Not a promise. A design constraint.
Here's exactly how Prowlr keeps your messages, photos, and location out of reach — including ours. No hand-waving, no "trust us." Just the mechanics.
Jargon, decoded
Six terms that'll make the rest of this page make sense.
- X3DH
- Extended Triple Diffie-Hellman — the handshake two devices use to agree on a shared secret the first time they talk, without that secret ever crossing the network.
- Double Ratchet
- A new encryption key for every single message. Message #47 and message #48 in the same conversation are encrypted with different, unrelated keys.
- Forward secrecy
- If a message key is ever exposed, it can't be used to decrypt anything sent before it — the past stays sealed.
- Trilateration
- Working out an exact location from three or more distance measurements — the same geometry GPS uses, run in reverse against a person.
- Passkey
- A key pair bound to your device's hardware (Face ID, fingerprint, Secure Enclave). Replaces passwords — can't be phished, guessed, or reused from a breach.
- Operator-blind
- Not "we promise not to look." We built the system so that looking isn't something it can do.
End-to-end encryption, step by step
Prowlr uses the Signal Protocol — X3DH key agreement plus a Double Ratchet — the same cryptographic design behind Signal's messaging. Here's what actually happens between "you type a message" and "he reads it."
- 01
Keys are born on your device
Your phone generates an identity key pair and a batch of one-time prekeys inside the iOS Secure Enclave or Android Keystore. The private halves never leave that hardware — not to us, not to a cloud backup, not anywhere.
- 02
Only public keys ever reach us
Your device uploads the public identity key and prekey bundle to Prowlr's key directory — a phone book of public keys. Useless for reading anything; essential for someone to start a conversation with you.
- 03
The handshake: X3DH
The first time you message someone, your device fetches their public prekey bundle and runs X3DH — both devices independently compute the same shared secret without either needing to be online at the same moment, and without that secret ever touching the network.
- 04
Every message, a new key: Double Ratchet
From there, the Double Ratchet rotates the encryption key forward with every message. That buys forward secrecy — an exposed key can't unlock the past — and post-compromise security: the conversation heals going forward, automatically.
- 05
We relay ciphertext, not conversations
Your encrypted payload passes through our server once, gets delivered, and is deleted. What briefly sits on our infrastructure is ciphertext we cannot read — not a conversation history.
What if someone's identity key changes?
Auth (who may log in) and cryptographic identity (who you are to the person you're talking to) are deliberately separate systems. If a contact's identity key ever changes — a new device, a reinstall, or something worth a second look — Prowlr surfaces a safety-number warning. Trust isn't assumed silently, and it isn't just on us to notice.
Beating trilateration
Location-based apps have a long history of being used to physically deanonymize people by triangulating exact distances. If an app tells you "exactly 214 meters," and someone can check that number from three different vantage points, basic geometry hands them a real address. Prowlr is built to make that math fail.
Raw coordinates never reach other clients
Distance is computed server-side. What you and other users receive is a number — never GPS coordinates, yours or anyone else's.
A secret, per-account offset
Each account's position is snapped to a grid and shifted by an offset derived from an HMAC keyed with a server-side secret — not a formula anyone could recompute just by knowing your account ID.
Distance quantization
Displayed distances round to a step rather than reporting bare meters, which destroys the fine-grained precision trilateration depends on.
A minimum-distance floor, and an incognito toggle
A floor stops '0m'-level precision at close range. One tap hides your distance from everyone, entirely.
Today's release leans on distance jitter as the primary defense. Firmer boundaries — defined "private zone" radii around places like home or work — are on the roadmap, not shipped yet. We'd rather say that plainly than imply more than what's live today.
No passwords. No SMS codes. No phishing surface.
Prowlr authenticates with passkeys (WebAuthn) — the same technology behind "sign in with Face ID." Every passkey is a hardware-bound key pair; there is no password, no one-time SMS code, and no shared secret sitting in a database waiting to be stolen.
Unphishable by design
A passkey is cryptographically bound to Prowlr's real domain. A lookalike phishing site simply can't get your device to produce a valid signature for it.
Nothing useful to steal
There's no password hash database to leak. A server breach yields public keys — worthless without the private half locked in your device's hardware.
Two identities, kept apart
Being able to log in as you and being able to read your messages are different keys entirely. Compromising one doesn't hand over the other.
Operator-blind by construction, not by policy
If the server can never read messages, photos, or private location, it never has to store plaintext, index it, or run moderation software over it. Strip that out and the backend collapses into something small on purpose: a stateless relay, a public-key directory, and a geospatial index.
That's also, not coincidentally, why it's cheap to run. Privacy and cost point the same direction here — no ML pipeline scanning messages, no plaintext database that needs a breach-response plan, because there's no plaintext in it to lose.
Moderation without surveillance
Public surfaces — profiles, event listings — are moderated the way you'd expect. Private conversations are never scanned; we're not capable of it. If something happens in a private chat, the person it happened to can report it — client-side, explicit, by them. That report is the only path abuse in a private conversation ever reaches a human, and it's their call to send it, not automatic surveillance.
