Family Chat
Private messaging for one family. Keys stay on your devices, so the server cannot read anything.
Set up this device
- 1. Email
- 2. Code
- 3. Passphrase
- 4. Passkey
Only addresses on the family list can sign in. Anything else gets the same answer, so this page cannot be used to guess who is in the family.
The code lasts 10 minutes and can be tried 5 times.
This passphrase is the only way back in if you lose this device, and nobody can reset it for you. Write it down somewhere safe. It never leaves this device: it unlocks your keys here, it is not a password for the server.
Last step. Your device will ask for Face ID, Touch ID, or your screen lock. That creates a passkey for signing in, and where the browser supports it, unlocks your keys with the same check.
Sign in
This device is set up. Sign in with your passkey.
You are signed in
Messages
Pick one person for a private chat, or several for a group. Everything you send is encrypted on this device first. The server moves the encrypted bytes and removes them after 30 days, and it cannot read any of them.
No conversation selected
The name is encrypted with your messages and shared with everyone in the conversation. The server never sees it.
In this conversation
Files are encrypted on this device before they are sent, with a key that travels inside the message and never reaches the server. Opening a file counts as one view for everybody, so a file limited to one opening is opened by whoever gets there first.
Settings and what this app can promise
Add Family Chat to your home screen
Installed, it opens straight to your conversations, works with no signal, and can show you a notification when a message arrives.
Add Family Chat to your home screen
On an iPhone or iPad, tap the Share button at the bottom of Safari, scroll down, and choose "Add to Home Screen". Then open Family Chat from the icon instead of from Safari. Apple only allows notifications for web apps that have been added this way, so this step is what turns them on.
Notifications
Read receipts
Turning yours off also hides everyone else's from you. A setting that let you keep watching while nobody could watch you would be a one way mirror, and in a family that is worse than having no setting at all.
Blocked people
Sign in to see who you have blocked.
Muting is the gentler one, and it never leaves this device: a muted person's messages still arrive and are still saved here, they simply arrive folded up and do not nudge you. Both controls sit next to a person's name in a conversation. One thing muting cannot do is stop the alert your phone shows when a message arrives, because that alert never says who sent it or what it says, so there is nothing in it to match a mute against.
What is real, and what is not
- Messages are removed from the server after 30 days, and sooner once every device has collected them. That is the one deletion this app can enforce.
- Anything already on somebody's phone stays on their phone. No app can promise otherwise, and any app that says it can is describing a request, not a rule.
- Limiting how many times a file can be opened stops the server handing it out again. It does not stop somebody who already opened it from keeping it.
- Read receipts are self reported. A changed app could read without saying so, or say so without reading.
- Screenshots cannot be blocked or even detected in a web app, on any platform. If that ever matters, this needs to be a native app instead.
- Blocking somebody stops the server sending you what they say. It does not tell them, it does not remove them from a group, and nothing they send while blocked can be shown to you later, because the server never kept a copy of it for you.
- Your messages are kept on this device, encrypted with the same key as everything else, so they survive closing the app. Lose the device and they are gone, which is the design.
- The MLS library this app uses has not had a security audit. It is a family instance and the source is public, and that is worth knowing rather than glossing over.