New app: BitDM

Henrik 4746requested to merge
Henner4746/fdroiddata:com.bitdm.bitdm into master

Abstract

Please introduce the functions and usage of your app in summary, and also attach some screenshots.

BitDM is an end-to-end encrypted messenger that needs no phone number, no e-mail and no account. Your address is your Curve25519 public key (56 characters), recoverable with 12 words. Messages use the Signal protocol (libsignal: X3DH, Double Ratchet) and go through a relay that only sees padded, encrypted envelopes (also reachable as a Tor onion service), or directly between nearby phones over Bluetooth LE without any internet. Groups, polls, voice messages, attachments (encrypted, also at rest), app lock with panic word, remote wipe by trusted contacts, recovery via trusted contacts (Shamir shares).

Screenshots are in the Fastlane folder of the repo: https://github.com/Henner4746/BitDM/tree/main/secure-messenger/app/fastlane/metadata/android/en-US/images/phoneScreenshots

Please elaborate why you wrote this app. Please highlight the unique functions it provides over other similar apps in F-Droid.

  • No identifier at all besides the key: no phone number (unlike Signal), no separate ID (unlike Threema/Session), no per-contact invite link (unlike SimpleX) — the address is the public key, so no server can hand out a wrong key for it.
  • Works without internet between nearby phones of existing contacts (Bluetooth LE 5, Android 12+), with a switch that never contacts a server at all. Adding a new contact still needs the relay once.
  • Self-hostable relay: one Python file and a systemd unit, AGPL-3.0, same repo.

Honesty note: this is a pre-release by a single developer. There has been no independent security audit yet. An internal review fixed around 80 findings; a code review on 14.10.2026 found no new critical or high issues, and the findings that were still open are fixed in 1.9.1.

Checklist

Policy

  • The app complies with the inclusion criteria.
  • The original app author has been notified — I am the author.
  • The upstream repo contains Fastlane metadata (en-US and de-DE: summary, description, icon, screenshots, changelogs).

Docs

  • Read the guide, the templates, the Build Metadata Reference and the Quick Start Guide.

Merge Request Setup

  • Title follows "New app: app name".
  • Fork is public, branch not protected.
  • No related fdroiddata or RFP issues.
  • One app in this MR.

Metadata

  • metadata/com.bitdm.bitdm.yml, valid YAML, LF line endings (fdroid lint and fdroid rewritemeta clean).
  • No summary/description/images in this MR — they come from upstream Fastlane.
  • Releases are tagged (v*), auto update enabled.
  • Issue tracker: https://github.com/Henner4746/BitDM/issues
  • AuthorName set.
  • Flutter is a git submodule (secure-messenger/app/.flutter), not a srclib.
  • Reproducible build enabled (Binaries + AllowedAPKSigningKeys). The upstream APK is built with fdroid build in registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie (GitHub workflow .github/workflows/android-fdroid.yml) and signed afterwards. Two independent runs of that workflow on the same commit produced a bit-identical unsigned APK.
  • ABI split: not set up. The APK is ~47 MB, arm and arm64 only (no x86_64). Upstream ships one universal APK, and a split would mean three versionCodes per release and a downgrade trap for users switching between the GitHub APK and F-Droid. Happy to switch to VercodeOperation + per-ABI Binaries if you prefer.
  • Only the latest version in the metadata, no disabled builds.
  • commit is the full hash.

Pipeline

  • All pipelines pass. (will check after opening)
  • All warnings in the Reports tab fixed or explained.

Permissions (for review)

INTERNET, ACCESS_NETWORK_STATE (relay) · RECORD_AUDIO (voice messages only) · CAMERA (QR scan only) · BLUETOOTH_SCAN with neverForLocation, BLUETOOTH_ADVERTISE, BLUETOOTH_CONNECT (nearby mode) · NFC (security keys) · USE_BIOMETRIC, USE_FINGERPRINT (app lock) · POST_NOTIFICATIONS, VIBRATE · FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC (background receive, off by default) · WAKE_LOCK (from UnifiedPush). No location, no storage.

Anti-feature

TetheredNet: the relay address can only be changed at build time (--dart-define=BITDM_RELAY). The relay itself is free software in the same repository, hence not NonFreeNet.

Merge request reports