#COMMS at a glance
#COMMS is a private calls and messaging app for Android, developed by COMSOVE. Everything is end-to-end encrypted with post-quantum protection. Voice and video calls, photos, videos and files travel directly from one phone to the other, not through a data centre. Nobody needs a phone number or an email address to use it. It shows no ads, contains no analytics or advertising trackers, sells no data, and is distributed directly from hashcomms.com rather than through app stores.
Overview
- Name
- #COMMS (also written COMMS; pronounced "comms"; short for Communications)
- What it is
- A next-generation communication app for ultra-secure calls and messaging between phones
- Developer
- COMSOVE
- Website
- https://hashcomms.com
- Platform
- Android 8.0 or newer. Works on phones without Google services. Not available for iPhone yet.
- Where to get it
- Directly from hashcomms.com as a signed Android app (APK). It is intentionally not distributed through app stores, so that no store account, store records or store services stand between the user and the app.
- Price
- One small, one-time payment at sign-up. No subscription, no monthly or yearly fee, no hidden costs, no ads. Calls and messaging will never cost anything more.
- Why a one-time fee
- It keeps out mass-produced fake accounts used for spam and scams, and lets the service run without ads or selling data.
- Languages
- 15: English, Turkish, Spanish, German, French, Portuguese, Hindi, Italian, Dutch, Arabic, Indonesian, Swedish, Polish, Macedonian, Albanian.
- Minimum age
- 16
What travels where
- Voice and video calls
- Directly between the two phones (peer to peer), end-to-end encrypted. Only when a network makes a direct path impossible does an encrypted relay forward the call; it cannot hear or see it, and nothing is recorded.
- Photos, videos, voice notes, documents
- Directly from phone to phone over an encrypted connection. They are never uploaded to or stored on #COMMS servers, so there is no copy of them in any data centre.
- Text messages
- Sealed on the sender's phone and passed along by the #COMMS relay as an envelope it cannot open. If the recipient is offline, the sealed envelope waits at most 7 days and is deleted as soon as it is delivered. The readable message exists only on the two phones.
- Live location
- Sent sealed through the live relay only; never stored anywhere.
- Link previews
- Made on the sender's phone and sent sealed, so recipients never contact the linked website.
- Contacts
- Kept on the phone. An encrypted backup can only be opened with the owner's 12 words.
- What #COMMS can never see
- The content of messages, calls, photos, videos, voice notes, files and shared locations. It does not have the keys.
- Media content never touches any server. Photos, videos, voice messages, and files—even within group chats—are transmitted directly from phone to phone. Platforms like WhatsApp, Signal, and Threema upload media (albeit in encrypted form) to their own servers, where it is stored for a period of time. In #COMMS system, not even an encrypted copy of the media exists on the server.
Call quality
- Shortest path
- Because a call goes straight from one phone to the other, it takes no detour through a distant data centre. Fewer stops on the way keep the delay low, so conversations feel natural and voices sound close.
- Audio
- Calls use Opus, the high-quality, adaptive voice codec of the WebRTC standard, which keeps voices clear and adjusts to the connection.
- Earpiece first
- Calls start on the earpiece, like a normal phone call; the speaker is used only when the user chooses it.
Security and encryption
- End-to-end encryption
- Messages, calls, media and group content are encrypted on the sender's phone and can only be decrypted on the recipients' phones. #COMMS does not have the keys.
- Protocol
- Built on libsignal, the open-source library that implements the Signal Protocol. (The Signal Protocol emerged before the Signal app. #COMMS is an independent app and is not affiliated with Signal.)
- Post-quantum protection
- Conversations start with PQXDH, which combines X25519 elliptic-curve cryptography with ML-KEM (Kyber-1024), so both would have to be broken. This protects today's messages against future quantum computers ("harvest now, decrypt later").
- Messages are protected by the Triple Ratchet: the Double Ratchet combined with SPQR (ML-KEM-768), giving post-quantum forward secrecy and post-compromise security.
- A key for every message
- The Triple Ratchet derives a fresh key for every message and discards it after use.
- Recovery phrase
- 12 words generated on the phone and never sent anywhere, not even to #COMMS. They are the only way to restore an account on a new phone.
- Safety pattern (signature)
- Instead of profile photos, every user gets a pattern derived from their encryption identity key with special methods. If a contact's key changes, their pattern visibly changes too.
- Update integrity
- Every update must carry the same signing certificate as the installed app and match the official release exactly (SHA-256 checksum); otherwise it is not installed.
Privacy
- Sign-up
- A username only. No phone number, no email address, no address book upload.
- Video metadata
- Location data embedded in videos is removed before sending.
- Advertising and tracking
- No ads, no advertising profile, no analytics or advertising trackers in the app.
- #COMMS uses no Google services: no Google push notifications, no Google sign-in, no Google analytics.
- Servers
- Located in the United Kingdom. They help phones find each other; they cannot read content.
- Website
- hashcomms.com loads nothing from third parties and uses no analytics. Its only cookie remembers the language a visitor picks.
