Calls
Encrypted voice and video
One to one, end to end, with the quality following your connection. Speech is coded at 13.2 kbit/s, about what an old GSM call used, so a call stays clear where other apps give up.
Free forever · No account · No tracking
Private calls, anywhere.
Clavenzo is encrypted calling and messaging with no phone number to give out and no account to create. Your identity is a key your phone or computer makes by itself. It stays on that device unless you export it yourself, and we never hold it.
App StoreComing to the App Store
Google PlayComing to Google Play
Windows and Linux today; Android, iPhone and Mac coming. Eleven languages. No price, now or later.
- 13.2kbit/s
- Clear speech on a connection that carries almost nothing
- 0
- Accounts, phone numbers and email addresses required
- 11
- Languages, in the app and on this site
- 72hours
- The longest a sealed offline message can exist on a server
What it does
Everything below is something the app does today, not something on a roadmap.
Messages
Text, photos, files, voice messages
Everything you send is encrypted on your device to the person you send it to. Conversations live on your device, not in anybody's cloud.
Local Wi-Fi
Calls on the same Wi-Fi
Two devices on the same Wi-Fi or hotspot can call each other directly, even with no internet: on Android once the phone being called taps Ready to receive, on iPhone while Clavenzo is open, and on a computer whenever Clavenzo is running. Messages and files go the same way while the app is open on both.
Verification
Four spoken safety words
Every call shows both people the same four words. Read them aloud. If they match, there is nobody in the middle, and no certificate can give you that assurance.
Forward secrecy
Today's call cannot be opened tomorrow
Each call negotiates throwaway keys that are destroyed when it ends, then adds a post-quantum layer, ML-KEM-768, a moment after it connects, when both apps support it. A recording made today stays unreadable even if a long-term key leaks later.
Nothing to sell
No ads, no analytics, no profile
No tracking, analytics or advertising code in the app. The only closed-source third-party code in it is Google's push service on Android, which wakes the phone for a call or a message. Nothing is measured, nothing is sold.
Why it exists
For everyone. For free speech.
Private conversation is not a luxury or a feature to sell. It is how people tell the truth: to a doctor, a lawyer, a reporter, a friend, their own family. Everyone, everywhere, should be able to talk without being overheard.
So Clavenzo asks for nothing to begin with (no phone number, no email, no name) and costs nothing, for good. It carries no ads and no trackers and has nothing to sell. We built it for people, not for profit, and we built it to keep working when conditions stop being easy.
-
Free, for good
No price, no subscription, no ads, no paid tier. Privacy that costs money is privacy for some.
-
Nothing to hand over
No number, no email, no account. There is no list of users with names on it to leak, sell or demand.
-
Built to keep going
Direct calls, a few small servers, two relay services, and calls on the same Wi-Fi. A failure somewhere is not silence everywhere.
Built for the day things go wrong
Most apps assume a fast connection and a data centre that never blinks. Clavenzo was designed the other way round: for weak signal, failing servers, networks that interfere, and the day the internet is simply not there.
-
Local Wi-Fi
Calls when the internet is down
Two devices on the same Wi-Fi or hotspot can still call each other, encrypted, with no internet and no server: on Android once the phone being called taps Ready to receive, on iPhone while Clavenzo is open on it, and on a computer whenever Clavenzo is running. Messages and files travel the same way while the app is open on both.
-
A few servers
A few small servers are enough
Servers only introduce two phones and hold sealed messages; your voice goes phone to phone. That is why the whole service runs on a handful of small machines, with different providers in different places, and why a new one can join without an app update.
-
No single point
Lose a server, keep talking
Your device registers with every server, not just one, and checks them all. The list of servers is signed and includes plain addresses with pinned certificates, so a failed server, a DNS failure or a CDN outage does not cut you off.
-
Two relays
More than one way through
When two networks refuse a direct path, a relay carries the encrypted call: our own relay first, over UDP and then TCP, then Cloudflare's. Losing one takes away an option, not your ability to call.
-
Thin connections
Clear on almost no bandwidth
Speech needs 13.2 kbit/s, the budget of an old GSM call and about 6 MB an hour. Lost packets are concealed rather than clicked through, so a conversation keeps going on a connection other apps give up on.
-
Patience
Nothing lost while you are offline
A message to a phone that is switched off is sealed and held for up to 72 hours. A large file that gets cut off resumes where it stopped when the connection comes back, instead of starting again.
No app can promise to work through anything. If every road out of a network is cut, calls over the internet stop. Calls on the same Wi-Fi can carry on, within the limits above. When things break
How it works, in three steps
Signing up is not a form. It is your device making a key.
-
Your device makes a key
The first time you open Clavenzo it generates a cryptographic identity. The private half stays on the device unless you export it. Nobody asks for your name, number or email, and there is nothing to log in to.
-
You share a short code
That key has a 16-character code and a QR beside it. Hand someone the QR to scan, or send them the code. That is the whole of exchanging details.
-
You talk, and nobody else can
Calls go straight between the two devices whenever the network allows. To find that path, each one learns the other's IP address, even if the call ends up relayed. When the direct path fails, a relay passes along bytes it cannot read. Either way it is encrypted end to end.
What our servers can see
Never what you say. Here is what they do see.
- No content, ever. Call audio and video are encrypted between the two devices with keys that exist nowhere else. A relay forwards packets it cannot decrypt.
- No names and no numbers. The directory holds each device's address, public keys and platform, and a phone's push token. It has never held a name, a phone number or an email address, because the app never asks for one.
- Who contacts whom. A call invitation or an offline message has to say which address it is for and which it is from, so the server sees those two pass. Once the item is gone, it keeps no record of the pair. Hiding the sender too, known as sealed sender, is on our list, and until it ships this page says so. Cloudflare, which our servers sit behind, sees the same details.
- Nothing kept longer than it must be. A call invitation waits 60 seconds. A sealed offline message waits 72 hours and is then gone, collected or not. A registration is deleted 30 days after the device last checks in.
And what it cannot do
Clavenzo cannot hide from your network that you are using an app. It cannot protect a phone that is already compromised. It has not had an independent security audit. The safety words only work if you actually read them to each other.
Free, and staying free
No price, no subscription, no ads, no paid tier, no upsell. It was built for people rather than for profit, because everyone deserves a conversation nobody is listening to.
Get Clavenzo