Limitations

BitGab does not claim anonymity or zero metadata. The server sees a random device handle, public keys, room membership while a room exists, message timing and sender inside the 12-hour window, push-routing values, and an optional display name. The strong claim is narrower: the server cannot read message or file content.

While a room exists, the operator can tell that device A and device B are in the same room. It cannot read what they say, and the association disappears when the room is destroyed. During the room's life, the association exists.

A per-room pseudonym does not fix this. The server must address a device to deliver a push, and a push endpoint is stable across rooms. The link reappears one column later. Genuine cross-room unlinkability needs a different delivery and sync architecture, not a patch.

The residual can be removed by operating the server yourself in the Sovereign deployment. Then the operator is your organisation, not a third party.

Some Android OEM builds freeze background processes and third-party push distributors. A wake signal may not arrive. This is a device and OS behaviour, not something the app can guarantee away. The gms build adds opt-in FCM for devices whose OEM freezes other push paths, but no push path is guaranteed on every Android device. Test the fleet you will use.

On some devices, an incoming call rings but the full-screen call UI stays behind the launcher when the phone is unlocked. The notification is still present. This is an open defect, not a claim that calls always surface correctly.

The app and this site are English only. There is no localisation.

Calls are 1:1 audio and video, peer-to-peer over Cloudflare TURN. There are no group calls and no screen share. There is no iOS client. Android 10 or later is required.

There is no SOC 2 report, no ISO 27001 certificate, and no third-party audit. BitGab does not commission one. A customer may commission an assessment of its own deployment at its own expense, with an assessor of its choosing. The source is not published and is not provided to a customer's auditor.

The Android app pins an explicit set of hosts, not a wildcard. The pin set expires on 2027-06-30. After that date Android ignores the pins and falls back to public CA validation. An installed app is not bricked by the expiry, but the pinning guarantee ends unless a new build extends it.

The update check fetches a version manifest. It reveals a version number and an IP address to Cloudflare. It sends nothing else and does not install anything.

Cloudflare sees the source IP address, TLS SNI, timing, and byte counts for any request it proxies. It also hosts the stored metadata and ciphertext. No configuration on this site removes the network-level visibility; only a self-hosted deployment moves the operator role.

Tell us which one, and what deployment you are considering: pilot@bitgab.app. Security reports go to security@bitgab.app. BitGab does not promise response times.