What Does a “No-Logs” Messenger Actually Mean?

A no-logs messenger is one whose server keeps no record of who you are, who you talk to, or what you say — beyond the bare minimum needed to pass a sealed message along, and only for as long as that takes. The phrase gets stamped on marketing pages everywhere, so it helps to know exactly what a server could record, what "no logs" honestly rules out, and how you can check the claim instead of trusting it.

What a relay can actually log

When you send a message, it travels through a server (often called a relay) on its way to the other person. Even if your message is end-to-end encrypted so the server can't read it, that server still handles the delivery — and delivery touches a lot of information that has nothing to do with the message body.

Here's what a relay is technically capable of recording:

• Content — the message itself. End-to-end encryption removes this: the server only ever sees ciphertext.
• Metadata — who sent to whom, when, how often, message sizes, and which accounts are online together. This is the part that survives encryption, and it's frequently more revealing than content. We cover it in depth in messaging metadata explained.
• Network identifiers — your IP address, which can pin down your location and internet provider.
• Account data — a phone number, email, username, or device ID tied to your identity.
• Retention — how long any of the above sits on disk, and whether it's ever truly deleted.

"No logs" is a claim about all of these, not just the message text. A service can be perfectly end-to-end encrypted and still log your IP, your contact graph, and your online times. So the useful question isn't "is it encrypted?" — it's "what does the server still know, and for how long?"

Retention and TTL: the difference between "we delete it" and "it was never stored"

Two services can both say "we delete messages after delivery" and mean very different things.

• Retention is how long data is kept. A short retention window (say, a few days) is better than indefinite storage, but the data still exists in the meantime.
• TTL (time-to-live) is a hard expiry stamped on the data itself. When the clock runs out, the item is purged whether or not anything else happens.

The strongest version combines a short TTL with ack-gated deletion: the server holds a sealed message only until the recipient's device confirms it arrived (the "ack"), then deletes it immediately — with the TTL as a backstop so undelivered messages don't linger forever. Nothing is archived "just in case."

Why "no account" beats "no logs"

Here's the uncomfortable truth about any no-logs promise: it's a policy, and policies can change, be misconfigured, or be overridden by a court order. You're trusting the operator.

Architecture is stronger than policy. If a service never collects a phone number or email in the first place, there's no identity for anyone — including the operator — to hand over, log, or leak. You can't be de-anonymized by data that was never gathered. This is why the most privacy-serious designs try to not know things rather than promise not to look.

Many excellent apps still tie your identity to a phone number. Signal, for example, is a genuinely private, well-audited messenger — but it requires a phone number to register, which is an identifier that exists on their side even though your messages don't. That's a reasonable, honest trade-off; it's just a different one from a design that has no account at all.

How to verify a no-logs claim

You don't have to take anyone's word for it. A few things separate a checkable claim from a slogan:

1. Open source. If the client (and ideally the server) is open, independent researchers can inspect what's collected and sent.
2. What identity is required. No phone number and no email means there's simply less to log. Ask what you have to hand over to sign up.
3. Metadata handling. Does the design hide your IP and contact graph, or just encrypt the message body? Routing over a network like Tor can hide your IP from the server entirely — see Tor messaging explained.
4. Retention specifics. Vague ("we don't keep logs") is weaker than specific ("sealed ciphertext, deleted on delivery, hard expiry after N days").
5. What the server can even see. With true end-to-end encryption, the server holds ciphertext it cannot decrypt — so "we don't log messages" becomes "we couldn't read them if we tried."

For the bigger picture on how all these pieces fit together, see our pillar guide to the encrypted messenger.

How Graphite approaches no-logs

Graphite is built around the "don't know it in the first place" principle rather than a promise to behave.

• No account. There's no phone number and no email. Your identity is a 12-word recovery phrase generated on your device — the server has no account record for you at all.
• Ciphertext-only relay. The relay stores only sealed ciphertext. It never sees your plaintext, your keys, or your recovery phrase. Messages carry a 7-day maximum TTL and are deleted after delivery is acknowledged — ack-gated, with the TTL as a backstop.
• Metadata and IP protection. Signaling and messages run over Tor by default (fail-closed, via a bundled Tor connection to a hidden service), so the relay doesn't see your IP or network. On mobile, calls are routed so the other person doesn't see your IP either. (Real-time call media is peer-to-peer DTLS-SRTP.)
• Modern encryption underneath. Messages use NaCl/libsodium X25519 sealed boxes with a hybrid post-quantum layer (ML-KEM-768) and Signal-style double-ratchet forward secrecy — so even if the ciphertext were somehow captured, it stays sealed.

The point isn't that Graphite promises not to peek. It's that there's no account to identify you, the relay only ever holds sealed ciphertext, and that ciphertext is purged after it's delivered. A no-logs claim is only as strong as what the system is able to know — and this design is built to know as little as possible.

The short version

"No-logs" should mean more than "we don't save your messages." A meaningful version covers metadata, IP, identity, and retention — and the honest way to earn the label is to collect less, not to promise more. When you evaluate any messenger, ask what the server is required to know, and for how long.

Graphite is free and in public beta (v1.13.25), running on Windows (portable .exe with bundled Tor), Android (sideloaded APK that works on GrapheneOS and de-Googled phones with no Google Play Services), and the web. No phone number, no email, no logs. Try it at graphite.chat.