What's new

Every release of the apps and the relay, newest first. Written for people using Flamenet Messenger; the parts that only matter if you run your own relay are at the bottom of each release.

2026-09-28

android 0.31

The app now tells you in the conversation when a message could not be sent sealed, and tells you if signing in gives this phone a different address from the one it had.

New, When a message cannot be sent sealed, the conversation says so at the time. Sealed sending falls back to an ordinary send when the other person's delivery key has gone stale, usually because they reinstalled. The message is still encrypted; what changes is that the server is told which account it came from. Privacy settings has always counted how often that happens, which cannot tell you whether it happened to the message you just sent. Now the conversation tells you, as a note, not an alarm. The iPhone app has said this since 0.31.0.
New, If signing in gives this phone a different address from the one it had, Settings now says so, beside your address, and shows the old one. Your address comes from your passphrase and a value the account server sends back at every sign-in, so a changed passphrase changes it, and so would a server that handed this phone a different identity. Until now the new address quietly replaced the old one, and nothing on the phone would have shown that either had happened.

2026-09-26

android 0.30

Deleting your account now deletes all of it, off-the-record conversations stay off the phone's storage, and the parental PIN can no longer be read out of the phone's files.

Fixed, Deleting your account now deletes all of it. It used to remove your messenger account and leave your Flamenet account behind, still registered and still holding your name, without saying so. Both go now.
Fixed, A conversation held off the record stays off the phone's storage. Drafts, messages queued to send later, and unread marks for those conversations were being saved to disk, when off the record is meant to live only while the app is open.
Fixed, The parental controls PIN could be read out of the phone's files. It was stored with a single fast hash, and four digits is only ten thousand guesses. It is now stretched the same way your account passphrase is. A PIN you already set still works, and your restrictions stay exactly as you left them.
Fixed, Moving to a new phone no longer copies this app's data across. On newer Android versions a phone-to-phone transfer could carry your encrypted messages without the key that opens them, which left an app that looked broken on the new phone. Nothing is copied now, so set it up fresh.
Fixed, When a server answers but refuses to prove its record of everyone's keys is consistent, the app now treats that as tampering. It used to accept the refusal and say nothing, which let a dishonest server skip the check just by refusing it.
Fixed, When somebody's key is replaced without their old key signing for it, the app now says which kind of change it was and what to do. It used to show the same message as an ordinary change, and the unsigned kind is exactly what somebody impersonating them would produce.
Fixed, Signing up or in no longer blames your connection for problems that never reached the network. The app said something went wrong reaching the server even when the account had been created, and tapping again made it worse.

2026-09-25

ios 0.31.0 relay

A conversation held off the record was being written to the phone and read back on the next launch, the bridge you use and the name of whoever gave it to you were riding your backups, and the parental PIN could be recovered from a backup without the phone. All three are fixed, and the app now tells you at the time when a message could not be sent sealed.

