Data protection for private individuals in Switzerland

Messenger

Session and data protection

Published: 2 November 2026

Session is a messenger for people who want to communicate as anonymously as possible. Since October 2024 it has been looked after by the non-profit Session Technology Foundation, based in Switzerland. Before that, the project was run by a foundation in Australia.

In brief

  • No phone number, no email: when you set it up, the app generates a random Account ID. That is all you need.
  • Decentralised, with onion routing: messages travel over a network of servers run by different operators around the world. Each message is routed via three nodes, so no single node can tell who is writing to whom.
  • End-to-end encrypted in one-to-one and private group chats.
  • Open source and free, with no advertising. According to its privacy policy, Session does not store IP addresses.

What you should bear in mind

  • Funding: in April 2026 the foundation announced that it would shut down the service unless it received at least 1 million US dollars. In June 2026 it reported that it had enough funds to continue; since then, development has been carried on by a small team. Whether Session will survive in the long term remains open.
  • No forward secrecy yet: in 2021 Session dropped “perfect forward secrecy”. If someone obtains an account’s key, they could decrypt messages intercepted earlier. A new protocol version with forward secrecy and post-quantum encryption is in development but has not yet been introduced.
  • Recovery password: your account depends solely on a recovery password. If it is lost, the account is gone – nobody can reset it.
  • Calls are not anonymous: you first have to turn on voice and video calls. When you do, Session points out that your IP address becomes visible to the person you are calling and to a Session server.
  • Communities (open groups) run on separate servers and are intended for large, public groups – not for anything confidential.
  • Because of onion routing, messages sometimes arrive with a slight delay, and you have to exchange contacts via the Account ID or a QR code.

How to set up Session in a privacy-friendly way

The labels may differ slightly depending on the app version.

  1. Save your recovery password: Settings → Recovery Password. Write it down on paper or store it in a password manager.
  2. Turn on screen lock: Settings → Privacy → Lock app.
  3. Calls only when needed: leave “Voice and Video Calls” turned off if you don’t want to reveal your IP address.
  4. Link previews: Settings → Privacy → leave “Send Link Previews” turned off. Otherwise the linked page is fetched to create the preview.
  5. Read receipts and typing indicators: turn them off under Settings → Privacy if you wish.
  6. Disappearing messages: set them for each chat in the chat menu.
  7. Install the app from a trustworthy source: App Store, Google Play, F-Droid or the project’s GitHub.

Further reading

Sources

← Back to overview