DeltaFox
Encrypted messenger with built-in AI assistant
▎ A year ago I asked myself a question that wouldn't leave me alone: why does every messaging app in the world need my phone
number, my email, or my contacts just to let me talk to someone?
▎ WhatsApp is owned by Meta — the same company that built its empire on selling user data. Telegram markets itself as secure
but doesn't encrypt chats by default — your messages sit on their servers in plain text. Signal is the gold standard for
encryption, but it still requires your phone number, linking your real identity to every conversation from the moment you
sign up.
▎ I'm a developer from Italy. I had no team, no investors, no funding. But I had time, stubbornness, and a belief that truly
private communication shouldn't require you to hand over a single piece of personal information.
▎ So I built DeltaFox. Every line of code. Every pixel. Every cryptographic function.
▎ Over one year of development. One person. Zero compromises on privacy.
▎ ---
▎ The Cryptography — built from zero, not borrowed
▎ I didn't use Signal's library. I didn't wrap someone else's protocol. I implemented the entire encryption layer myself:
▎ - X3DH (Extended Triple Diffie-Hellman) for the initial key exchange — when two users first connect, they establish a
shared secret without ever transmitting it. Three Diffie-Hellman computations using Curve25519 keypairs create a root key
that only the two devices know.
▎ - Double Ratchet Protocol (DFXM3/DFXM2) for ongoing message encryption — every single message gets a unique encryption
key. If one key is ever compromised, past and future messages remain secure. The ratchet advances with every message sent,
making bulk decryption mathematically impossible.
▎ - NaCl (Networking and Cryptography Library) with XSalsa20-Poly1305 for symmetric encryption and Curve25519 for key
agreement. No AES, no RSA, no legacy algorithms. NaCl was designed to be misuse-resistant — it's extremely hard to implement
incorrectly.
▎ - Sender Key Protocol for group chats — each member generates a sender key, encrypts it individually for every other
member using their Double Ratchet session, and distributes it. When someone is removed from a group, all sender keys are
rotated. Forward secrecy is maintained even in groups.
▎ - SQLCipher AES-256 for the local database — all message history is encrypted at rest on your device. If someone clones
your phone's storage, they get nothing but encrypted noise.
▎ - DTLS-SRTP for voice and video calls — the same standard used by every WebRTC implementation, but routed through global
TURN relay servers so calls connect reliably between countries behind any type of NAT or firewall.
▎ The server sees only encrypted blobs. It cannot read message content, media, locations, or call audio. Messages are
deleted from the server after delivery confirmation.
▎ ---
▎ The Features — privacy without sacrifice
▎ I refused to build an app that was "secure but limited." DeltaFox has everything you expect from a modern messenger:
▎ - Encrypted voice and video calls — WebRTC peer-to-peer with Twilio global TURN servers. Works across countries, on
cellular and WiFi, with automatic reconnection if your network drops mid-call.
▎ - Lilith — built-in AI assistant — text conversations powered by Anthropic Claude Haiku, real-time voice conversations
powered by OpenAI. She speaks all 10 supported languages. No other encrypted messenger has an AI assistant built in.
▎ - Ghost Mode — set a second "panic" password. If someone forces you to unlock the app, entering the panic password shows a
completely empty account with no messages, no contacts, no history. Your real account remains hidden and intact.
▎ - View-once media — photos and videos that self-destruct after 8 seconds. Combined with screenshot detection that alerts
the sender.
▎ - 10 languages — Italian, English, Spanish, French, German, Russian, Turkish, Albanian, Greek, Georgian. Every screen,
every button, every notification fully translated.
▎ - Anonymous registration — username and password. That's it. No email. No phone. No contacts uploaded. No identity
verification. You are a username and nothing more.
▎ - Phone calls to real numbers — integrated Twilio Voice for calling and texting actual phone numbers worldwide, all from
within the encrypted app.
▎ ---
▎ The Stack
▎ - Client: React Native with Expo SDK 54, New Architecture enabled
▎ - Server: Node.js + Express + Drizzle ORM + PostgreSQL
▎ - Encryption: Custom DFXM3/DFXM2 Double Ratchet + X3DH + NaCl (tweetnacl)
▎ - Calls: WebRTC P2P + Twilio TURN relay + CallKit (iOS)
▎ - AI: Anthropic Claude Haiku 4.5 (text) + OpenAI Realtime API (voice)
▎ - Infrastructure: Self-hosted on Hetzner in Helsinki, Finland. Nginx reverse proxy with Let's Encrypt SSL. Zero
third-party analytics. Zero tracking.
▎ ---
▎ The Hardest Parts
▎ - Writing the Double Ratchet implementation and debugging why message #47 in a conversation would occasionally fail to
decrypt — turned out to be a chain key counter overflow in my ratchet state machine
▎ - Making WebRTC calls work from the iOS lock screen — this required native Swift code integrating CallKit with PushKit
VoIP notifications, bridging audio sessions between CallKit and WebRTC, and handling a dozen race conditions between the
native and JavaScript layers
▎ - Passing Apple's App Store review — they rejected the first build with 5 issues. I fixed everything and got approved the
same day on the second submission
▎ - Fighting the loneliness of building something this complex alone for over a year. No one to review your code. No one to
debate architecture decisions with. Just you and the compiler.
▎ ---
▎ Where I Am Now
▎ - Live on the App Store — https://apps.apple.com/app/deltafox/id6761270754
▎ - Google Play — coming in the next two weeks
▎ - Revenue: $0
▎ - Investors: none
▎ - Team size: 1
▎ - Total cost: a €15/month server, €99/year Apple Developer account, and mass amounts of coffee
▎ I'm not trying to take down WhatsApp. I'm building for the people who read privacy policies. The people who use VPNs. The
journalists, the activists, the developers, and anyone who's ever felt uncomfortable knowing that a corporation is reading
their messages to serve them better ads.
▎ DeltaFox is available now. Try it: https://www.deltafoxxx.eu/app.html
▎ AMA — I'll answer anything about the cryptography, the architecture, the App Store experience, or what it's like to build
a complete messenger as one person.
Comment