Post-quantum · peer-to-peer · no servers

Your social network,
running on your phone.

Hey is a native Android app for chat & social — where the server is your device. No company in the middle, no account on someone else's database. Just you, your keys, and your people — powered by the ElastOS Internet OS.

How it works ↓ The network is hidden
HeySocial
Powered by ElastOS

The Internet OS that puts the computer back in your hands.

ElastOS is a “World Computer” — a local operating-system layer (the Runtime), a peer-to-peer network (the Carrier), and self-sovereign identity (DID). Apps run as sandboxed capsules; the Runtime decides exactly what each one is allowed to touch. Hey is one of those apps — so everything Hey does inherits ElastOS's guarantees: your data stays yours, and the network stays hidden.

Runtime — the on-device OS layer Carrier — the P2P transport DID — you own your identity Capsules — capability-secured apps WebSpaces — your personal drives
No server · no VPS · no cloud

The whole runtime runs inside the app.

Most apps are thin clients to a company's servers. Hey is the opposite: the ElastOS Runtime and the Carrier are compiled into the app and run in-process, on your phone. Your device is the node — it holds your keys, signs your posts, stores your data, and talks straight to your friends' phones.

📱

Your phone is the node

A mini ElastOS Runtime + Carrier boot inside the app. There is no “Hey server” to go down, get hacked, or read your messages.

🔑

You hold the keys

Your identity is a self-sovereign did:key generated on-device. No email, no phone number, no account — it signs everything you create so others can verify it's you.

🔋

Always-on, no Google

A foreground service keeps the Carrier alive so messages arrive in the background. Notifications are local — no Firebase, no Play Services. Works on GrapheneOS.

HeySocial
Rong
2 min ago
1/3
golden hour on the ridge 🌄
❤ 12💬 4⤓ save
You
now
first post on my own network ✨
♡ like💬 comment
＋
The Feed tab

Share your moments — on your terms.

Post photos and videos to a beautiful frosted feed. Tap a card to swipe a multi-photo gallery, pinch to zoom, like and comment in threads, and save what you love. Every post is signed by you and travels straight to your followers over the Carrier — no algorithm, no ads, no company deciding who sees it.

  • Up to 10 photos per post, with a swipeable gallery & pinch-to-zoom.
  • Photos & video — auto-compressed, delivered peer-to-peer over the Carrier.
  • Likes & threaded comments that sync to your followers cross-device.
  • Tap a + to share a moment — it's pinned on your device, signed, and yours.
Security

Private by cryptography, not by policy.

Every message and photo is sealed end-to-end with post-quantum cryptography before it ever leaves your device. Even when traffic has to pass a relay, the relay only ever sees ciphertext — never your content.

🛡️

Post-quantum E2E

ML-KEM-768 + X25519 hybrid key exchange and ChaCha20-Poly1305 sealing, with a Double Ratchet on direct messages — secure today and against tomorrow's quantum computers.

🔒

Keys never leave the device

Your private keys live in the app's sandboxed storage, which Android encrypts at rest. Nothing is uploaded to a company. An optional fingerprint/StrongBox lock adds another layer.

🧱

Sandboxed by the Runtime

Hey runs as a capability-secured capsule. It can only touch what it's explicitly granted — and other apps on the phone can't read its data.

🪪

One link, full trust

A Hey invite carries your post-quantum keys, so following someone also establishes a private, DM-capable channel — verified by their signature, no server vouching required.

Built-in wallet

One phrase. Multi-chain. Truly private.

Hey carries a self-custodial wallet from a single recovery phrase — Elastos, the major EVM chains, and a real privacy coin. Keys never leave your phone; for BEAM, neither does your node. Hover a coin to learn more.

◈
BEAM — private money
Mimblewimble · confidential by default
★ Privacy coin

Amounts, sender and receiver are hidden — by design, not opt-in. BEAM is built on Mimblewimble + Lelantus: a payment reveals no balance, no address, no graph. It isn't a mixer bolted on — confidentiality is the protocol.

