
Status
Waitlist
Category

Messaging

Platform

iOS · Web

Year

2026

Why it needed to exist

Most "encrypted" messaging apps fake customization

Your friends, family, and clients are stuck choosing between enterprise tools that are built for oversight or consumer apps that only focus on privacy. Current messaging app focus on fixed identities, server-side push previews, and decryption keys the vendor holds for you. We built out an incredible level of detail and customization within the app with privacy as the foundation rather than an add-on.

How we shaped it

The server is a blind relay, not a participant

Every trust boundary is drawn at the device. Messages are encrypted client-side with industry-standard, publicly vetted primitives before they touch the network, and the local database is encrypted at rest, keyed by a secret that never leaves the device's secure hardware. The server's job is reduced to simply route ciphertext.

What sets it apart

Real E2EE, not marketing E2EE

Most "encrypted" chat apps encrypt in transit and decrypt on arrival at a server the vendor controls. We took it a step further than full end-to-end encryption with no server option to ever decrypt. Zero-knowledge design means the server never holds a decryption key for message content, files, chat names, or usernames — the only things that ever touch the server in plaintext are your account email address and the metadata needed to route a push.

The biggest challenge

The unrecoverable message bug

A device reinstall could leave a stale registration behind, still associated with a public key nobody held the private half of anymore — every message encrypted against it was gone for good, with no error and no recovery path, since a zero-knowledge server has no fallback copy to default to. The fix was structural: device registration now retires every other registration for that user before adding the new one, so there's only ever one live key per user at a time. In a system where the server can't bail you out, correctness has to live entirely in how state transitions are sequenced on-device.

More work

Mosa.Click

Coming Soon
Website analytics · Web

Worship Guitar Academy

Live
Education · Web

A Little Tachy

Live
Health · Web

Searchappy

Live
Directory · Web

Cowabunga Farms

Retired
Business · Web

Regenerative Classifieds

Retired
Marketplace · Web