Tern is an encrypted messenger whose intelligence runs on your phone — not in someone's data centre. Real conversations, real encryption, and an assistant that still works on a plane.
Everything below runs on real phones in a private household beta. Where something isn't finished, this page says so — that is the whole point of building a trust product in the open.
Create a room, share its code, talk. Newer rooms run on MLS — the IETF messaging-security standard — so every member has their own keys, past messages stay safe if a device is later compromised, and the group re-keys whenever membership changes.
One tap summarises what you missed: decisions, questions nobody answered, things asked of you. It reads your messages on your phone. Today's version is rule-based; the on-device AI model comes next, and the app always states which produced a summary.
Snap a photo or hold to record. Photos are resized and re-encoded on your phone, which strips the GPS data most apps forward without asking. Media is sealed and streamed in pieces like everything else.
Our server cannot read your messages, so a notification can only say "you have new messages" — your phone fetches and decrypts the content itself. There is no preview text on the server, because there can't be.
Invite someone from your contacts while your address book stays on your phone: iOS shows the picker and hands us only the person you tapped. It is also why there's no "who else is here" list — we would have to upload your contacts to build one.
Reactions, editing, typing indicators, read receipts, unread counts, delete for everyone and delete just for you. Even read receipts are encrypted state between your phones — our server never learns who read what.
We use established, standardised primitives through audited libraries and write nothing of our own. Anyone evaluating a privacy claim deserves the specifics rather than a padlock icon.
X25519 · AES-128-GCM · SHA-256 · Ed25519. Every member
holds their own keys; the group re-keys on each membership change,
which gives forward secrecy and post-compromise security.
liveChaCha20-Poly1305 envelope over TLS 1.2+.
The relay sees ciphertext on an unlinkable topic — never content,
authorship, or document structure. liveX25519 + ML-KEM (FIPS 203) key agreement, so
traffic recorded today cannot be decrypted by a future quantum
computer. The decision is written and approved; the swap lands when
our MLS library ships production support, and the codebase is already
structured so it touches one layer.
plannedThis compares Tern's design commitments with practices that are common — and publicly documented — across ad-funded platforms. It describes an industry norm, not any single company.
| Typical ad-funded app | Tern | |
|---|---|---|
| Business model | Advertising — your attention is what's sold | Subscriptions, planned — you pay, so nobody else has to be served |
| Where the AI runs | Company data centres, processing your content | On your own device; your content doesn't leave it |
| What the server can read | Message content, for features and scanning | Nothing — it relays sealed bytes on anonymous topics |
| Your contacts | Address book uploaded to find other users | Never uploaded; you send invites yourself, from your phone |
| Read receipts | Metadata the server can see | Encrypted state between your devices |
| Ad profile of you | Built from your activity and interests | None exists — there are no ads to target |
| Session design | Infinite scroll, streaks, autoplay are common | Natural stopping points; no streak mechanics, ever |
| Moderation | Often opaque; appeals vary widely | Designed so every action carries a written reason and a right of appeal |
| AI labelling | Inconsistent | Every AI surface states how it produced what you're reading |
The "typical" column summarises practices documented in regulatory findings and companies' own disclosures; individual apps differ, and some do better on some rows. The Tern column mixes shipped behaviour with commitments for features still being built — the roadmap below keeps them separate.
Regulators across the EU, the UK and a growing list of US states are converging on the same demands: explain your moderation, label your AI, minimise what you collect, and protect minors. We treat those as design inputs — decided before a feature is built, not patched on afterwards.
Every enforcement action is designed to carry a written, human-readable reason and a route to appeal, in the shape the EU's Digital Services Act expects. The pipeline — triage, statement of reasons, appeal — is already built and tested in our core; the community surfaces that use it come with Phase 3.
New York's SAFE for Kids Act, the UK's Online Safety Act and several US state laws require platforms to establish age before exposing minors to certain features. Our design keeps that private: a device-held or third-party attestation of "over 18" or "under 16" rather than uploading your passport to us. We would rather hold no identity documents at all than promise to guard them well.
Every AI surface states how it produced what you're reading — today that means Catch Me Up telling you it used rules rather than a model. That transparency is what the EU AI Act asks for, and we shipped it before anyone required it of us.
Ranking signals and interaction history stay on your device. We do not upload contacts, we do not build ad profiles, and the server stores no message content — so there is very little for a breach, a subpoena, or a change of ownership to expose.
When community feeds arrive, a chronological, follows-only option is one tap away and always available — the non-profiling choice EU rules now push the industry toward. No streaks, no autoplay for minors, and a scroll that ends.
Moderation actions, recommender parameters and systemic-risk metrics are being designed to be queryable for regulator and researcher reporting from the start, rather than reconstructed under deadline.
"Planned" means designed and decided, not shipped — this page marks the difference deliberately. Nothing here is a certification, a legal opinion, or a claim of current compliance with any specific statute; requirements and effective dates vary by jurisdiction and change often. Tern is in invitation-only private beta and is not offered to the public or to minors today.
Tern is in private beta: a working encrypted messenger on real iPhones, not a mockup. It is also early — one platform, invitation only, and the community half is still ahead of us. Our architecture decisions and benchmarks are written down as we go, because "trust us" isn't a privacy policy.
Subscriptions and paid community tools. That single choice does most of the privacy work: when you pay for the product, there is no advertiser to profile you for, no reason to engineer a feed for time-spent, and no incentive to read anything you write.
Nothing is for sale yet — the beta is free and invitation-only, and payments inside Tern are deliberately deferred until the identity and audit layers can carry them.
Advertising. An engagement-ranked feed as the only option. Streaks. Uploading your address book. Reading your messages to train models. Payments before the groundwork is ready. Each of those is a written decision with reasons, not an oversight we might quietly reverse.
Beta groups are small on purpose — households and tight-knit communities who move together, so the app gets tested the way it is meant to be used. iPhone today; Android next.