Decision guide¶
This guide translates the report’s conclusions without scores or guarantees. Answer the questions you understand. Nothing is sent or stored.
What these recommendations do NOT protect you from¶
- Compromised / unlocked device and spyware.
- Copying, screenshots or disclosure by the contact.
- Initial Discord traces, reused alias, avatar, voice or files.
- Global correlation; relay, ISP, telecom, store and backup data depending on the path.
Decision rules and evidence¶
- Everyday security
- E2EE and everyday use, with identity and client-specific limits.
Signal, Threema, Olvid [1] [2] [3] - Pseudonymity
- Separate identities; Signal needs hardened settings and retains the number at the service.
SimpleX, Signal, Threema, Olvid [1] [2] [3] - Metadata minimisation
- Reduce centralised identifiers; relays, networks and endpoints remain observers.
SimpleX, Cwtch, Briar, Ricochet Refresh [1] [2] [3] - Network anonymity
- Tor or configured relays against a limited observer, without a global-observer guarantee. Verify the actual Tor / relay path; TURN alone does not hide IP from the ISP.
Cwtch, Briar, SimpleX [1] [2] [3] - Ease of use
- Adoption and simplicity take priority; WhatsApp retains substantial metadata exposure.
Signal, WhatsApp [1] [2] [3] - Teams / chosen server
- Teams with server, device, encryption and history configuration.
Matrix / Element, Wire [1] [2] [3] - Malicious contact
- Force relayed calls; the relay then sees IP and duration.
SimpleX, Olvid, Signal [1] [2] [3] - Legal requests
- Minimise held data without immunity: device, telecom, store and contact remain sources.
SimpleX, Cwtch, Briar, Ricochet Refresh [1] [2] [3] - Censorship
- Diversify transports or servers; country, operator, bridges and maintenance matter.
Briar, Cwtch, Matrix / Element, XMPP / OMEMO [1] [2] [3]
data/messengers.json · decision.js
Report 1.0 · 14 October 2026. No network lab, controlled forensic testing or bit-for-bit reproduction of binaries. Unknown remains Unknown.