AiThaoAn account without personal details
On first launch AiThao creates an account with an opaque identifier, a randomly allocated AiThao Number and a username you can change. A display name, photo and status are optional, and people find you by your number, username or QR code.
Getting back in on a new phone
- Apple or Google sign-in: AiThao receives only a stable account identifier and, if the provider sends one, an email address.
- Email code: the server keeps a hash of the address and a short masked hint, not the address itself.
- Recovery code: a one-time code you save yourself, of which only a hash is stored. Using it signs out every other device and removes its keys, so a lost phone cannot keep using the account.
Sessions
Access tokens live 15 minutes and refresh tokens 30 days. Each refresh token works once: using it issues a new pair, and if an old one is presented again, the whole session is revoked. The server stores only a hash of each refresh token.
Controls in the app
- App lock: require Face ID or your passcode to open AiThao.
- Profile privacy: choose who sees your profile — everyone, your contacts or nobody.
- Online status: “online” and “last seen” are one expiring timestamp, never a log. Hiding it looks exactly like being offline.
- Notification previews: an encrypted message’s preview is encrypted for your phone, so neither Apple nor AiThao’s server can read it. The key for previews is replaced every 30 days.
- Blocking: a blocked contact can no longer reach you.
Questions
What if I lose my phone?
Sign in on the new phone with Apple, Google, your email code or your recovery code. The recovery code also signs the old phone out and removes its keys.
Why does AiThao not ask for my phone number?
It does not need one to run the messenger, and a phone number would identify you. People find you by your AiThao Number, username or QR code instead.