Phantom Chat — Marketing Claim Audit

This document maps every technical claim made on veilusdigital.co and inside the iOS app to the specific Swift source file that implements it. Each row reflects what the code actually does — not what marketing copy aspires to. Where a claim is partial or unimplemented, that is noted explicitly. The goal is to make this product easy to fact-check before you write or record about it.

On line numbers: the line references below were accurate when re-verified on the date above. Line numbers drift as code evolves — the file name + symbol/function name is the durable reference. If a line has moved, search for the named symbol in that file. Happy to share the exact commit on request.

If anything here is unclear, contact support@veilusdigital.co and I'll walk through the relevant code or schedule a screen-share.

1. Cryptography

1.1 Post-Quantum Key Exchange (PQXDH / Hybrid Curve25519 + ML-KEM-768)

1.2 Double Ratchet (Signal Protocol)

1.3 AES-256-GCM

1.4 Hardware-Bound Identity (Secure Enclave)

1.5 App Attest (Device Attestation)

2. Privacy & Anonymity

2.1 Anonymous Sign-up

2.2 What the Server Stores

2.2b Message Retention — How Long the Server Keeps Ciphertext

2.3 Push Notifications Carry No Content

2.4 No In-App User Search / No Public Directory

2.5 Invitation Code Discovery (1-on-1)

2.6 Group Invitation Codes (1–500 redemptions per code)

2.7 Metadata the Server Can See (full disclosure)

2.8 Emergency Destruct — exactly what is deleted, and what is recoverable

On the device — SecureDataDestruction.killSwitch():

• Calls the server deleteAccount cloud function.
• Deletes the user's Firebase Storage media (personal / pair / group).
• Keychain wipe — SecItemDelete across all key classes (SecureDataDestruction.swift:158-176). This destroys the encryption keys = crypto-erase.
• 7-pass DoD 5220.22-M overwrite of every file in Documents/Caches/App Support/tmp, then delete (SecureDataDestruction.swift:222-254).
• Clears UserDefaults, Firebase cache, overwrites heap memory.

On the server — deleteAccount (functions_index_consolidated.ts:212-740):

• 1-on-1 pairs: deleted entirely — both halves, all messages, all media.
• Account: user doc, all sub-collections, username index, push tokens, invites, invite codes deleted; then Firebase Auth account deleted (auth.deleteUser).
• Groups: the user is removed (sender key + receipts deleted). The group is fully wiped only if no participants remain; otherwise the group persists and messages the user already sent into it remain (encrypted) for the other members (functions_index_consolidated.ts:438-494).

Recoverability — the honest answer:

• Device: effectively permanent. The Keychain key-destruction is a cryptographic erase — any residual flash data is ciphertext with no key, mathematically unrecoverable. (On iOS flash/APFS a multi-pass overwrite isn't guaranteed to hit the original physical cells; the crypto-erase is the real guarantee, the overwrite is secondary.)
• Server: the app issues a logical delete — data is removed from the live Firestore database and Storage and is gone from the app, queries, and console. We cannot securely overwrite data on Google's infrastructure; after deletion it follows Google Cloud's deletion process. If Point-in-Time Recovery or scheduled backups are enabled on the project, deleted data is restorable by the project owner for that window (PITR ≤ 7 days). Mitigation: the server only ever held encrypted ciphertext, so any residual copy is undecryptable once the device keys are crypto-erased.
• Not in scope of destruct: the recipient's device still holds its own decrypted copy of any messages they received (no messenger can reach into another user's phone), and group messages the user contributed remain with groups that still have members.

Honest one-liner: "Destruct deletes your account, 1-on-1 conversations, and media from our servers and crypto-erases your keys on-device, so any encrypted copy that briefly persists in our provider's backups can never be read. We don't claim to physically overwrite Google's disks — no service can."

3. Emergency Account Reset (Three Independent Paths)

3.1 Shake-to-Wipe

3.2 Lock Screen Widget

3.3 Duress Passcode

3.4 Multi-Pass Secure Deletion (DoD 5220.22-M, 7 passes)

4. UI & State Privacy

4.1 App Switcher Blackout (Privacy Overlay)

4.2 Screenshot Detection

4.3 Disappearing Messages

5. Customisation

5.1 76 Alternate App Icons

6. Coming Soon — Honestly Marked, Not Yet Built

6.1 Tor Relay Routing (Anonymous Tier)

6.2 Offline Bluetooth / P2P Mesh (Anonymous Tier)

7. Things Removed From Marketing After Code Audit

These claims previously appeared on the website or in the in-app onboarding tour and have been removed because the code does not back them:

8. How to Verify This Yourself

The TestFlight beta is open: https://testflight.apple.com/join/rmSrMch9

For a deeper look:

• Open Wireshark or a similar tool on a Wi-Fi network with TestFlight running — confirm only encrypted Firestore + APNs traffic.
• Read the on-device logs — enable Settings → Logs & Support → File Logging, do anything, then tap "Send Logs to Veilus" — the log file shows every cryptographic operation step-by-step.
• Request the cloud functions source — happy to share functions_index_consolidated.ts (~1700 lines) for review of the server-side claims.

For deeper questions: support@veilusdigital.co.

— Curtis Tunaley Founder, Veilus Digital Western Australia