What Hubyn is

A private messenger and collaborative workspace for iPhone and Mac with its own identity system. On the Mac, full CRDT pages, an audio workspace with on-device transcription, and Jimmy intelligence sit beside messages and calls. Jimmy runs on the shared Neutron Engine foundation also used by Neutron Studio. No phone number, no contacts upload, no tracking tools riding along. The iPhone owns your account. The Mac is a linked companion — it can join, but it can never create or recover an account on its own.

• CRDT workspaces allow collaborators to edit shared pages and converge their changes without turning the page into a static chat attachment.
• Audio recordings and their on-device transcripts remain organized inside the workspace.
• Jimmy works locally with the workspace material available on the Mac; private workspace content is not sent to a cloud AI service for inference.

Privacy is the default, not a setting you have to find.

How we build it

Five rules decide every argument inside the product.

1. No homemade encryption. Message secrecy comes from libsignal, the same protocol family behind Signal.
2. Fail closed. When something is missing, broken, or ambiguous, the app refuses instead of guessing.
3. Infrastructure stays blind. Relays and servers never hold readable content or unilateral control of your identity.
4. Privacy is the default, not a setting you have to find.
5. Honest boundaries. What we don't protect against is written down, not buried.

Identity without a phone number

You are a durable handle plus a PIN — in the spirit of BBM, but the trust underneath is cryptographic. Your keys, not a carrier record, prove who you are. Devices are listed in a signed set, retired device slots are never reused, and a removed device cannot quietly return.

Recovery you hold, not us

Recovery takes two things: a recovery code only you hold, and an encrypted envelope synced on your behalf that we cannot open. There is no operator bypass. Lose every device and the code, and the account is gone — support cannot restore it. Today that code plus envelope is permanent root authority and cannot be rotated, so treat a copy of it as a copy of your account.

Adding people, with consent

Nothing arrives until you allow it. Connection requests are explicit, blocks are enforced, and content is refused unless sender, route, and consent all line up. First contact comes in two strengths, and the difference is real:

• Scanning a code is strong. The code commits to a specific key, so a hostile directory cannot swap someone in — the add simply fails.
• Typing a PIN alone is weaker. It relies on directory integrity plus comparing your security code in person or by voice.

One honest note: a party who can resolve your handle can tell that someone tried to reach you — never who you talk to or what was said.

Messages are sealed before they leave

One-to-one chats use X3DH, the Double Ratchet, and PQXDH for post-quantum hardening. Groups of up to 1,024 people use Sender Keys with explicit invites. The routing secret rotates whenever membership changes, so a newcomer never learns earlier relay tags, and group keys rotate whenever someone leaves or is removed, so they cannot read what follows. Delivery, acknowledgment, and key advancement commit together, so a crash never loses or duplicates a message.

Relays that cannot read

Our relay stores sealed records under rotating tags and random names. An operator sees opaque identifiers, rough timing, and sizes — never content, identities, or who talks to whom.

• Deleting a record needs a secret, not an address. Knowing where a record lives authorizes nothing.
• From the Mac release, nearby devices can hand off the exact same sealed envelope over a direct local link, with no ID, key, or contact exposed during discovery.
• A local handoff carries messages. It never grants identity, membership, or recovery authority.

Two locks on the device

The local database is encrypted with SQLCipher, and every message record is sealed again with a key that never enters an iCloud or device backup. A fully restored backup is still locked without that key, which stays on the device only. If part of the database is damaged, it is quarantined rather than quietly treated as empty — and today there is no message history recovery after you lose every device. An encrypted backup that only your recovery key can open is on the way.

Photos, files, and voice notes

Attachments up to 2 GB are encrypted in authenticated pieces under a key unique to that file, and stored as random-named ciphertext that the relay deletes after 30 days. On iPhone, voice notes are recorded and played. Transcripts made on the phone, never uploaded, arrive in a later iPhone update. On the Mac, voice-note transcription and the audio workspace run on your device only — if on-device speech isn't available, the note simply sends without one. There is no cloud transcription, ever.

The Mac can join. It can never quietly become the owner.

Linking your Mac

Linking is an explicit, user-confirmed scan. The Mac receives revocable, scoped authority — not ownership. Apple's hardware attestation exists on iPhone and has no Mac equivalent, so the Mac fails closed on operations that require it instead of quietly accepting a weaker check.

