MessageVAX launches privacy messaging app in 15 countries

MessageVAX has released version 3.0 of its messaging app on Google Play across 15 countries and in 10 languages.

The Sydney-based company has also submitted an iOS version to Apple, where it is under App Store review. Founder Dr Wolf Mueller-Leydig said version 3.0 is the company's first public release after five years of development.

MessageVAX describes the app as a privacy-focused messaging service for sensitive information. Readable conversation history remains on a user's device, while its server relay, known as the Post Office, stores delivery items only until they are collected or expire.

The release is available in Australia, New Zealand, the United States, Canada, the United Kingdom, Switzerland, Norway, Japan, Singapore, South Africa, the United Arab Emirates, Mexico, Brazil, Argentina and Chile.

Privacy model

Messages are encrypted on the user's device with keys generated there and used once for a single message. The system is designed so the service operator cannot read the contents of messages handled by the Post Office.

Technical details disclosed for version 3.0 include X448 key agreement, ML-KEM-1024 post-quantum key establishment, HKDF-SHA-512 key derivation and AES-256-GCM authenticated encryption. A new 256-bit key is derived for every message.

The app also includes controls intended to limit how long content remains accessible. These include TTL, or Time-To-Live, settings for local readable copies and uncollected items, as well as Burn After Reading and Burn After Send options.

Users can also activate tools called Amnesia and Eject. According to the company, Amnesia destroys selected data on the current device, while Eject closes the account and starts local clean-up.

Other features include the ability to send messages to oneself and to edit messages, attachments and timelines. The company said these are intended to give users more control over what remains visible on a device.

Payment model

MessageVAX is using a credit-based payment model rather than advertising. The app includes 20 welcome credits on first download, and users buy Message Credits in the app to send messages.

There are no advertisements and no third-party advertising trackers, the company said. It said this sets the app apart from many mainstream consumer messaging services that rely on broader platform ecosystems or ad-supported business models.

The product is owned by Superclass, which MessageVAX describes as a boutique software business based in Sydney. Superclass builds the app and operates the MessageVAX OHTTP Relay, while MessageVAX operates the Post Office.

A statement accompanying the launch set out the company's position on privacy and the design of the service.

"Messages should always be as private as your thoughts. After five years of research, planning and development, our first release covers all stages of a message's vulnerability: data at rest on your device, data in transport, and stored data on a server. Messages are encrypted on your device with keys that are generated on your device and used only once for a single message. When a message is exchanged, we have taken our D2 generation of transport encryption to the next level, which includes quantum-era countermeasures and more. We call it D4. Our Post Office is the server that facilitates the exchange of encrypted messages between users, and because the keys are generated on a user's device, we can never know what a message contains. This is the core that does the heavy lifting. After that, the fun starts: there is a long list of clever features that further enhance privacy and security. They include setting a TTL, or Time-To-Live, for messages on your device; the ability to send messages to yourself; editing messages, attachments and timelines; sending messages as Burn After Reading and Burn After Send; and the emergency app controls Amnesia and Eject. I leave it to you to do more research from the published information on our website, and to try the app," said Dr Wolf Mueller-Leydig, Founder, MessageVAX.