Shipped Opt-in In development
Features
One private app, one AI layer across all of it.
KENI is an end-to-end encrypted messenger with an AI layer that runs through every module instead of sitting in its own corner. Below is what that actually means — and, honestly, what's shipped versus still being switched on.
01
The AI layer
AI that acts, not just chats
KENI's AI isn't one more tab — it's a layer that runs across every module. You say what you want in plain language; KENI routes it to the right modules and carries it out, with a quick-access entry you can reach from anywhere in the app.
Plain-language intent
Shipped“Find my headphones,” “remind me tomorrow,” “message Mum” — KENI maps it to an action.
Cross-module orchestration
ShippedOne sentence can touch reminders, contacts, chat and calls together.
Quick access
ShippedA floating entry brings KENI up without leaving what you're doing.
02
Messaging
Private by architecture
1:1 chats are end-to-end encrypted: the server stores ciphertext only and holds no key to read it. Group chats keep a compliance copy by design (see Safety); an end-to-end group mode is in development.
End-to-end encrypted 1:1
ShippedX25519 ECDH key agreement, AES-256-GCM per message, private keys generated on-device.
Optional passphrase backup
Opt-inMove your keys to a new device with a passphrase only you know — zero-knowledge to us.
End-to-end groups
In developmentA Sender Keys group mode is implemented but not yet enabled by default.
03
Social
Moments, Stories & Channels
Share with the people you choose, in a feed that isn't tuned by an ad-ranking engine. Moments are stored as ciphertext plus the minimum metadata needed to deliver them.
Moments & Stories
ShippedPost to your friends list; visibility is yours to set.
Channels
ShippedFollow and broadcast in a simple publish-subscribe model.
No ad ranking
ShippedWhat you see is from people you chose, not an engagement auction.
04
Calls
Voice & video calls
Real-time calls over WebRTC. Media goes peer-to-peer when the network allows; when it can't, it's relayed through our own TURN server — which only ever sees encrypted packets.
Self-hosted TURN
ShippedOur own coturn relay, with a TLS fallback for networks that block UDP.
Short-lived credentials
ShippedEach session uses HMAC time-limited TURN credentials; no permanent passwords.
05
Memory
A memory that's actually yours
KENI builds a long-term sense of your preferences and relationships so it gets more useful over time — and unlike a black-box profile, you can see and delete what it remembers.
Soul memory
ShippedPreferences and facts learned gradually, surfaced gently — never as a pop-up sales pitch.
See & delete
ShippedEvery memory is visible and removable. Nothing is locked away from you.
Relationship-aware
ShippedKENI uses who's who to disambiguate (“message Wei”) instead of guessing.
06
Control
Transparent, controllable AI
AI features are not end-to-end encrypted — a cloud model has to read your prompt to answer it. So we make the trade-off legible and put the controls in your hands.
Every suggestion has a “why”
ShippedYou can see what prompted a suggestion, and turn the whole AI layer off in one tap.
PII scrubbing before egress
ShippedPhone numbers, emails, cards, IDs and IPs are masked before a prompt leaves our server, then restored in the reply.
Privacy modes
ShippedChoose how much context AI may use — down to a local-only mode that keeps prompts on-device.
07
Your model
Bring your own — or run it offline
You're not locked to one vendor's model. Use ours, bring your own key, or download a small model and leave the cloud entirely.
Bring your own key (BYOK)
ShippedConnect your own OpenAI, Anthropic, Gemini or Ollama key and route through it.
On-device model
Opt-inDownload a small GGUF model (e.g. Qwen2.5-0.5B, ~280MB) and run inference locally via llama.cpp.
Offline transcription
Opt-inSwitch speech-to-text to on-device Whisper for fully offline voice.
08
Web
Real-time web search
When you ask a time-sensitive question and turn it on, KENI can look things up on the live web. It's opt-in, disclosed before first use, and your query is PII-scrubbed before it's sent.
Opt-in per query
Opt-inOff by default; you decide when a question should reach the web.
Scrubbed queries
ShippedThe same PII masking applies before your query goes to the search provider.
Want the cryptographic detail, or how we handle safety? The whitepaper and safety page spell out the trade-offs in full.