Importing from Slack, Notion, and Zoom

Coming later in the Mac app. Hubyn reads export files you already have, on your Mac, and encrypts them into your workspace before anything syncs. No plaintext from an import ever reaches our servers.

• Slack: an admin export of channels becomes Hubyn chats and groups, with history and file links. Private channels and DMs are included only when Slack's own export allows it for your plan.
• Notion: a workspace export of Markdown pages maps to shared pages. Databases (CSV) follow once Hubyn's database support lands.
• Zoom: cloud recordings and their transcripts are re-transcribed and summarized on the Mac. The archive is never uploaded.

Imported authors appear as names, not accounts, until they join. Hubyn can then offer to invite the teammates who aren't on it yet.

Moving a team, and running it

Planned for the Mac app, after it launches. The admin side is designed so that it never needs to see content.

• Start a team: an admin invites a group of 5–10 by email or from the Slack import's member list, and one-click offboarding removes a leaver from every space and group.
• Coexistence bridge: for 30–90 days, a chosen Slack channel mirrors both ways with a Hubyn space. It runs on the customer's own Mac with the customer's own Slack token, so no Hubyn server sees the content. It is labeled as not end-to-end encrypted on the Slack side and is time-boxed by design.
• Signed admin policies enforced on every device: retention periods, enabled features, and device limits.
• SSO and SCIM provisioning from the company directory, with the Hubyn PIN still the identity, tied to the company account by attestation.
• An audit log of admin actions only, never of content. Retention and legal hold are enforced on devices; legal exports are held by the company from its own admin devices.

Trust work in progress: a third-party penetration test and SOC 2 are planned. Neither is claimed as complete.

Hubyn is deliberately Apple-only: iPhone and Mac.

What Apple and our servers can see

Hubyn claims content blindness — not anonymity. Two disclosures we refuse to soften:

• Relay and storage: opaque IDs, sizes, and timing. No content, identities, or contact graph.
• Our registry: protocol traffic and operational timing, plus the fact that a contact was attempted.
• Apple and the network: IP address, account identifiers, timing, and volume — content is always ciphertext.
• Push notifications currently reveal to Apple how many people and groups you talk to — not who, never content. We are working the fix and stating the gap until then.
• Anything passing through Apple services can be delayed, blocked, or legally compelled. Encryption removes content exposure, not legal exposure.

Content blindness is not anonymity.

Defaults that protect you quietly

Notification previews show only “Hubyn — New message” until you opt into more. Read receipts are off until you turn them on. If a preference record is missing or unreadable, it resolves to the most private option — never silently back to open.

What we deliberately don't do

• No phone numbers. Identity is a handle you keep, not a number you rent.
• No contacts upload. There's no address-book pipeline at all.
• No analytics or telemetry SDKs.
• No duress PIN or decoy mode. A decoy that the file system contradicts can put someone in more danger than honest possession. That needs a real architecture and review, not a toggle.
• No certification theater. No FIPS, NIAP, or government authorization is claimed or implied.

Security claims are meant to be verified, not believed.

How this compares

Signal-grade message cryptography is not the differentiator — everyone serious uses it. The combination is: that cryptography with no phone number, no contacts pipeline, no telemetry, a backup-excluded local seal, and relays holding only opaque ciphertext under deletion secrets they never see. Unlike cloud-backed messengers, history doesn't come back after full device loss today. Encrypted backup, opened only by your recovery key, is on the way.

Limits, stated plainly

This page would be dishonest without its boundaries. As of this draft:

• Independent review is assigned but not yet executed. Until it closes, the only claim we make is “internally tested.”
• Production is intentionally inactive. There is no production or TestFlight population yet.
• One dependency on our abuse-prevention path is a release candidate and is release-blocking until replaced or approved.
• No key transparency yet, so typed-PIN first contact rests on directory integrity plus the security-code check.
• The recovery key cannot be rotated.
• No biometric prompt on every key use, and no protection at all once a device is unlocked, compromised, or unlocked under compulsion.
• Hubyn is visible on a device. High-risk users should weigh whether possession itself is a risk.
• No anonymity or traffic-analysis resistance, and no availability guarantee against platform or network denial of service.

Checking our work

Security claims are meant to be verified, not believed. The external review package pins an exact commit — never a moving deployment — with the threat model, evidence index, and reproduction steps. Every security fix ships with a test that fails before the fix. Suspected vulnerabilities go through private security reporting, never a public issue, and never with live user data or exploit details attached.