Self-hosted on YOUR phone. Hey runs its own BEAM node on-device and syncs straight from the network over loopback — no third-party node, no explorer, no company ever sees your wallet or your IP. Most “private” wallets still phone home to a server; this one doesn't.

Get tipped privately. Your reusable confidential donation address can be shared right from a post or a chat — supporters send you BEAM and the amount stays between the two of you.

hover to expand →
ELA
Elastos
Mainchain · ELA

The native coin of Elastos — the World Computer Hey is built on. Its mainchain is merged-mined with Bitcoin for security. Send & receive ELA, signed on-device.

hover to expand →
ESC
Elastos Smart Chain
EVM · smart contracts

Elastos's EVM sidechain — ELA-powered smart contracts with full Ethereum tooling. Hold ELA and ERC-20 tokens; send with on-device signing.

hover to expand →
Ξ
Ethereum
ETH · ERC-20

Ethereum mainnet and its tokens, including stablecoins like USDT & USDC. The same recovery phrase derives your address across every EVM chain.

hover to expand →
B
Base
EVM · L2 · ETH

Coinbase's fast, low-fee Ethereum L2. Hold ETH and ERC-20s and transact directly in Hey — handy for cheap, quick on-chain payments.

hover to expand →
🔑
One phrase, self-custodial
BIP-39 · on-device

A single 12-word recovery phrase derives every address — Elastos, EVM and BEAM. Generated and held only on your device: nothing custodial, nothing uploaded.

hover to expand →

Tipping is by identity, not address: follow someone and you can support them — including in private BEAM — straight from a post or a chat. Your keys, your coins, and for BEAM, your node too.

The Internet OS hides the network

Apps speak namespaces, never the internet.

There are no IP addresses, ports, or gateways anywhere in Hey's code. The app addresses everything by name, and the Runtime + Carrier resolve it — quietly handling the network underneath. Four schemes, and nothing else is reachable:

https://
Web2 back-compat. The old internet, when you explicitly need it.
localhost://
Your PC2 ↔ anyone's PC2. Personal data on your WebSpace drives — e.g. Hey stores media at localhost://WebSpaces/hey/<cid>.
elastos://
Decentralized, global data. Content, peers and identity through the providers: elastos://content, elastos://peer, elastos://did.
DNS://
User-defined WebSpaces. Human-friendly names over your drives.

A photo in your feed is addressed as localhost://WebSpaces/hey/<cid> — a handle on your personal drive. The Runtime resolves it to bytes through the content provider. The app never sees an IP, a port, or a gateway. The network is simply… hidden.

The Carrier

Relay introduces. Devices talk direct.

A relay is only a matchmaker: it helps two devices find each other and punch through firewalls. The instant they connect, your devices form a direct peer-to-peer link and data flows device-to-device — the relay steps aside, and it's always end-to-end encrypted so even a relay only ever sees ciphertext. When either side has a real public address — a public IPv4 or a global IPv6 — the relay leaves the path entirely. Nothing hosts it, nothing carries it: your chats, your feed, your metaverse run device-to-device, owned by the people on it.

⇆ relay · introduces You your PC2 Friend their PC2 direct · encrypted

Relay introduces

Finds your friend's device and helps both sides punch through NAT/firewalls. It never stores your account or messages.

Carrier connects

Your two devices form a direct peer-to-peer link. With a real public IPv4 or a global IPv6 on either end — common on home Wi-Fi and many mobile carriers — data goes straight device-to-device: no relay, no server in the path.

End-to-end sealed

Everything is encrypted with ML-KEM-768 + X25519. If a relay must carry it, it only ever sees ciphertext.

Relay use isn't a leak — it only ever moves ciphertext. But the goal is no relay at all, and on a public IP or global IPv6 that's exactly what happens: introductions aside, the relay is gone from the path. The result is a network — feed, chat, world — with no host but its users: a metaverse you own, not one you log into.

Calls & files

Face to face — no server in the middle.

