Before you move sensitive conversations

Lock your phone and set an app passcode

Anyone holding your unlocked phone can open your conversations. Use a screen lock on the phone, and set an app passcode in SeTalk, so the app asks for it before showing anything.¹

Keep the system updated and install apps only from trusted sources. Spyware on a phone reads what's on its screen, before any encryption.

Verify each contact through another channel

To be sure you're talking to the right person, compare the security code with your contact in person or through another channel, after you connect.¹

Send invitations only to the right person

An invitation sent to the wrong person connects you to the wrong person. Send each invitation link or QR directly to the person it's for, and don't post it where others can see it.¹

In groups, check who is in each group before you share something sensitive. Everyone in a group reads what's sent there. Group chats don't have the quantum-resistant layer that direct conversations have.²

Use disappearing messages

Your contact can take a screenshot, forward or show a message. Disappearing messages reduce what stays on both phones over time. They're turned on per contact, and your contact has to agree.¹

They don't stop a screenshot taken before the message disappears.

Back up your authenticator and keep your recovery codes apart from your phone

Your account opens with two of three: password, authenticator, recovery codes. Without two of them, nobody can recover it, including us.³

Use an authenticator app with a local backup, such as Aegis or 2FAS, and keep the backup somewhere other than your phone.⁴

Keep your 10 recovery codes in a password manager or on a sheet of paper stored away from your phone. These codes only work together with your password or with your authenticator.^4,3

If you lose your phone

1. Lock or erase the phoneIf you set up your phone's remote lock or erase feature, use it first.
2. Stop the lost phone from renewingOn setalk.app, generate new recovery codes with your password and authenticator. This ends every other session of your account, including the app's session on the lost phone, so the app there can't renew its subscription check. It doesn't erase anything on that phone.³
3. If the authenticator was on that phoneUse "I lost my authenticator" on setalk.app, with your password and a recovery code. It removes all authenticators, ends every session of your account (with the same limits as step 2) and gives you 10 new codes and a new authenticator to set up.³
4. Know what stays on the phoneSeTalk can't erase the phone remotely. The app on it stays linked to your conversations: it can keep sending and reading until its last subscription check expires (up to 14 days), then reading for 7 more days, and it keeps receiving messages in the background even after that. When the app locks, only its screens lock; nothing on the phone is deleted. That's why the screen lock and the app passcode matter, and why you should tell your contacts.³
5. Tell your contactsLet them know through another channel, so they don't trust messages from the lost phone.

Your conversations live on your phone. Recovery codes give you back your account, not the conversations on a lost phone.³

Read the threat model · Why SeTalk is safer