Product autopsy · therift.chat
We literally can't read them.
Rift sells a private Discord alternative. The live homepage on therift.chat says direct messages are encrypted end to end, and then: not "we promise not to," we literally can't. The encryption page on the same site lists the messages Rift holds the keys for, the second copy of every DM, and the client Rift serves you that day.
Stamp every claim Meet the LLC
| 0 | Published security audits. The FAQ says audits are "on the list for later." |
|---|---|
| 0 | Member names on the free Wyoming record for Rift Communications LLC. The registered agent is a company at 30 N Gould St. |
| 48 hours | How long a connection fingerprint can still be matched to an IP address, by the privacy policy. |
| 7 days | How long a deleted row can remain in a database backup after the homepage says delete means gone. |
| $100 | Liability cap in the terms if you have not paid them. Paid users are capped at the prior twelve months of fees. |
| 3 | People, by their count. The about page is signed "Founder, primary engineer, husband." No surname. |
What this site is
Rift is a closed-source chat, voice, and "Portals" app from a group that describes itself as three people: a retired software engineer, an audio engineer, and a junior dev. Communities are called Shards. Group chats are called Splinters. Accounts are a username, a password, and a 12-word Rift Key. The operator on the privacy policy and the terms is Rift Communications LLC, a Wyoming limited liability company. The app is 18+, with a confirmation at signup and no ID check. Google Play lists it as PEGI 18.
A lot of the long documents are more careful than the homepage. The encryption writeup is specific about what fails. The privacy policy admits the backup window, the Cloudflare hop, and the fingerprint salt. This page is the product they described in the slogans, set next to those documents, the Play listing, two threads on r/DiscordAlternatives, and the company record. Research current as of 3 October 2026.
Their specials, translated
Private
Homepage: "DMs we can't read." Encryption page, September 2026: 1:1 DM text and 1:1 calls are end to end. Shard channels, Splinters, and file attachments, including attachments inside DMs, are encrypted on Rift's servers with keys Rift holds. Shard voice is plaintext on Rift's media server, because the server mixes the audio. The same page says a malicious Rift that serves modified client code is outside the threat model, and that web and desktop clients load their code from Rift's servers.
Locked
Features page: the same encryption model Signal uses, and if a key leaks later, messages already sent stay locked. Encryption page: every DM also carries a second ciphertext under long-lived identity keys, so forward secrecy does not cover stored history. Lose the Rift Key, or the DM identity key on any device, and every message the server still holds can be decrypted, both directions. The signed prekey stays the same for the life of the account. Keys cannot be rotated without a new account.
Nothing worth stealing
About page: crack Rift open and you walk out with unreadable gibberish that isn't attached to anybody. Features page, further down the same product: a worst-case breach leaks conversations, not identities, because community messages are encrypted at rest and Rift collects "essentially nothing, just a username." Encryption at rest with keys the operator holds is there to stop a stolen disk. It does not stop the operator.
Gone
Homepage: when you delete a message, the row leaves the database. It isn't archived somewhere or hidden behind a flag. Privacy policy: rolling backups cover the previous seven days. If an account less than a day old deletes itself, administrators can still see the username, the Shards it joined, and up to 20 of its latest Shard messages (the first 300 characters of each) for seven days. Reports and their evidence are kept after the account is gone. The terms say CSAM evidence is preserved as the law requires.
Nobody upstairs
"No investors, no board, no growth targets. There is no upstairs." The company on the contract is a 2026 Wyoming LLC. The free record names Registered Agents Inc at 30 N Gould St, Ste R, Sheridan. The Google Play listing prints 30 N Gould St, Pmb R, plus a support email and a phone number. Wyoming does not put LLC members on that public record, so the filing also cannot show that there are no investors. The terms let Rift assign the contract in a merger or sale.
Adults only, like a lounge
The FAQ says being 18+ unlocks the privacy features "regulators don't permit" on platforms that allow minors: no email, no phone, no government ID, and deleted messages that leave the database. The control is a stored date and time of the user confirming they are 18. The privacy policy still has a section on the Children's Online Privacy Protection Act, which is a statute about children under 13. The terms call a false age a material misrepresentation and a reason to ban the account.
Free is the whole product
Plans page: everything in the free list "will never move behind a paywall." The price table under that headline: free is 1080p60 and 50 MB uploads. Rift+ is $7 a month or $70 a year for 1440p60, 300 MB uploads, and a badge. Shard Forge is $25 a month. There is also a $10 Shard tier. Safety tools are described as free. File size, resolution, and shard capacity are metered.
Check the work yourself
FAQ: the code is closed, audits are later, and in the meantime you can sign up, export your data, and read the transparency report, the canary, and the privacy policy. "That is all in writing on our own site, and we would rather not be sued, which is a decent guarantee that it is true." The terms forbid reverse engineering, decompiling, and unofficial clients. The security page offers a safe harbor for good-faith reports and says there is no formal bug bounty.
Exhibit: two sentences, one product
The same encryption model Signal uses. Even if one of your keys leaks later, the messages you already sent stay locked.
That is the features page, under "Signal-style X3DH/Double Ratchet."
The forward secrecy the Double Ratchet gives the live session doesn't extend to stored messages. The second copy sits under long-lived keys. Lose your Rift Key, or the DM identity key on any device, and every message the server still holds can be decrypted, both directions.
That is the encryption page, under "The second copy every message carries." They picked multi-device history over the property the features page is selling. The encryption file has the rest of the list, including the static prekey, trust on first use, and the web client.
The founder
The about page is a first-person story about a childhood dashboard, ten years in "one app," and friends who wanted to help. It ends:
My wife hates the app we left with the burning passion of a thousand suns. She loves Rift more than she loves me. At this point I keep it excellent out of pure self-preservation.
On 22 July 2026, Reddit user u/TheRiftChat told r/DiscordAlternatives the same biography: team of three, retired software engineer, audio engineer, junior dev, AI tooling, some AI-assisted parts, everything reviewed. Closed source. Not self-hostable. They had not advertised because they "didn't want to advertise an unfinished product." The FAQ says they stay pseudonymous for the same reason they don't ask for your email.
The public coordinates of the company are a registered-agent mailbox in Sheridan, Wyoming, support@therift.chat, and the phone number printed on the Google Play listing. No personal name is on the about page, the terms, the DMCA page, or the free company record.
Pages
- Claims: homepage, about, features, FAQ, and plans, each set next to the longer document.
- Encryption: what is actually end to end, the second ciphertext, the client they serve, the terms that forbid you from checking.
- Privacy: IP fingerprints, backups, the day-old account copy, Sentry, Stripe, and the 18+ checkbox.
- Company: Wyoming filing, Gould Street, arbitration, the $100 cap, the canary, the sideload APK.
- Founder: u/TheRiftChat, the AI answers, the July "unfinished product," the August thread.
- Sources: the live pages, the filing, the Play listing, and the threads.