Because your devices talk direct, so does everything they carry. Video and voice flow straight phone-to-phone over the same end-to-end encrypted link — there's no media server, ever, and when a direct path exists (a public IP or global IPv6, common on Wi-Fi and mobile) no relay at all. The picture and the sound never touch a company's cloud.

🌍
Tested live: Germany ⇄ Bangkok
A real video call across two continents — direct device-to-device, no relay and no server in the path. If it holds ~9,000 km apart, it holds anywhere.
~9,000 km apart 0 servers P2P direct
📹

Direct P2P video calls

One-to-one and group. Video and audio ride QUIC streams straight between devices — encrypted end-to-end, carried by no one. Group calls mesh peer-to-peer, with no conferencing server doing the mixing.

📁

Unlimited file transfer

Send any file, any size — photos, full-quality video, archives — straight to your friend's device. Large files stream directly between phones (hash-verified), never staged in a cloud and never throttled by an upload cap.

🛡️

Private by construction

The same post-quantum seal as your chats: ML-KEM-768 + X25519. A relay that ever introduces the two sides sees only ciphertext — never your face, your voice, or your files.

No TURN servers, no media relays, no “fair-use” transfer caps. The call and the files are between you and the person you called — and nobody else is in the room.

Metadata-minimal

The Carrier is dumb — on purpose.

The Carrier is a blind courier. It shunts sealed envelopes between devices and knows nothing about them — not who sent one, not who it's for, not what's inside. There are no DIDs on the wire: a conversation rides an opaque per-pair handle, and the body is post-quantum ciphertext only the two endpoints can open.

✓ What a relay sees

topic: q/3f9a…b1  (opaque)
payload:ciphertext
…and that something moved, and when.

✗ What it can never see

from: did:key:z6Mki…
to:   did:key:z6Mks…
“hey, see you at 8?”
your social graph
🕶️

Sealed sender

The sender's DID is encrypted inside the envelope. A relay can't tell who sent a message — only the recipient learns that, after decrypting.

🎭

No DIDs on the wire

Conversations travel on an opaque 256-bit queue handle the two participants derive privately — not your identity. The Carrier routes a number, never a name.

📦

Ciphertext only

The body is ML-KEM-768 + X25519 sealed. A relay that carries it — or anyone sniffing the wire — sees random bytes and nothing more.

No accounts, no directory, no server logs to subpoena. The most a relay can observe is that some opaque envelope moved, and when — never who, to whom, or what.

In the app

A real messenger & feed — that you actually own.

HeyVerse

A metaverse that runs on your phone — not on a server.

HeyVerse is a living 3D world built right into the app. Invite a friend the way you'd start a call; they walk into your space, and you see each other move, sit, chat and explore in real time. There is no game server anywhere — the world renders on each device and stays in sync peer-to-peer over the same Carrier that carries your messages.

HeyVerse on the phone — your avatar, your world, kept in sync peer-to-peer. No game server. Save a capture to docs/heyverse.png to show the real render in the frame.

Your device is the world

The whole 3D engine ships inside the app and runs locally — no streaming, no cloud render, no logging in to anyone's world server. You own the client and the world both.

Movement is pure peer-to-peer

Position, turning and sitting fan out ~15×/second over an ephemeral gossip namespace — never the chat lane, never disk. With a public IP or global IPv6 it travels device-to-device with nothing in between, so it feels instant.

Live-only, like a visit

A friend is present exactly as long as they're connected. Walk out — or close the app — and you simply leave each other's world. Nothing is stored, nobody is tracked, there is no history to mine.

Your chat stays end-to-end encrypted; movement is ephemeral and unsealed — it's only "where am I standing right now," so it's free to be fast. Same principle as the rest of Hey: the relay just introduces, then steps aside. When both sides are reachable, the world has no host at all — a metaverse owned by the people walking through it, not one you log into. Proven on real hardware: a phone on cellular and a phone on home Wi-Fi, moving together, direct · no relay.

Own your identity. Own your data. Own your network.

Hey is what social media looks like when there's no company in the middle — just your phone, your keys, and the people you choose. Powered by ElastOS.

Powered by ElastOS