Your texts never leave the room

When I went hunting for a way to text from my computer after switching to a flip phone, I kept running into the same pattern: the app had an account, or a sync service, or an “our servers” somewhere in the privacy policy. Which meant: my texts — the actual content of my conversations — were passing through someone else’s infrastructure. Not as an accident, but as the product.

That’s not a knock on every service that works this way. Cloud sync solves real problems. But it also means that somewhere between your flip phone and your keyboard, a company holds your messages — for indexing, for backup, for moderation, for whatever their business model requires this year. You accept that when you sign up and generally forget about it.

I didn’t want that. So dumbsms is built differently — not as a policy you have to trust, but as an architecture that makes the alternative impossible.

Where most “text from your computer” tools live

A typical setup looks like this:

1. Your phone syncs messages to a cloud server.
2. The desktop app connects to that server and shows you the messages.
3. When you reply, the text goes up to the server, back down to the phone, and out.

The server is the product. It’s why the app can work when your phone is on the other side of the world — because neither endpoint is actually talking to the other. They’re both talking to the server, which is the real hub.

DIGITS works this way. Google Messages web works this way. Apple Messages in iCloud works this way. The convenience is real. So is the exposure.

dumbsms has no server

Not “a private server” or “your own server” or “encrypted in transit to our server.” There is no server.

When dumbsms connects to your flip phone, it’s a direct link — USB cable or Bluetooth — between the app on your computer and a small companion app on the phone. The desktop app asks for messages. The phone looks in its actual SMS inbox and hands them back. When you send a reply, the app hands it to the phone over the same wire, and the phone sends it using its own cellular connection.

Your texts go: keyboard → desktop app → USB/BLE → phone → cell tower. No middle stop. Nothing stored in a data center with your name on it.

There’s no account to create, which means there’s no account to breach. There’s no sync to configure, which means there’s no sync that can leak. There’s no “sign in again” prompt because there’s no session to expire. It runs on your machine and talks to your phone, and that’s the complete list of parties involved.

The Bluetooth path is encrypted end-to-end

The Bluetooth path — which lets you leave the USB cable at home — encrypts every frame with AES-256-GCM, using a key provisioned over USB the first time you pair. The encryption key never touches a server because there’s no server to send it to.

The more important job of that encryption is authentication. Without the key, nothing can talk to the phone over BLE at all — the companion app will simply reject the connection. That means someone within Bluetooth range can’t use your phone as an SMS gateway, can’t read your messages off it, and can’t issue commands to it. The encryption is the lock on the door, not just the tint on the window.

The protocol is documented in the codebase and encryption is mandatory — the app won’t fall back to unencrypted for compatibility or convenience. No cleartext fallback means no “just this once” that becomes a permanent gap.

Open source so you don’t have to take my word for it

Privacy claims from proprietary apps are promises. dumbsms is GPL-licensed open source — every line that handles your messages is readable. You can verify that no telemetry call exists, that no HTTP request is made to any server, that the code does what I say it does. (You can also verify it doesn’t do things I claim it doesn’t, which is the part that matters most.)

If you’re the kind of person who reads grep -r "https://" crates/ before trusting a new tool: go for it. That’s the right instinct and you should find nothing alarming.

What I do collect

One honest caveat: the desktop app caches messages locally on your machine, in plaintext, so you can scroll back through conversations without re-fetching from the phone every time. That cache lives in your computer’s config directory and is only accessible to your user account. It’s the same tradeoff every SMS app makes — messages that exist on your phone have to live somewhere on disk to be searchable. They don’t leave your machine.

The fine print nobody wants to say out loud

All of the above is about what dumbsms does — or more precisely, what it doesn’t do. It says nothing about what happens once your text leaves the phone as an SMS.

SMS and MMS are 1990s protocols. They are not end-to-end encrypted. They were never meant to be. The moment your message leaves your phone and hits the carrier’s network, it travels as plaintext through infrastructure that any sufficiently motivated three-letter agency has had documented access to for decades. Your carrier keeps records. So does the recipient’s carrier. CALEA made sure of it in 1994, and subsequent programs made sure those records were accessible. None of that is dumbsms’s fault — it predates smartphones, let alone flip-phone companions written in Rust — but it would be dishonest to write a privacy post about SMS software without mentioning that SMS is, at its core, a postcard.

dumbsms protects your messages between your keyboard and your phone. What happens after the flip phone hands them to the cell tower is between you, your carrier, and anyone with a national security letter.

If your threat model includes the NSA, use Signal. If your threat model is “I’d rather not have my texts sitting in a startup’s S3 bucket,” dumbsms has you covered.

Why this matters when you’ve already left the cloud

Going to a flip phone was partly a privacy move for me, and mostly an attention one — but those aren’t as separate as they sound. The same infrastructure that serves you the infinite scroll also sits in the path of your text messages when you use the cloud-sync apps. Leaving the smartphone didn’t automatically mean leaving that infrastructure. It just meant I had the chance to notice and choose differently.

dumbsms is what choosing differently looks like for messaging. Small software, direct connection, nothing in the middle. Your conversation stays between you, your phone, and whoever you texted.

No server has ever seen it.