Signal is an open-source encrypted messenger developed by the Signal Foundation, a US-based 501(c)(3) nonprofit founded by Moxie Marlinspike and Brian Acton. End-to-end encrypted by default using the Signal Protocol (X3DH key agreement plus Double Ratchet). The application collects only the phone number used to register and the date of registration. Not message content, not sender, not recipient, not timing.
What it means in practice
The minimal-data architecture has been verified the only way that matters: in court. Signal has been subpoenaed multiple times in US federal proceedings (Eastern District of Virginia 2016, Central District of California 2020, others undisclosed) and the production response has been the same each time: the phone number, the date of account creation, and the date of last connection. Nothing about who you talk to, what you said, or when. Disappearing messages take this further by removing the content from devices on a timer, so even a seized device with the passcode known produces nothing past the retention window. The trade-off is the phone number requirement: registering Signal links the account to a SIM, which links to a carrier, which links to a billing identity unless the SIM was acquired anonymously.
Who uses it, and against whom
Default secure messenger for journalists negotiating with sources, lawyers communicating with clients under attorney-client privilege, NGO field staff coordinating in hostile environments, and protest organizers facing law enforcement scrutiny. Adversaries range from local police executing routine search warrants on seized devices, to commercial spyware operators deploying Pegasus or Predator-class implants that bypass encryption by capturing the screen pre-render. Signal protects against the former completely. Against the latter, no application running on a compromised endpoint can protect anything; the threat model assumes the endpoint is uncompromised.
What you can change today
Five settings in the next ten minutes. Set a registration lock PIN to prevent SIM-swap takeover. Enable disappearing messages globally to a default of one week, then per-conversation down to one day or one hour for sensitive threads. Turn on relay calls to hide your IP from contacts. Disable preview generation in notifications so lock-screen notifications show “Signal message” not message content. Verify safety numbers in person for the three contacts that matter most, and screenshot them.