A list that doesn't exist can't leak

Why I built a messenger that never asks for your email, your phone number, or a password.

You have probably had the email. "We recently became aware of an incident involving some of your information." Your address, sometimes your phone number, sometimes a password, is now in a file that strangers trade.

The usual response is to promise better locks. Stronger encryption at rest, more audits, a bigger security team. All of that is good. None of it changes the basic shape of the problem: the company is holding a list, and a list can be taken.

I wanted to try the other answer. Don't hold the list.

What LILAC doesn't ask for

LILAC is a messaging app for iPhone and Android. When you open it for the first time, there is no sign-up screen. No email field. No phone number. No password to invent.

That is not a shortcut we plan to close later. It is the design.

• No email on file. We never ask for it, so a breach of our servers cannot expose it.
• No phone number. Same reason. It also means no SIM, no carrier and no country code are needed to be reachable.
• No password. Your identity is a key that is created on your phone and never sent to us. There is nothing for an attacker to steal from us and try on your other accounts.

If you picture our user table, it has the columns you would expect — email, phone, password — and zero rows.

So how do people reach you?

With an invite. You show a QR code in person, or send a link. The other person opens it and you are talking. They don't register either.

The part I care about most is what happens afterwards. On most apps, "blocking" someone leaves you on their contact list; you are one tap away from being reachable again. In LILAC you shared a link, not your number, so you can take the link back. Once you do, it stops working and nothing new from them can reach you.

What our server actually sees

Messages are sealed end to end. Our relay stores three things: a sealed envelope, the random mailbox address it is going to, and a timestamp of when that mailbox was last used. It cannot open the envelope. It does not hold your keys, your contact list or your name. A mailbox nobody touches for 24 hours is forgotten, mail included.

If someone seized the server, they would find sealed text waiting for delivery, random mailbox addresses and those timestamps. No keys, no contacts, no readable messages.

One thing no relay can avoid: the network it runs on (ours is hosted on Cloudflare) sees the IP address of each connection. Our code does not store it, but LILAC does not hide it the way Tor would.

What LILAC can't do

I would rather say this plainly than have you find out later.

• It can't un-leak the past. The email you already gave to other services is still out there. LILAC only makes sure that staying in touch with someone doesn't cost you one more.
• It can't reach into someone else's phone. If you take an invite back, messages already delivered stay on their device. Nobody can change that, and I don't trust any app that claims it can.
• Your phone is the vault. The key sits in the phone's secure storage, and your contacts and notes sit in the app's private storage behind your screen lock. There is no separate app lock. Someone who has your unlocked phone has your LILAC.
• Older versions kept contacts and notes in device backups. Since Android 0.1.9 and iPhone 1.2.1 (both October 2026) they stay out of Google and iCloud backups. If you installed before that, update. Your key was never among them.
• Your key may also be in your own cloud backup. The phone's secure storage can back the key up to your Google or Apple account, encrypted by them, so a new phone can pick it up. It never comes to us, but "only on this one phone" would be the wrong way to describe it.
• Old messages are not protected if a key is stolen later. LILAC uses long-lived keys. If someone recorded your sealed messages and later got the key off your phone, they could open them. Apps like Signal rotate keys to prevent this; LILAC does not yet.
• The first invite is a matter of trust. If someone swaps your invite on its way to your friend, they can sit in the middle, and there is no code to compare yet. Showing the QR in person avoids this.
• There is no "forgot my password" button, because there is no password. To move to a new phone, you hold the old and new phones together and transfer across, or you use the 12-word recovery phrase you saved. If you lose the phone and have neither, we cannot restore your identity for you. We don't have it.

That last one is a real trade-off, not a footnote. The same property that means we have nothing to leak means we have nothing to hand back.

Why bother

Most of us have accepted a strange bargain: to talk to one person, you hand a company a permanent identifier that connects to your bank, your logins and everything else you do. Then you hope they look after it.

For a lot of conversations — someone you met once, a buyer on a marketplace, a group that will dissolve in a month — that bargain is far too expensive. A link you can take back is enough.

LILAC is free, with no account, no ads and no tracking. It is out now:

• iPhone: https://apps.apple.com/app/id6782758292
• Android: https://play.google.com/store/apps/details?id=app.lilac.android
• More detail: https://lila-c.com

I am one person building this. If you find a claim here that doesn't hold up, I want to hear about it: hello@lila-c.com.