Updated October 2026: This post originally described per-device ECDH key wrapping, pairing codes and QR codes. Shoal’s encryption uses family and conversation keys that Shoal holds — it is encrypted, not end-to-end — and children now join through a family device rather than a QR code. The security page has the current, complete picture.
Most family messaging today happens on platforms that weren’t built for families. They were built for advertisers, or for power users, or for everyone — which usually means for nobody in particular. The result is a strange compromise: kids on apps designed for adults, parents wishing they could see what’s being said, grandparents on a different platform entirely, and a steady leak of metadata to companies that shouldn’t have it.
We started Shoal because we wanted something narrower and stricter. A messaging app that does one thing — let a family talk to itself privately — and does it without the usual trade-offs.
What’s different
Encryption runs through everything. Every message is encrypted on the sending device with AES-256-GCM before it leaves, under a per-conversation key that is wrapped for each family in the conversation. Your display name, profile picture and device names are encrypted too. Your email address is held in plaintext so we can send you sign-in emails, as is the routing information we need to deliver messages — which account IDs are in each conversation, and when. There’s an honest limit to all of this — Shoal holds the keys, which is how family admins can read children’s chats — and we describe it in detail on the privacy page.
Admin oversight is explicit. Family admins can read children’s chats — that’s how the safety features work. This is a normal thing parents want, and we’d rather build it openly than pretend it doesn’t matter.
Kids don’t need email. A family admin adds a child to the family by name, and the child picks themselves on a family device. No inboxes, no usernames to remember, no platform to hand a young child the keys to.
No ads. No tracking. No analytics SDKs. The business model is families paying a small amount for a tool that works. That’s it.
Where we are
Shoal is live for early users. The features pages cover what’s shipping today; the security page goes into the cryptography in detail, and the privacy page is honest about the architectural limits. We’ll write more here as we ship — about the engineering, the threat model, and the surprisingly knotty design questions that come with building software for two-year-olds and seventy-year-olds at the same time.
If you’d like to be part of it, try Shoal or get in touch at hello@shoal.chat.