Short answer: every phone in the album is a node. Phones find each other on the local network or over the internet, then send photos directly, encrypted. A public relay is used only when two phones cannot reach each other. The trade-off: two phones must be online around the same time for a photo to pass between them.
Server or no server
A cloud album has a company's server in the middle. Photos go up, photos come down, and the company stores them, pays for the storage, and decides how long it keeps them. A peer-to-peer album has no middle: each phone holds copies and hands them to the others.
The benefits follow from the architecture. There is no photo store to breach, no hosting bill that rises with popularity — so the app can be free without a catch — and no company that can be asked to hand over an album, because it does not have one.
How phones find each other
Two phones cannot exchange photos until they know where each other is. Halation uses two ways of finding a peer, neither of which is a server run by the app's makers:
- On the same Wi-Fi: local discovery (mDNS). Phones in the same room find each other with no internet connection needed.
- Over the internet: the BitTorrent Mainline DHT, a large distributed directory that already exists, used to look up where a peer can currently be reached.
The peer-to-peer layer is built on iroh, which establishes direct encrypted connections between devices and addresses data by its hash.
The relay, said plainly
Home routers and mobile networks often block incoming connections, so two phones cannot always connect directly. In those cases the connection falls back to a public relay — a machine somebody else runs that forwards encrypted packets. For roughly 10–30% of connections this is the only route.
| What the relay can do | What it cannot do |
|---|---|
| Forward encrypted traffic between two phones. | Read the photographs, which are encrypted before they leave the phone. |
| See that two devices are talking. | Store the album. |
This is the one third-party machine in the picture, and the reason Halation does not claim that "nothing ever leaves the phone". Photos do leave the phone — to the other members' phones, encrypted.
The trade-off: being online together
With no server to wait at, a photo can only move when the phone that has it and a phone that wants it are reachable at the same time. For a group that opens the app regularly this happens constantly. For two people who open it for five minutes a day at random, the overlap is small. Practically: after an event, open the app once or twice on Wi-Fi, and the more phones hold a photo, the likelier everyone gets it.
Is it encrypted?
Yes. Each photograph is sealed before it is shared, and connections between devices are encrypted. Photographs are encrypted with a key derived from the content itself, so identical bytes seal identically and every key is used once.
Sources
An album that does not live on anybody's server
Free, no account, no ads. iPhone and Android.