Android and browser · Closed alpha
Summoner is an app for small groups who arrange to meet in person. Someone drops a pin with a clock on it, the people in that circle answer, and the invite deletes itself when the clock runs out.
It runs on Android, and there is a browser version covering circles, summons and your account. Private chats are phone-only, because the keys that decrypt them never leave the device that made them.
The buttons work.
Summons
Set what is happening and for how long, anywhere from 15 minutes to 24 hours. Send it to a circle or to one person. Everyone taps going or passes, and the count updates on every phone as it changes.
When the time is up the summon ends by itself and moves into the circle's history along with any photos taken during it. There is nothing to cancel and no dead event left in the chat next week.
On the way
Once you have said you are going, the app can work out when you will arrive and show that to the rest of the circle. The chip counts down on everyone's summon, reads Arrived within a minute either side of the estimate, then disappears.
The estimate is calculated on your own phone. It takes your current position, asks Google Directions how long that journey takes, and publishes one number: the time you should get there. Your coordinates and your route are not sent to us and not stored anywhere. The circle sees a time, never a position on a map.
A scheduled job deletes the arrival time once it has passed or the summon ends. The feature needs location permission and is skipped entirely without it, so choosing not to grant it means no chip appears next to your name rather than a broken one.
What the server holds for this summon: four usernames and three timestamps.
Consensus summons
Instead of picking the spot yourself, propose up to four of them. You set the activity, how long the summon should run once it starts, and a deadline for voting. Everyone in the circle gets one vote.
At the deadline the server decides, not your phone, so the result cannot be pushed around by a modified client. Most votes wins; a tie goes to whichever spot was proposed first. If nobody voted, or a summon is already running in that circle, the proposal is cancelled instead of forced through.
Once it resolves it becomes an ordinary summon, with the same countdown and the same notification everyone else gets. The host can also close the vote early, or call it off entirely.
Seven in the circle, seven votes cast.
Circles
A circle is a group chat with one extra thing: a count of how many summons each person has actually attended. It is visible to everyone in the circle. Nothing is hidden and nothing is ranked against a target, it is just a count.
Circles sort by the most recent message or summon, so whatever is live sits at the top.
Your data
Not everything in Summoner is encrypted the same way, and it is more useful to know which is which than to be told your messages are private. The table is the short version.
The important distinction: one-to-one chats are end-to-end encrypted and circle chats are not. A circle is a group conversation stored on our infrastructure in readable form, the same as any group chat. If you need a conversation nobody but the recipient can read, that is a private chat, and it is phone-only for the same reason: the key lives on the device that generated it.
Keys are made on your phone and wrapped by your fingerprint or face. They are never uploaded. The only copy that ever leaves is the six-part recovery key you write down yourself, which is also the only way to read your history on a new phone. Lose it and that history is gone, including for us.
The privacy policy covers retention periods, the third parties involved and your GDPR rights in full.
Shared links
Every summon has a link. Open it without the app and you get the activity, the map and how many people are going. Open it with the app installed and it goes straight to the summon.
The link dies with the summon. There is no permanent event page left behind.
Discover Off
Discover is the public half of the app: summons open to people outside your circles, and local communities to organise them in. It is finished and it is disabled. A feed of what is happening near you is worthless when nobody near you has the app, so it stays off until there are enough users in one area for it to show anything.
It matters here because of how it handles location when it does open. A public summon is never pinned to its real address. The map draws a circle, and the true point sits somewhere inside it, pushed off centre by a random bearing and 50 to 75 percent of the radius, so it is never at the middle where you would look first.
The size of the circle depends on the area. The server widens it until roughly twenty other places fall inside, which settles around 800 metres in a city and stretches to 5 km somewhere rural, so a lone pub in a village is no easier to pinpoint than one bar on a busy street.
The exact coordinate is held separately and released only once you have joined, and where the host is screening people, only once they have approved you. The offset is calculated on the server rather than in the app, so a modified client cannot publish the true point. Public features are 18 and over.