Fixed, A conversation you held off the record did not stay off the record. The app promised it was gone when the app closed, and instead it was written to the phone's history file and read straight back on the next launch. Twenty-four ordinary actions triggered that write, so this was the normal case, not an edge one. Conversations saved that way are filtered out on the first launch after you update, and nothing new is written. Four test suites covered the filter the whole time and all four passed: the defect was a path to disk that never called it, so the new test checks that no path can.
Fixed, The obfs4 bridge you had configured, and any bridge somebody had offered you, were stored where iTunes and iCloud back them up. An offer carried the name of the person who sent it, so a backup held a contact's name in the clear beside the address of a bridge they use. That is both a contact and a record that somebody went looking for a way around a block, and this feature exists for people who expect the phone to be taken and read. Both now live in the Keychain, marked so they never leave the device.
Fixed, The parental controls PIN was stored as a single round of SHA-256 with a salt, and both sat where backups carry them off the phone. Four digits is ten thousand guesses and one SHA-256 takes nanoseconds, so whoever held that backup held the PIN, without ever holding the phone. It is now stretched with the same function the account passphrase uses, at 650,000 iterations, and kept in the Keychain on this device only. A PIN you already set still opens, and is rewritten in the new form the first time you enter it, which is the only moment that is possible. Your gates come back as you left them, not as the setup screen would set them.
Fixed, Muting a conversation wrote the conversation's name into a setting kept outside the sealed store, so the list of who you had muted could be read without the key to anything else. Mute settings are now keyed by a value that cannot be turned back into a name, and the ones already written are converted when the app starts.
New, When a message cannot be sent sealed, the conversation says so at the time. Sealed sending falls back to an ordinary send when the other person's delivery key has gone stale, usually because they reinstalled. The message is still encrypted; what changes is that the server is told which account it came from. Privacy Settings has always shown how often that happens, which cannot tell you whether it happened to the message you just sent. Now the conversation tells you, once, as a note, not an alarm.
Fixed, When somebody's identity key is replaced with one the old key did not sign for, the app now says which kind of change it was. The server has always recorded the difference between a replacement the previous key vouched for and one that arrived with no signature at all, and the app showed the same sentence for both: their key set changed. The unsigned kind is exactly what somebody who cannot sign with the old key would produce, so it names itself and says what to do about it. This is about another person's key, and is separate from the notice about the server's own identity that arrived in the last version.
Changed, Nine items the app keeps in the Keychain sat outside the one mechanism that stops them being eligible for a backup. Only one of them predated the change that made these device-only, and it was a device identifier that opens nothing, so nothing was exposed. That was luck rather than design: the item unlocking your whole conversation history was added two weeks after that change instead of two weeks before. There is now one list, read by everything that needs it.
Changed, The Donate row is gone from the Account screen. App Store rules require a donation toward an app's own development to go through Apple's in-app purchase, even when giving unlocks nothing, and this app will not put a payment flow in front of people to fund itself. The donate page is still on this website for anybody who wants it.

2026-09-22

ios 0.29.0 relay

A lost iPhone can be erased from another one, screenshot notices are finally shown to the person they are about, and a new phone is let onto a full account instead of being turned away without being told.

Fixed, This iPhone has been telling the other end when you screenshot a conversation with a timer on it, since the day the feature shipped. The receiving half put every one of those notices into a list that nothing on screen read, so one phone said it and the other showed nothing. That is worse than not having it at all: somebody who knows the app has the feature would reasonably conclude nobody had screenshotted them, and the app was the only thing that could have said otherwise. The notice now appears in the conversation it belongs to.
Fixed, When somebody blocked reappeared, the app could add them back to your contacts by itself. The app files people who write to you, which it has to do, because a sealed message carries nothing the relay can annotate. The block check was the only thing standing between that and undoing a block, and it read a failed request as an empty block list, so one timeout was enough for every blocked person to pass. A block list that cannot be fetched is now treated as unknown rather than empty, and nobody is added on that pass.
Fixed, Messages a contact sent after reinstalling are no longer lost. The relay counted them delivered and forgot them, this iPhone refused them because the keys had changed, and then threw them away, so accepting the new keys brought nothing back: they saw delivered messages, you saw an empty conversation under a security warning. Refused messages are now held as they arrived and delivered once you accept. The check that refused them was right and is unchanged. Discarding them was the mistake. Android got this in 0.29.
New, A lost or stolen iPhone can be erased from another device on your account, from the Devices screen, with your passphrase. Both halves of this existed and neither was connected to anything, so a phone that could not be reached could not be wiped either.
New, A story can go to a group, and several pictures can go out as one story. Both were built and neither could be reached: nothing in the app could produce a group story, so the part that receives them had never had one to receive.
New, Inviting somebody is a link now, rather than an explanation of what to install and where.
Fixed, On an iPad, a story stretched the full width of the screen with its caption stranded at the far left, and a conversation put one message hard against each edge with an empty lake between them. Both are held to a width you can read across. A phone is unaffected, being narrower than the ceiling.
Fixed, One call made two rows in the call log. It makes one.
Changed, The app says out loud when the relay's identity changes, rather than noting it somewhere you would have to go looking.
Fixed, Signing a new phone in to an account that already has its limit used to be refused, and the refusal was invisible on the phone that got it: no mailbox, so nothing is queued and nothing rings. The account looked signed in and simply never received anything. It happened three times to one account before anyone worked out why, and the remedy was a screen you could only reach from a device that still worked. The relay now retires the device you have used least recently and lets the new one in.

