A phone line between your own devices.

When you open Callyou for the first time, the device makes a key: a long secret number, and a public half that works like its address. The secret half never leaves the device. On a phone it is kept in the phone's own secure key storage.

The public half is how other devices know this device is really this device. It is also where its mino comes from: the key draws the mino, so the same device always shows the same one, on every screen.

Because the key never leaves the device, there is no account to sign in to, and nothing to steal from a server. A new or restored phone makes a new key, and you pair it again.

Two devices trust each other only after you pair them. One shows its code, as a QR code or a link. The other scans the code or opens the link, and sends a request. The first shows the request with the mino of the device that asked, and you check that it matches the one on the other screen before you accept.

From then on, each keeps the other's public key. When a call comes in, the device checks the caller's key against the devices it paired, and turns down any other before it rings. There is no phone number to guess and no directory to look anyone up in.

Home networks hide devices behind their routers, so two devices can't simply find each other. Callyou uses iroh, an open source networking library, to dial a device by its key. Each device keeps in touch with a relay server, so the other can reach it. When you call, the two devices try to connect to each other directly, through their routers, and keep using the relay when they can't.

Either way the link is encrypted, and each end proves it holds its key, so nobody can pretend to be one of your devices. Today these relays, and the address book that points to them, are the public ones that n0, the makers of iroh, run. They see which keys are online and connect to each other, and the devices' internet addresses, but not what passes between them.

Over that link, the two devices agree on the call: what each can send and receive, and how to reach each other. Then the sound and video travel over WebRTC, the same technology browsers use for video calls.

The call is encrypted on one device and opened on the other. The two devices check each other's encryption keys over their own encrypted link, so no server in between can slip in and listen.

Some networks keep two devices from reaching each other. The call then passes through Callyou's relay server, a TURN server in the Netherlands. It stays encrypted end to end, so the relay can't see or hear it. It sees both devices' internet addresses and how much data passes.

A phone that's asleep can't hear a call arrive, and keeping a connection open all day would drain its battery. So the calling device asks Callyou's push service to wake it. The push service sends a small wake-up through Apple on an iPhone, through Google or your own UnifiedPush app on Android, or through your browser's push service. The phone wakes, connects, and rings.

The push service keeps one thing per device: its public key and its push address. It never learns a name. A computer stays running to ring, so it is never woken.

No server ever sees or hears a call, and none learns a name. This is what each one does see.

Our privacy page says how long each one keeps it.