Built to
get through.
Three layers between your phone and the open internet: an entry point that looks like ordinary cloud traffic, a private tunnel, and a server we own. Here is the shape of it, without the addresses.
What a censor sees is a connection to a cloud address. What carries your traffic is a server we own.
- 1Entry points
Cloud fronts in the United States and in Frankfurt. They look like any other cloud traffic, and when one is blocked a new one replaces it. They never hold your traffic in the clear.
- 2Private tunnels
Each entry point forwards over a private, encrypted tunnel to the back-ends. The back-ends have no public face of their own, so there is nothing to block there.
- 3Our own servers
Traffic leaves from hardware we run in Los Angeles and from dedicated servers in Falkenstein, Germany. No rented exit nodes, no third-party VPN backbone.
Two transports
The first is standard WireGuard, carried over TCP so it passes networks that drop unfamiliar UDP. The second is a transport we built ourselves to keep working where known protocols are recognised and blocked. The app tries what works on the network you are on and switches without asking you.
Configuration is signed and fetched from our own domains, and the app connects only to our own servers. There is no marketplace of third-party nodes behind it.
What this means for you
On an airport or hotel network, the operator sees one encrypted connection to a cloud address and nothing else: no sites, no apps, no messages. Where the network blocks sites, the same connection carries them.
We keep no account for the free tier, because there is none. Premium is tied to the email or store account that bought it, and nothing more.
Two transports
WireGuard over TCP, and one of our own for blocked networks.
Signed configuration
Fetched from our own domains; the app refuses anything unsigned.
Only our servers
No third-party exits. We name the cities and we mean them.
Linux with checksums
A static binary and SHA-256 sums, so you can verify the client you run.
What we do not publish
No addresses, hostnames, server counts or provider details, and nothing about how the second transport avoids detection. Not because the design is fragile, but because every detail we print is one more thing a censor can act on, and the people this network exists for pay for that, not us.