About Dew

Dew is a messenger where your friends are dew drops on a blade of grass. Chats, groups, photos, voice and video messages, and voice and video calls are all end-to-end encrypted: only the people in the conversation can read or hear them. Not Dead Center Apps, not our hosting companies, not anyone on your Wi-Fi.

How messages are encrypted

• Your own keys on every device. Each phone or browser you use creates its own elliptic-curve key pair (P-256) with the Web Crypto API. The private key is made non-exportable and never leaves that device; our server only ever sees public keys.
• A new key for every message. Each message is encrypted once with a fresh random AES-256-GCM key. The text is padded to fixed sizes so its length gives little away, and the conversation and sending device are bound into the encryption, so a message can't be replayed into another chat or claimed by another device.
• Locked separately for every device. The message key is then wrapped for each device in the chat (including your own other devices) with a key derived by HKDF-SHA-256 from two elliptic-curve Diffie-Hellman agreements: a brand-new one for every message, and one with the sender's device key, which proves which device sent it.
• Voice and video messages are encrypted on your phone with their own AES-256-GCM key before upload. That key only travels inside the encrypted message, so the stored file is unreadable to us. Files are deleted after 30 days.
• Calls go directly between phones over WebRTC, which encrypts audio and video with DTLS-SRTP. Our server only helps the phones find each other.
• Safety numbers. Each chat's info shows 60 digits made from both people's device keys. Compare them in person: if they match on both phones, nobody is listening in the middle. Dew warns you when a friend adds a new device.

How you sign in

• Google sign-in (OpenID Connect). Dew never sees your Google password. The Android app signs in through your phone's browser and gets the result back with PKCE, so the one-time code is useless to anyone who intercepts it.
• Verified email and phone. Every account verifies an email and a phone number by text code (sent through Twilio). We keep only a scrambled fingerprint of the number and its last four digits; one account per number keeps spam out.
• New devices need your phone. Adding a device to an account that already has one needs the phone check again, so a stolen Google sign-in alone can't read your messages. You can see and remove your devices in Dew's settings.

What we store

Encrypted message envelopes for up to 30 days (so your other devices can catch up), each device's public key and label, who is in which conversation and when messages were sent, your plan, and the safety settings below. We can't read any message, photo or call. Notifications never include what a message says. Your quick-connect favourites, drop colours, icons and background stay on your device. Details: Privacy Policy.

Safety

• Dew is for ages 13 and up. Everyone confirms their date of birth and accepts a safety statement for their age group; teens (13 to 17) get their own statement and need a parent's or guardian's permission.
• Nobody can message you unless you have both added each other. There's no public directory and no "people near you".
• Block or report anyone from their chat info. A report can include the recent messages from your phone if you choose.
• In an emergency, call your local emergency number.

Plans

Dew is free to chat, with an ad bar. "No ads" is a one-time $5.99. Dew+ ($2.99 a month or $25 a year) adds voice and video calls, encrypted voice and video messages, and removes the ads. One account works on the website and the Android app.

Open Dew   Terms of Service · Contact