Panic wipe is a first-class security feature designed for hostile environments — border crossings, device seizures, or any situation where you need to destroy all local identity state immediately. It is not buried in settings; it is a gesture available anywhere in the app, at any time, that executes synchronously and leaves no remnants.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/permissionlesstech/bitchat/llms.txt
Use this file to discover all available pages before exploring further.
How to Trigger
Triple-tap the logo anywhere in the app. The wipe executes immediately. There is intentionally no second confirmation step after the gesture itself. In a genuine emergency, an extra tap costs time you may not have. The triple-tap threshold is high enough to prevent accidental activation during normal use.What Gets Destroyed
Panic wipe clears every piece of locally-held identity state and message data synchronously before returning. This includes:Identity Keys
Noise static Curve25519 key, Ed25519 signing key, all Nostr key material, prekeys, group keys (current epoch), and per-geohash Nostr identity seeds stored in the Keychain.
Favorites and Petnames
All favorited contacts, petnames, and the mutual-trust relationships that unlock Nostr delivery and the larger courier mail quota.
Courier Mail
All courier envelopes this device is currently holding on behalf of other users, plus the associated spray-and-wait state and copy budgets.
Sealed Message Outbox
All queued outgoing private messages waiting for acknowledged delivery (up to 24h retention, up to 100 messages per peer), along with the ChaCha20-Poly1305 outbox key in the Keychain.
Public Mesh History
The on-disk gossip archive (up to 6h of public channel messages cached for sync across mesh partitions), public board posts, and deletion tombstones.
Group State
Group names, member rosters, creator identity, key epoch records, and all group-related Keychain material.
Location Bookmarks
Selected geohash channels, bookmarks, teleport flags, bookmark display names, and the per-geohash identity seed stored in the Keychain.
Media
All stored images and voice notes under Application Support — both sent and received — including any in-flight transfers. Media deletion completes synchronously after active work has been invalidated and cancelled.
- Delivery metrics (local counters for courier deposits, handovers, sprays, and outbox flushes — no identities are stored, but the counters themselves are wiped)
- Hand-added Nostr relay addresses
- Active transport connections and in-flight subscriptions
- Bridge deduplication state
- App-switcher snapshot (the screenshot iOS stores when the app goes to the background)
What Happens Next
Immediately after the wipe completes:- New cryptographic identity. Fresh Noise static and Ed25519 key pairs are generated. The new peer ID (first 8 bytes of the SHA-256 fingerprint of the new Noise static key) has no mathematical relationship to the previous one.
- Clean local state. No messages, no favorites, no group memberships, no media.
- Nostr identity rotated. A new Nostr key pair is generated. Relays holding old envelopes addressed to the previous key will keep them, but the app can no longer decrypt them and will not re-subscribe to that key.
- App continues running. Bitchat does not quit; it simply starts fresh, as if installed for the first time.
Recovery After Wipe
Because there are no servers and no account system, there is nothing to restore from:- Message history is gone. Conversation timelines, queued messages, and courier mail cannot be recovered.
- Favorites must be re-added manually. Mutual-trust relationships are established by re-exchanging keys with contacts. This requires each contact to share their current identity, either via QR code or another channel.
- QR verification must be redone. Any nicknames-to-fingerprint bindings created by in-person QR scanning are gone. New verification scans are needed to re-establish identity confidence with contacts.
- Group memberships are gone. Group creators or administrators need to re-invite the new identity.
Keychain items can survive app uninstall on iOS. The iOS Keychain does not always clear when an app is deleted. Bitchat records a non-secret install marker on first run and checks it on every subsequent launch. If the marker is absent but Keychain keys are present — indicating a reinstall after uninstall — Bitchat deletes those surviving keys before using them. This prevents a prior identity from silently persisting across a reinstall that a user intended to be a fresh start.