How Capy works

In most apps, a message goes from you to a company's server, and the server sends it on. Capy has no such server. Your computer connects to the computers of the people in your room, and the app itself makes no web requests at all.

To find each other, devices use a public phone book that nobody owns, called a distributed hash table (DHT). Every room has a topic. Devices that share it look it up, learn each other's addresses and connect. A technique called hole punching gets the connection through home routers and firewalls, and everything on the link is encrypted end to end.

Sometimes a direct link can't be made, for example between two strict mobile networks. Then Capy goes through a blind relay: an always-on computer, run by the Capy team, that passes the encrypted bytes between the two devices. It can't read them, and it is only used when a direct link can't be made.

There is no sign-up, email or password. When you start, Capy makes 24 words. They are your identity. The only copy stays on your device, in a file that only your user account can read, and nothing is sent anywhere.

From the words, Capy derives a Keet identity key. Each time the app runs, it also makes a fresh key for this device, and your identity vouches for it. The device key signs everything you write: messages, your profile and read receipts. Everyone else's app checks those signatures, so nobody can write as you, and no server has to say who you are.

Type the same words on another computer and it finds your other devices by itself, and your rooms come over. Log out and the device forgets the words. Type them again to come back.

Each member's device keeps its own log and adds to it. Autobase merges all the logs into one order that every device agrees on, and a small database on top (HyperDB) turns it into messages, profiles and tasks. There is no central copy: the room is the sum of its members' copies.

You join with an invite, a code you paste or scan as a QR code. Your app sends a request, and the app of a member who is online checks the invite and lets you in. From then on the whole history replicates to you, because every member's device holds a copy.

Any member could be running a modified Capy, so no device trusts a record just because it arrived. Before one counts, each device checks its shape, its size and its signature. A record that fails is skipped the same way everywhere.

A room lives on its members' devices. If all of them are offline, a device coming back has nobody to copy from. A blind peer fills that gap. It is an always-on computer that keeps an encrypted copy of the room's data, files included, and hands it to members when they come back. It never has the key that opens any of it, hence blind.

Capy ships with one, run by the Capy team, and there is nothing to set up: every room is registered with it as it opens, except secure rooms, which never are. A blind peer holds signed blocks, so it can keep them or drop them, but it can't change them.

It also keeps the sealed copies of message keys that let a message open while its author is offline (more under storage).

Everything lives on the members' devices, in a folder the app keeps (a Corestore). Capy has no database anywhere. Photos, videos and files go in cores of their own, encrypted so that a blind peer can't read them.

Each message is sealed with a key of its own. That key is never in the room's log. It sits in a separate file on each device and travels only to members, over the room's encrypted connections.

So a message can open while its author is away, every device publishes a new prekey each day. The author seals each message's key to the other devices' prekeys, and blind peers keep those copies. Only the device that owns a prekey can open its copy.

A secure room is for 2 to 8 people. It has its own folder and its own store, shared with nothing else in the app, and it keeps nothing but the chat: no files, transcripts, minutes, notes or AI.

Its key is made on the owner's device and kept in one file on the device that only your user account can read. It stays there through quits and restarts. The room is erased when the call ends (the default), when its time is up (a day by default, a week at most), when its owner erases it, or when you log out. Erasing purges every core of its store and removes the folder, key file included.

A secure room announces no topic, so it can't be found on the DHT. Members connect straight to each other by key. It is never on your account's list and never given to a blind peer. While one is open, Capy's windows are hidden from screenshots, recordings and screen sharing on macOS and Windows. Linux can't do that, and Capy says so.

Your microphone is encoded as Opus audio and your camera as VP8 video. Both are cut into small packets and sent straight to the others in the call, over the same encrypted connections the room uses, as unordered messages that don't wait for one another.

The call's insights don't come from a server either. On your computer, a voice detector notices when you talk. Your device writes that, signed, into the room: in batches, every 5 seconds and when you leave. Every device then works out talk share and interruptions from the same records, so every screen shows the same numbers, also for someone who joined late.

Nobody hosts a call. Anyone in it can move the round along, mark a decision or edit the notes. The room's owner, or an admin, can mute or remove someone, and each app obeys only them.

Capy's AI is QVAC, Tether's on-device AI. You pick and download each model once in Settings → Notes & AI, and it comes over the peer-to-peer network, not from a website. Until you download one, those features stay off. The models then run in a second process on your computer.

Nobody transcribes you but you. With the transcript on, your computer turns your own voice into text with Whisper or Parakeet and signs each sentence into the room. The text is shared with the room: that is the transcript. The audio is not stored.

When a call ends, the last person to leave writes the minutes with a language model on their own computer, if they have a minutes model. The minutes appear in the room as a card anyone can open.

There is no update server. The Capy team publishes each version to the Pear network, and the app downloads it from other computers that already have it, the way a room replicates. Your app checks when it starts and again when a new version appears.

When the download is ready, a card in the sidebar offers Restart. It never restarts in the middle of a call. A production release needs a quorum of the team's signing keys, so a single key can't push an update on its own.

If a new version fails to start twice in a row, Capy puts the previous app back and doesn't try that version again until a newer one arrives. On a Mac outside Applications, Capy offers to move itself there so it can replace itself later.