No phone number to hand over. No history sitting on a server somewhere. Once your message reaches the other person, we don't have it anymore — it's just the two of you.
Four things had to be true at once for that to hold up. Here's each one, plainly.
Most apps treat your phone number as identity. Guhya never asks for one — signup and recovery run entirely on email and username, so there is no single thread tying your account back to you.
Every message is locked with a Diffie–Hellman key exchange (ECDH P-256), then stepped through a Double Ratchet before AES-256-GCM encryption — so even a single leaked key can't unlock past or future messages.
The message and its metadata — who, when, from where — are deleted from the server the instant delivery completes. No history sitting on a disk somewhere, nothing to compel later.
The cryptography is written up in a public security report, including what is still a work in progress. Nothing here asks you to take our word for it.
Every message is locked on your device with a key we never see — Diffie-Hellman key exchange, a Double Ratchet for forward secrecy, and AES-256-GCM.
Sign up with just an e-mail and a username. Nothing links your account to who you really are — no phone number, ever.
Messages and their metadata are deleted the moment they're delivered. No backups sitting around, nothing for anyone to ask us for.
Text messaging is unlimited on every plan, including the free one. Paid plans only unlock media and voice.
Group messaging is available from day one, on the free plan — group creation and voice calls open up from Standard.
Calls are end-to-end encrypted the same way your messages are. Available from the ₹29 one-time Standard plan.
Signal and Threema are both well-established, well-audited apps — we're not claiming to have replaced them. Here's an honest, feature-by-feature look at where Guhya sits next to them, so you can judge for yourself.
| App | Phone number required | Server message retention | Pricing model | Origin |
|---|---|---|---|---|
| Guhya | Not required — email + username | Deleted on delivery, metadata included | Free unlimited text, one-time paid tiers from ₹29 | India |
| Signal | Required | Deleted after delivery, encrypted | Free, donation-funded nonprofit | United States |
| Threema | Not required | Deleted on delivery | Paid, one-time purchase | Switzerland |
| Required | End-to-end encrypted; metadata retained | Free, ad-supported ecosystem (Meta) | United States |
Signal and Threema are more established and more widely audited than Guhya today; we link our own encryption details openly in the Guhya Security Report so you don't have to take our word for it.
Text messaging never has a limit, on any plan. Paid plans are a single one-time payment — never a subscription — and unlock images, files, group creation and voice calls. Encryption is identical across every tier.
Prices in INR. See our Terms and Privacy Policy for full plan conditions.
We don't run ads. We don't track you around the web. We don't have affiliate deals steering you toward a plan. There's no investor behind Guhya either — it's a small, independent team based in India, and these one-time payments are what actually keep the servers running. Pay once, no recurring charge, no surprise renewal.
A plain-language technical review of the encryption, key handling, and account security behind Guhya — including where it honestly stands next to Signal, WhatsApp, and Telegram. For a code-level walkthrough of the same claims, see the source-code page.
Guhya is built and maintained by Prabh Hundal, a software developer based in Punjab, India, through his company Guhya Technologies. Prabh writes both the backend and the frontend himself — the encryption design, the server, and the interface are all one person's work, reviewed openly in the public security report and on the source-code page rather than kept behind a corporate wall.
The name "Guhya" (from Sanskrit, meaning hidden or secret) was chosen for what the app does — it is not related to any other historical or religious use of the word.
No. Just an email and a username. There's no phone number anywhere in signup or recovery.
Yes — text messaging has no daily limit on any plan, including free. Paid plans add image, file and voice call capacity.
Both the message and its metadata are deleted from the server the moment it's delivered. No history, no backups, nothing to hand over even if someone asked.
Yes — encrypted on your device with a Diffie-Hellman key exchange (ECDH P-256), stepped through a Double Ratchet for per-message forward secrecy, then sealed with AES-256-GCM. Full details, including real code excerpts, are in our security report and on our source-code page.
Signal asks for a phone number and is a large, widely-audited nonprofit app. Guhya only needs an email and username, deletes messages and metadata from the server on delivery, and funds itself through one-time plan payments. Signal is more mature and more widely reviewed today — our security report is upfront about that.
No. Every paid plan is a one-time payment — ₹29 or ₹399 — for extra media and call capacity. No auto-renewal, no recurring charge.
Group chat is on every plan, including free. Group creation and encrypted voice calls open up from the ₹29 Standard plan.
No ads, no tracking, no affiliate deals. We're a small, self-funded team based in India — the one-time plan payments are what actually pay for the servers.
Yes — Guhya is a progressive web app. Install it straight from your browser on desktop, Android, or iOS and it behaves like a normal app icon on your home screen.
Yes. Guhya is built and run by Guhya Technologies, based in Punjab, India — it's an India E2E encrypted app end to end, not a foreign product with a local skin.
Your backup passphrase is the only way to restore your key on a new device — we never have a copy and can't reset it for you. Without it, you can keep using your account, but old message history won't carry over to a new device.
Email us at prabh@guhya.space. Our team is based in Punjab, 143301, India.
Guhya was founded and built by Prabh Hundal, a developer based in Punjab, India, through his company Guhya Technologies. Prabh handles both the backend and frontend engineering himself.
Guhya is built end-to-end in India — sign-up needs only an email, messages and metadata are deleted from the server on delivery, and there are no ads or data sale. The full cryptographic design is published openly in our security report and on our source-code page for anyone to check.
No. Guhya (गुह्य) is a Sanskrit word meaning hidden or secret. The Guhya app, built by Guhya Technologies, borrows that word as its name because the app is built around keeping messages private — but the app itself is a modern, India-built, end-to-end encrypted chat product, not the historical term.
Guhya doesn't hide identities from each other in a conversation, but it never asks for a phone number, never stores message history on the server, and deletes metadata the moment a message is delivered — so there's nothing sitting around for anyone else to find.
Guhya is built as a private, hidden-by-default chat app — sign up with only an email, no phone number, and messages plus metadata are wiped from the server the instant they're delivered.
Yes — guhya.space/source-code walks through the real client-side cryptography module with code excerpts: ECDH P-256 key exchange, the Double Ratchet, AES-256-GCM, sender-key group encryption, and PBKDF2-wrapped key backup, so you can verify the claims instead of taking them on trust.
Email us — a real person on a small team will answer, not a ticket queue.
Small team, one clear rule: don't collect what you don't need. Come help build it.