In-person pairing
Both phones generate an ephemeral X25519 keypair. The QR carries the public half. Each side combines the other party's public key with its own private key (ECDH) and derives the same shared secret locally. No server ever sees it.
Help and support
How can we help?
Short answers to the questions that come up most. If yours is not here, write to info@hongi.io.
Backend and data
What stays on your phone. What reaches our servers.
For your personal contacts, Hongi works on your phone. Once you have paired, codewords are computed on the two phones without an internet connection, and the secret you share is derived on the paired phones and never sent to our servers. Some features do use our servers; the main ones are below.
- 1
Remote pairing (invite links)
When you pair with someone who is not with you, our relay briefly holds a pairing session: identifiers, temporary public keys and the display name you share, encrypted between the two phones. The relay cannot read that name or work out your shared secret. Sessions expire automatically, after 30 minutes as standard.
- 2
Verification notifications
For a silent check, our push service links a pseudonymous mailbox identifier to your app's push token and passes an encrypted message through Expo to Apple or Google. They see routing information, not your codewords.
- 3
Organisations and work accounts
If you add an organisation from the directory, Hongi keeps a pairing record and an encrypted copy of the organisation's side of the secret, so that its agents can verify you. If your employer gives you a work account, Hongi holds your email address, role and membership; with Hongi Work also your phone's certificate with your approved name and role, and online status checks, logged without names.
What we never receive
- Your personal codewords and shared secrets. They are derived and kept on the paired phones.
- Your calls. No audio, no call content, no transcripts. Hongi is never part of the call.
- Your address book or location. The app does not ask for your contacts or your GPS location.
- Advertising trackers. No advertising or third-party behavioural analytics in the app.
- A sign-up for personal use. Pairing with the people you trust needs no account.
Our servers do process some data, such as IP addresses in service logs and the records above. The privacy notice lists all of it, with how long we keep it.
Under the hood
How it works, in pictures.
Four short diagrams showing how pairing, codewords, and silent checks actually work. The same drawings you would see on a security whiteboard, with the cryptographic primitive each step uses.
Remote pairing
Hongi's relay forwards an end-to-end encrypted invite from one phone to the other. The relay cannot decrypt the payload. After delivery, the two phones derive the same shared secret via X25519 on-device, exactly as in the in-person case.
Codeword derivation
Every 30 seconds, both phones run HMAC-SHA512 over the shared secret and the current time slot to derive two different codewords. One is what you say, the other is what you hear. An impostor without the shared secret cannot produce either.
Silent check
To send a silent check, your phone encrypts the message and sends it through our push service and Expo to Apple or Google, which deliver it to your contact's phone. Our push service routes it by a pseudonymous mailbox identifier and cannot read it.
How does pairing work?
In person: open Hongi, tap Pair and scan the QR code on the other phone. Remote: tap Pair, then Invite link, and send it through any channel; the invitation passes through our relay, but your codeword secret never does. The two phones derive a shared secret locally with X25519. No server sees that secret.
What if I lose my phone?
Codewords can't be recovered without the device, by design: the shared secrets are kept only on the paired phones. To restore protection with a contact, pair with them again on your new phone.
Is Hongi really offline?
Once you have paired, yes. In person you pair with a QR code; remotely, the invitation passes through our relay. After that, codewords are computed on the phone from the shared secret and the current time, so checking a codeword needs no internet. The silent check does need a connection on both phones.
What does the silent check do?
When a caller feels wrong and you can't ask for a codeword aloud, tap Send a silent check. Your real contact's phone shows a notification that a contact is asking for an identity check; only in Hongi do they see who is asking, and they answer “Yes, it's me” or “No, I'm not on a call with …”. The caller hears nothing. Both phones need an internet connection for this.
How do I add a contact?
Tap Pair to start a new pairing. Scan the QR, or send an invite link. Once paired, the contact appears on the Home screen with their current codeword.
How do I delete my data?
In the app, open Settings and tap Delete all data at the bottom: it removes your paired contacts, their secrets and Hongi's settings from the phone, and signs out any work account. If you no longer have the phone, hongi.io/delete explains what you can do, including how to ask privacy@hongi.io about data on our servers.
Which languages does Hongi support?
Dutch, English, French, German, Turkish, Spanish, Italian, Portuguese, Polish, Arabic, Hindi, Indonesian, Japanese, Korean, and Chinese. The website matches.
How secure is the cryptography?
Pairing uses X25519 elliptic-curve key exchange (RFC 7748). Codewords are derived with HMAC-SHA512 (RFC 4231) from the shared secret and the current 30-second time slot. For personal pairs, the secrets are kept only in the protected storage of the two paired phones (iOS Keychain or Android Keystore-backed storage); no server holds them.
Why is it called Hongi?
Hongi is the Māori greeting where two people press noses and foreheads together and share one breath, the ha. It marks the moment two people are no longer strangers. The app does the same job in a different shape: two people, paired once, trust each other from then on.
Still stuck?
Email info@hongi.io. Tell us the OS (iOS or Android), the app version (Settings, About), and what you were trying to do. The faster we can reproduce, the faster we can fix.
Want to support the project?
Hongi is free, with no ads, and personal use needs no account. If it helped you dodge a scam or just gave you peace of mind, a tip keeps the lights on.
Leave a tip →