If you run your own relay

FN_EMAIL_VERIFICATION_REQUIRED locks Android users out. The relay refuses to mint a device token until the address is verified, the iPhone shows that message and a box to type the code into, and Android has neither: the refusal is mapped to an error that is caught nowhere, and nothing calls the route that spends the code. Leave it off until the Android app can answer it.
docs/CONFIGURATION.md now lists every environment variable the relay reads, and a CI job fails if one is added without being documented.
API.md pointed federation at two routes this relay does not serve, and omitted others that it does. Both are corrected.
The Postgres autovacuum migration is guarded by a test. The statement it used is Postgres-only and crash-looped a SQLite relay on boot, which would have taken production down had it merged.
The self-hosting smoke test had been unable to run since 2026-09-04 and was reporting nothing rather than failing. It runs again.

2026-09-21

android 0.29

Messages stop disappearing when a contact reinstalls, a lost phone can be erased from another one, and conversations start carrying a second signature chosen to outlast the arrival of a quantum computer.

Fixed, When a contact reinstalled, everything they sent before you accepted their new keys was destroyed. The relay had marked those messages delivered and forgotten them, this phone refused them because the keys had changed, and the refusal was swallowed instead of held. Tapping Accept new keys brought nothing back: they saw delivered messages and you saw an empty conversation under a security warning. Refused messages are now held and delivered once you accept. The check that refused them was right and has not changed; throwing them away was the mistake.
New, A lost Android phone can now be erased from another device you own. The relay and the iPhone have been able to do this for a while and Android had no part of it, so an Android phone was the one that could not be wiped at all. Erasing also asks before it happens now, because it was previously one tap with nothing in the way.
New, Stories can go to a group, and one story can hold more than one picture. Both were built and neither could be reached: the composer had no way to choose a group, so nothing could produce a group story even though arriving ones were already checked against the group roster. Posting to a group replaces the audience rather than filtering it, so a group story reaches the group and only the group.
New, Account settings has Invite a friend. It asks the relay for a code, shows it large, and shares a link to a page with the code and the store buttons on it. If you have run out of invites the relay's own sentence now reaches the screen, so you are told you already have five unused ones rather than just being told you hit a rate limit.
New, Every device now publishes a second identity key alongside its existing one, and signs with both. The existing key is safe against anything that exists today but not against a quantum computer, which could forge one and be believed as somebody else. The new one is built to survive that. You will not see any of this: there is nothing to turn on, and nothing in the app yet tells you whether a particular conversation is using both signatures or only the old one. Two cases are still on the old key alone, a phone that has not taken this update, and a phone restored from a backup made before this release, which keeps the identity it was restored with rather than being given a new one behind your back.
Fixed, Swiping the app out of Recents hung up a call you were on. That was written when removing the app also stopped the call anyway, and it stopped being true when the app started surviving the swipe to stay reachable. The call now survives it too.
Fixed, When a server started signing with a key this app had never agreed to, you were told that something went wrong reaching that server. The app already knew exactly what had happened and had a warning written out naming the server, and that warning was being thrown away on the way to the screen. You now get the warning, the name of the server, and both of the things it can mean: a change the operator made on purpose, or something else answering in its place. The app cannot tell those apart and does not pretend to.
Fixed, Blocking or removing someone left them able to ask the relay whether you were online. Both now revoke that, and revoking the last one actually reaches the relay, which it previously did not.

If you run your own relay

The post-quantum identity is optional on the wire. A device that publishes none is treated as classical rather than refused, so a relay serving a mixed fleet needs no change and nothing is cut off mid-upgrade.
A relay that strips or substitutes a published post-quantum identity is now refused by the app rather than silently accepted. The app pins the identity itself and not merely the fact that one existed.