Radar: Scan & Chat

Talk to a stranger.
Earn everything else.

Anonymous text to begin. Voice, images, and live camera unlock only through sustained, reciprocal conversation — verified by the same deterministic program running on both phones simultaneously. Neither side can fake it.

Android E2E Encrypted No Account No Phone Number 9 Languages

The problem with the category

Omegle did not die of boredom.
It died of its opening move.

A live camera pointed at a stranger selects hard for exhibitionists, drives away everyone looking for actual conversation, makes moderation impossible at any price, and eventually produces the litigation that ended it in November 2023.

The category's failure was architectural. Radar's answer: the scarcity people actually want is not anonymity — it is earned access. The ladder below is how that changes the outcome. Competitors can copy a rung ladder in a sprint. They cannot copy a ladder nobody can forge without building a deterministic verifiable execution engine first.


The Trust Ladder

Five rungs. Real stakes. No shortcuts.

Named in shortwave vernacular — talking to strangers at distance is what shortwave is. Each rung is structurally harder to reach than the one above it.

"A rung grants the right to offer, never the right to deliver." Reaching a rung means you may ask. Every transfer still needs an accept. Without this distinction, progression becomes pressure. With it, no stays an ordinary word.
📡
SKIP
Text messages, reactions
Where every conversation begins — no requirements
no gate
🔊
TRACE
Voice notes, typing presence
12 reciprocal turns 1 session 8 min elapsed
no gate
🖼️
CARRIER
Still image offers
40 reciprocal turns 2 sessions 12 hours elapsed
assent required
📹
DUPLEX
Live camera offers
90 reciprocal turns 3 sessions 48 hours elapsed
assent required
🤝
CLEAR
Permanent contact, Hood group invites
140 reciprocal turns 4 sessions 96 hours elapsed
assent required
01

Alternations, not messages

Two hundred messages sent into silence counts as zero. Spray-and-pray is structurally impossible, not just against the rules.

02

Sessions require dormancy

A session only counts after the conversation has gone quiet and both people came back. You cannot grind it in an afternoon. You have to sleep on it.

03

Friction freezes progression

A report or mute stops the climb with no decay path and no forgiveness timer. The program does not negotiate.


Built-in Games

Games, gated at the appropriate rung.

Games are how strangers become something more. They earn Sparks, advance conversation depth, and unlock Hoods. Every game is gated at the appropriate rung — you have to know someone before you play voice games with them.

1
game shipping now
more in 2-phone test
9
interface languages
the app speaks your language
9
localized gift sets
every gift named in your language

Text Games

  • Hangman — multi-language, 9 locales
  • Alphabet Sprint — 60s, 8 categories
  • Orb Payback — prediction engine
  • Flick or Flirt — truth or dare variant
  • This or That — 93 pairs per language
  • Emoji Charades — 136 entries, 9 locales
  • Trust Teller — lie detection game
  • Number Logic — hot and cold
  • Trivia Blitz — question bank

Voice Games

  • Echo Tongue — pronunciation challenge across languages
  • Melody Echo — pitch matching and musical memory

Image Games

  • Guess the Image — progressive reveal
  • Zoom In — extreme crop challenge

Video Games

  • Ghost Hunter — AR camera game, one hunts while the other shoots
  • Frame It — live framing challenge using the camera

Video games require Duplex rung — 90 reciprocal turns, 3 sessions, 48 hours, mutual consent.

The Economy

  • Sparks — earned through games and conversation
  • Gifts — 100+ items, sent between users
  • Hoods — group rooms unlocked at Clear rung
  • Ledger keepsakes — signed artefacts of Clear conversations

The Mechanism

How the unlock cannot be faked

The progression check does not run on a server you have to trust. It runs on both phones simultaneously, using the same deterministic program. Both results must agree — on the verdict and on every step of the reasoning that produced it.

The relay cannot grant a rung, revoke one, or tell a Skip conversation from a Duplex one. The claimed rung is bound into the AES-GCM associated data of every message. A UI check is advisory. A capability bound into the MAC is structural: edit the claim and the authentication tag fails.
8/8
rung_gate.ual conformance tests passing against our reference VM — including friction-freeze, assent gating, and hash determinism
6 ints
in the progression ledger. It proves a relationship progressed while recording nothing about what was said
P-256
Custom signed-ECDH. Each ephemeral key authenticated by the long-term identity key via ECDSA. HKDF-derived into four AES-256-GCM keys. Not libsignal.
StrongBox
Hardware-backed identity key behind device unlock where a secure element exists. A seized locked device is inert.

Privacy Model

State it precisely or not at all.

Content and metadata are two different questions with two different answers. Not distinguishing them is the most common mistake in this category.

Content — E2E, unconditional

  • Message content is end-to-end encrypted without qualification
  • No server ever sees plaintext — at any rung, for any user pair
  • The relay sees a rotating routing tag and ciphertext. Nothing else
  • This is structural, not a policy promise

Metadata — real, honest, scoped

  • The relay holds a durable SQLite database
  • Confirmed-contact edges keyed by fingerprint
  • Hood membership records
  • 20-minute outbox TTL for queued ciphertext
  • A compelled production yields the social graph — not content, ever
  • Unconfirmed scan matches leave no durable record
The relay logs timestamp, method, host, path, and status only. Client IP, request headers, and TLS metadata are deleted before any log entry is written. Identity-free logging is enforced at the infrastructure level, not as a policy.

Honest Status

What exists versus what is in progress.

Built and verified

  • rung_gate.ual — 8/8 conformance against reference VM
  • ProgressionLedger — dual-device ratification, chain verification
  • SessionCrypto — custom signed-ECDH + AES-256-GCM
  • Hardware identity (StrongBox / TEE) behind device unlock
  • Report and block at every rung, relay never involved
  • Relay service — real, tested against a live process
  • Matching pool, room persistence, conversation history
  • Age assurance at the Duplex boundary
  • Built-in games — 1 shipping, gated at the appropriate rung
  • Interface localized to 9 languages; gift catalogue fully localized
  • Hoods group rooms — design and relay work complete
  • Challenge-authenticated account and contact deletion
  • Voice messages, image sharing
  • Gift economy — 100+ items

In progress

  • On-device media classification — interface exists, implementation pending. Not described as a shipped protection.
  • DVEE Pulse VM Android in-process binding — the UAL VM currently runs via Chaquopy; a native Kotlin reimplementation of the ~15 opcodes is the next step
  • Play Integrity gate for official relay admission — designed, not yet deployed

Commitment

What will always be free.

The ladder itself — every rung from Skip to Clear, with every capability it unlocks — stays free, permanently. That is a public commitment, not a current promotion.

Monetisation happens in adjacent features that improve experience without touching the trust model or the safety story:

Scan filters — language, region, active hours. Improves match quality, touches nothing about capability.

Multiple concurrent scans — hold several conversations climbing at once.

Ledger keepsakes — an exportable signed artefact of a Clear-rung conversation. Cosmetic, meaningful, cryptographically real.

Named handles — reserve one instead of drawing from the pool.

Relay self-hosting — a licensed build for communities that want their own. Sells to the people who most believe in the decentralisation story.

Rung skips are not for sale. A purchasable unlock destroys both the product thesis and the safety statement. "Camera access is earned over 48 hours" stops being true the moment it can be bought.