GoodHuman is a messaging app that won’t send a message unless it can prove a real human, holding a real phone, just did something a bot can’t fake. The score isn’t a wellness number — it’s a live-presence gate. Fail it, and the message doesn’t go.
Private beta. Not on the App Store. I’ve been running it on my own iPhone and iPad for months as the only user.
What it does
Every time you hit send, the phone runs a ceremony: it reads motion, touch, and (when granted) microphone or camera signal in the second around your tap, and weighs sixteen on-device signals into an H-score. The score has to clear a gate before the message is allowed out. A phone sitting still on a desk, screen-mirrored from a Mac, or driven by a UI-automation script fails the gate — I don’t publish exactly how the gate tells those apart from a real hand, since that’s the part worth protecting.
Messages that clear the gate go out end-to-end encrypted — Curve25519 identity keys, Olm/Double Ratchet sessions, sealed-sender envelopes the server can’t attribute to anyone. Every device carries an Apple App Attest key the keyserver has validated once at enrollment, so the recipient’s phone can verify the sender was a real, attested device — not just that the ciphertext decrypts.
Addresses are permanent — one per human, for life, closer to an SSN than a username. The community can look up who an address belongs to; GoodHuman itself never can, by design. The key material underneath an address rotates (routine device changes, or a guardian-quorum-approved theft recovery), but the address itself never does.
How it’s built
The iOS app is Swift/SwiftUI, using CoreMotion, LocalAuthentication, and CryptoKit, with OLMKit handling the Double Ratchet sessions. A Node/Fastify/Postgres keyserver — deployed on the same infrastructure as my other projects — does exactly one non-relay job: validate each device’s App Attest object once at enrollment. Otherwise it’s deliberately dumb: no logs, sealed sender, hourly purge of anything older than 7 days. It cannot see who’s talking to whom even if compelled to try.
At rest, the local message store is Keychain-encrypted with no backup, decrypted only in memory while the app is open behind a Face ID lock — reading a thread and sending a message use two different gates, since the evidence for “a human is looking at this” and “a human’s hand just authorized this” aren’t the same thing.
Where it stands (September 2026)
iPhone-only for the eventual launch — I dropped the iPad from the roadmap since the TrueDepth/Face ID requirement the security model depends on isn’t consistent across iPad hardware. I’m currently in a self-run testing phase, collecting weeks of real send data on my own devices before tuning anything on guessed numbers. Refinements to the presence gate are ongoing; I’m keeping the specifics off this page until they’re locked down legally.
Why I built it
I kept coming back to a simpler question than the one a wellness app answers: with AI now able to fake a voice, write in anyone’s style, and hold a conversation indefinitely, how does the person on the other end of a message know a human sent it? Passwords and Face ID prove an account belongs to a person. None of them prove that person is there, right now, doing the thing. GoodHuman is my attempt at building the second kind of proof — using nothing but the sensors already in the phone in your hand.