Questions worth asking first

No. Messages are encrypted in transit, and the copy on your phone lives in an encrypted local database — but the copy on our servers is stored in a form we could read.

Nook's hidden rooms protect your conversations from someone who has your unlocked phone. They don't protect them from us, or from anyone who could lawfully compel us. If protection from the operator of the service is what you need, Nook isn't the right tool yet, and we'd rather say that here than let the word "private" imply otherwise.

A second PIN that opens a second Nook. Different chats, folders, friends, groups and notification settings — with no connection to the first one and no way to see one from the other.

The point isn't cryptography, it's deniability: someone scrolling your unlocked phone finds an ordinary messenger with an ordinary chat list, because that's genuinely all the app shows them.

Not from the app, and not from the server. Hidden rooms aren't listed on any screen, no API response mentions them, room names aren't required to be unique (a "name already taken" error would itself be a giveaway), and a wrong PIN just fails — it never signals that you were close to something.

The one thing that could betray a room is a notification arriving at the wrong moment, which is why hidden rooms are silent unless you deliberately turn them on from inside.

Never the text. A notification says something arrived and at most who it's from — the message content is not sent to the phone in the notification at all. You can reduce it further with Message Preview, or silence periods with Quiet Hours.

No ads, no advertising identifiers, no data brokers, and no location collection. We also don't upload your contacts — Nook can't, because it never asks for them.

Two Google services are involved in running the app: Firebase Cloud Messaging delivers notifications, and Crashlytics receives crash reports. The privacy policy lists everything that is stored and for how long.

We can't. PINs are stored only as hashes, so there is nothing on our side to read back. This is deliberate — a PIN we could recover is a PIN anyone who compels us could recover.

What can get you back in is something you set up in advance, inside that room: eight one-time backup codes, or a recovery contact for that room. Either is enough. Set one up the day you make the room.

Because a list of backup codes found on your phone would prove that a hidden room exists, which defeats the room. They're shown once, at the moment they're generated, and stored only as hashes afterwards. Write them down somewhere that isn't the phone.

Lost them? Generate a new set from inside the room — that replaces all eight.

No. Change PIN re-keys the door, not the room. Everything inside stays exactly as it was. The same is true of a recovery reset: it re-keys only the room the contact belongs to, and touches nothing else.

Sign in on another device and use Settings → Device Management to sign the old one out; that session dies immediately. Changing your password signs out every device at once.

The messages themselves live on the server, so they're there when you sign back in.

Because every other method is a way for strangers to find you. There's no username search, no phone-number matching and no "people you may know" — someone can reach you only because you showed them a code, and you decide when it expires and how many times it works.

Not in the same room? Share the code as a link instead; it does the same thing.

Depends which you chose. Delete for me hides it from your copy and leaves the other person's untouched. Delete for everyone — sender only — removes it on both sides, and the stored row is purged within seven days.

A broadcast is many separate messages, so deleting your copy of one never affects the others. There's no unsend-for-everyone across a broadcast.

They can't reach you any more, and if you broadcast something they're skipped silently. What they see is deliberately undramatic: their chat list and history stay as they were, and they discover it when a message doesn't go through — not with an announcement.

Unblocking is one tap in Blocked Users. Removing someone as a friend is a different, softer thing: the existing chat stays where it is.

In one-to-one chats, when it's read. In groups, when it's sent — with many readers, "after it's read" has no single meaning, so the group has one clock set by the owner and everybody sees the same countdown.

Not today. Nook is an iOS and Android app; this site is only the pages you're reading.

Ten: English, ไทย, Tiếng Việt, Español, 中文, 한국어, 日本語, Português, हिन्दी and Bahasa Indonesia. Change it under Settings → Language Settings.

Yes, and the free plan is a real one — one hidden room, five folders per room, groups of 50, five broadcasts a day. Pro raises those limits; the table is on the home page. Pricing isn't set yet.

Nothing is deleted, ever. Limits return to the free ones, and hidden rooms beyond the free allowance become read-only — still there, still readable, just not writable until you renew or remove one.

Nook is still in development and isn't on the App Store or Google Play yet. There's no date to announce, and we'd rather not put one on this page than put a wrong one.

Write to support@nookmsg.com. Material that sexually exploits children is reported to the authorities; the rest of the rules are in the Terms of Service.

Thirteen, or older if the law where you live sets a higher age for agreeing to online services on your own.