Security and privacy at Yapie

#Your account

• Passwords are stored only as salted Argon2 hashes — a modern, deliberately slow algorithm that resists cracking.
• Two-step verification: add a code from Google Authenticator, Microsoft Authenticator, Authy, 1Password or similar. Each code works once.
• New-login alerts arrive in your Saved Messages, and you can end any session from Settings › Devices.
• Brute-force protection: repeated wrong passwords or codes are slowed down per account and per network.
• Recovery codes let you back in if you lose access, without handing control to anyone else.
• App lock with a PIN on your device.

#Your messages

• Secret chats are end-to-end encrypted: the keys stay on your devices, and the server only ever stores ciphertext.
• Regular chats are stored on the server so they sync across devices and can be recovered.
• Disappearing and view-once messages are removed and are never copied into the recovery vault.
• Uploaded files are served as inert downloads that can't run code in your browser.

#Your contacts

When you sync contacts, phone numbers and emails are turned into one-way hashes on your device before matching. Yapie only learns about contacts who already use Yapie.

#Your privacy controls

Choose who sees your last seen, profile photo and bio, who can add you to groups, who can message or call you, and whether read receipts and typing indicators are shared. Strangers' messages wait in Requests with links disabled.

#Never losing your data

Yapie keeps a recovery vault on the server: chats (including edits and deletions) and uploads are saved every few minutes in highly compressed form and are never deleted by the app. If you lose a phone, delete a chat by accident or lose a backup, support can restore it into your account. Access to the vault is limited to administrators and every export or restore is logged.

#Our servers

• The Yapie service runs in a locked-down sandbox with a read-only system, no extra privileges and access only to its own data folder.
• Security headers and a strict content security policy protect the web app; sign-in endpoints are rate-limited.
• Database snapshots are taken nightly, compressed and verified.

#Report a vulnerability

Found a security issue? Please tell us privately through Contact (or the address in /.well-known/security.txt) before disclosing it publicly. Include steps to reproduce. We'll confirm receipt, keep you updated and credit you if you'd like.

#Frequently asked questions

Are all Yapie chats end-to-end encrypted?

No — secret chats are. Regular chats are stored on the server so they sync across your devices and can be recovered if you lose your phone. Use a secret chat when you want only the two devices to hold the messages.

Can Yapie staff read my messages?

Regular chats are stored on the server. Access to the recovery vault is restricted to administrators, used for recovery requests, and every access is logged. Secret chats can't be read by anyone but the participants.

How do I turn on two-step verification?

Go to Settings › Privacy & security › Two-step verification › Set up, scan the QR code with your authenticator app and type the 6-digit code.

Try Yapie free

No credit card, no Google account needed. Your chats come with you to every device.

Open YapieDownload the app