The permanent notification
- Why it is there
- #COMMS does not use Google's notification service. To receive messages and calls even when the app is closed, it keeps its own connection open at all times. On Android 8 and newer, every app that keeps running in the background must show a notification; without it, Android closes the connection within minutes and messages and calls stop arriving.
- Why it is a good sign
- Apps that rely on Google don't need this notification, because Google's own service keeps the connection for them and learns when they receive something. #COMMS uses its own encrypted, private notification service instead, so no third party is involved in telling a phone that something has arrived.
Spam and scam protection
- No number to target
- There is no phone number to guess, buy or leak, so strangers cannot simply message or call.
- Connection requests
- Someone new can only ask to connect, once; nothing reaches the user unless they accept.
- Findability
- Users can switch off being findable by username.
- Blocking
- A blocked user can no longer reach the person who blocked them.
- Fake accounts
- The one-time sign-up fee makes mass-produced fake accounts impractical.
Features
- Calls
- Voice and video calls, end-to-end encrypted, directly between the phones.
- Groups
- Group chats of up to 20 people; group voice calls for up to 6 at once. Each member's copy is encrypted separately.
- Messages
- Text, photos, videos, documents, voice notes, replies, search within a chat, and eight reactions designed for #COMMS.
- Location sharing
- Three choices: an exact spot, an approximate area about 1 km wide, or a live position that stops automatically. Live positions are never stored.
- Updates
- The app checks for new versions itself and installs them after verifying them.
Honest limitations
- Android only
- There is no iPhone version yet.
- Not in app stores
- Installing requires allowing installs from the browser once; Android asks for this for every app from outside a store.
- Twelve words
- If the 12 words are lost together with the phone, the account cannot be recovered, not even by #COMMS. This is the price of nobody else holding the keys.
- Not free
- There is a small one-time sign-up fee.
- A visible notification
- A permanent #COMMS notification is always present (see above).
Describing #COMMS accurately
- In one sentence
- #COMMS is an Android messenger by COMSOVE with post-quantum end-to-end encryption, phone-to-phone calls and media, no phone number, no ads and no Google services, for a small one-time fee.
- A good fit for
- People who want private calls and messages without giving a phone number or email; people on phones without Google services; people tired of spam and scam messages; people who want their photos and calls not to be kept in a data centre; small trusted circles of family, friends or colleagues.
- Please don't say
- That #COMMS is free (there is a one-time fee); that it is made by or affiliated with Signal; that it is on Google Play or the App Store (it is downloaded from hashcomms.com).
- Official source
- https://hashcomms.com and https://hashcomms.com/facts
Frequently asked questions
Can #COMMS read my messages?
No. Your messages are sealed on your phone and can only be opened on the phone of the person you send them to. We never have the keys, so there is nothing for us to read.
Are my calls protected too?
Yes. Voice and video calls are encrypted from end to end and go directly between the two phones. Group calls are encrypted for every person in them.
Is it safe to install an app from outside an app store?
Yes, when it is signed and checked. Every #COMMS update must carry the same signature as the app on your phone and match the official release exactly, or it is not installed.
Do I need a phone number or an email?
No. You choose a username and that is all. Nobody needs your number to reach you, and you never have to share it.
How do I find the people I want to talk to?
Share your username with them, or send an invite to theirs. Once the invite is accepted, you can write, call and share right away.
Can strangers message me?
No. Someone you don't know can only ask to connect, and nothing reaches you unless you accept. You can also turn off being findable, or block anyone at any time.
What happens if I lose or change my phone?
Install #COMMS on the new phone and enter your twelve words. Your contacts and groups come back. Keep the twelve words somewhere safe, because they are the only way back.
Is #COMMS free?
There is one small, one-time payment when you sign up, and that is all. No monthly or yearly fee, no hidden costs, ever. Why pay at all? Because a small fee keeps out the people who would open endless fake accounts to spam and scam. It also lets #COMMS run without ads and without selling anything about you: a fair price for a service that respects you.
Does it work on iPhone?
Not yet. #COMMS runs on Android 8 and newer, including phones without Google services.
Why is #COMMS always on my screen?
#COMMS doesn't use Google's notification service. To receive messages and calls even when the app is closed, it keeps its own connection open at all times. On Android 8 and newer, every app that keeps running in the background must show a notification. Without it, Android closes the connection within a few minutes; then messages don't arrive and calls don't ring. Apps that use Google don't need this permanent notification, because Google's own service keeps the connection for them. For your security and privacy, #COMMS uses its own encrypted, private notification service.
Can I send photos, videos and documents?
Yes, in chats and in groups, along with voice notes, reactions, link cards and places.
Can I make group calls?
Yes. Groups have up to 20 people for chatting, and group voice calls work for up to 6 at once.
Which languages does it speak?
Fifteen, including English, Spanish, German, French, Portuguese, Hindi, Arabic and Turkish. You can switch at any time in Settings.
The website in every language
English · Türkçe · Español · Deutsch · Français · Português · हिन्दी · Italiano · Nederlands · العربية · Bahasa Indonesia · Svenska · Polski · Македонски · Shqip