Changelog

Release notes

What shipped, when. Changes with security consequences are called out explicitly rather than folded into “bug fixes and improvements”, and material revisions to policies or the threat model are logged here too.

This log starts at the public beta. Closed-beta builds are not listed. See the roadmap for what is coming.

Current

Public beta

Keylane leaves closed beta. Android and iOS clients are available to everyone, with no invite required.

Added

  • Public availability on Google Play and the App Store
  • Open registration — no invite code required to create an identity

Documentation

Known limitations

  • No independent security audit has been completed. One is being commissioned.
  • Full client source is not yet published. The Kodium crypto core is public under the Apache License 2.0.
  • Self-hosting is not yet available as a packaged release.
  • No desktop client.

Contact forms replace mailto links

  • Every “email us” link on the site now goes to a contact form — support, feedback, security reports, legal requests, press, brand assets, commercial and self-hosting enquiries, and website corrections. It posts to our own function on this domain and is relayed to us by email; no third-party form service is involved, nothing is stored in a database, and your IP address is written neither to the email nor to our logs. The privacy policy now describes exactly what the form processes.
  • Addresses are still published where a form is the wrong instrument: the data controller card on the policy pages, legal service, and security.txt.

Secure notebook

  • Private notes and credentials can now be kept in the app, under the same on-device encryption as your messages. Notebook entries never leave the device and are covered by the same PIN and history-expiry settings.

Donations are live

  • Voluntary donations are now open via GitHub Sponsors, Ko-fi, or direct SEPA transfer — details on the pricing & funding page. A donation carries no perks and changes nothing about an account: it pays for the public relay, and privacy is not a tier.

Website corrections

  • Revised the pricing & funding page: free-network allowances are now described as generous fair-use rather than “no cap”, with any future change announced here first; noted that calling has shipped and is free on the public relay during the beta; added a commitment to disclose any accepted public-interest grant on that page.
  • Corrected pages that described multi-device linking as already available (support, download, and the Keylane ID guide). A Keylane ID lives on exactly one device today; multi-device remains on the roadmap.
  • Corrected the site footer: “Keylane” is a trademark of Livotov Labs Ltd., not yet a registered one.
  • Corrected the licence stated for the Kodium cryptographic core throughout the site and the terms of service: it is published under the Apache License 2.0, not GPLv3.

Policy update

  • Documented the abuse-reporting path in the terms of service and privacy policy, covering what a report contains and how it is handled given that we cannot read the reported conversation.

Cryptography whitepaper

  • Published the protocol specification: identity, proof-of-possession authentication, PQXDH key exchange, payload encryption, group fan-out, zero-knowledge routing, attachments, and privacy-preserving push.

How we log changes

Security-relevant fixes are described here rather than shipped silently, including those reported by outside researchers, who are credited unless they ask not to be.

Material revisions to the threat model, the privacy policy, or the funding model are logged here as well. A promise that can be quietly edited is not a promise.