How family messages work
Family messages is a free service for short family news, from families outside Iran to their loved ones inside, even when the internet is cut. Messages air sealed by satellite, and only the recipient's phone can open them.
What goes on air
At set times every day the Eagle Eye broadcast switches to family messages for a few minutes: during those minutes all three columns of the screen carry family messages, and the news returns right after. In regular service this happens once a day; during an internet shutdown it happens several times a day, and the time is shown on screen. Messages air in fixed-size turns: each turn holds exactly 146 sealed cards of 336 bytes each. Empty places are filled with cards that cannot be told apart from real ones, and turns air even when there is no mail. So nobody can tell from the broadcast how many real messages a turn holds, who sent them or who they are for. During an internet shutdown the number of turns grows with the amount of mail, so the broadcast shows roughly how much mail there is; we publish that figure monthly as well. The codes are visible on screen; nothing is hidden in the picture.
It is not instant
A message written today starts airing tomorrow, or the day after if it is written after 22:00 Tehran time, and then airs on 3 days in a row: once a day in regular service and several times a day during an internet shutdown. The recipient sees it only when they scan at their turn. Please don't use this service for anything urgent or time-sensitive.
What never goes on air
- Readable text
- Sender or recipient names
- Codes or numbers
- IP addresses
- Photos, files or audio
- Money or payment instructions
- Replies from inside Iran (the service is one-way)
Who can read a message
Only the phone on which the receive code was created. The message is encrypted in the sender's browser and never reaches our server, our hosting provider or the TV channel in readable form. We cannot read, review or remove messages.
What we keep, and for how long
| Data | Where it is held | How long |
|---|---|---|
| Sealed message cards | The family service at our hosting provider | Until 24 hours after the last day they air; then deleted and unreadable |
| A short daily number per recipient (it changes every day and can't be linked to them without their code) | The family service | Until the end of that air day |
| Your network address (your IP address, or for IPv6 only its network part), hashed with a key that changes daily, only to limit message counts | The family service | That day only |
| Daily counters (how many messages per turn) | The family service | That day only |
| List of cancelled codes (only a short fingerprint of each code, no names, no dates) | Public list | Indefinitely |
| Broadcast-ready containers | The broadcast server | 3 days |
| Anti-abuse check data | Our hosting provider, as an independent controller | Under that provider's policy |
| Network logs at our hosting provider | Our hosting provider | Outside our control |
| Your sender identity, saved people and copies | Your browser only | Until you erase them |
Request logging is switched off for this service. There are no accounts, no email and no cookies.
The anti-abuse check and the small puzzle
To stop automated floods we use the anti-abuse check (a CAPTCHA). The anti-abuse check sees your IP address and details of your browser and connection, and our hosting provider processes them under its own policy as an independent controller. We receive only the result of the check. Your browser also spends a few seconds on a small maths puzzle so that mass sending is costly.
Technical summary
Each card is a Noise X message (Noise_X_25519_ChaChaPoly_SHA256) bound to its air day. A receive code is an Ed25519 key plus monthly keys, so someone who one day obtains a phone's keys can open only about the last month of messages. Each turn is signed with the Eagle Eye mail key. Recipients are spread across turns by a number that changes every day.
How to know you're on the real site
- Type oghab.app/family; it takes you to cheshmehoghab.app/family, and the address bar must then show exactly cheshmehoghab.app
- This site never asks for email, a phone number, a password, money, or access to your camera, microphone or location; only a code and your message
- We never contact you first or send you links
- Addresses ending in .top, .online, .site, .live or .press, and look-alikes, are fake
- If someone sends you a link, read the address letter by letter
Rules of use
This service is for family news only. We cannot see or review message text, so the sender is responsible for it. Do not send: money transfer instructions, threats or harassment, scams, political or military content, home addresses or meeting arrangements. Each connection and each recipient has a daily message limit. If a code attracts harassment, its owner can make a new one in the app. Delivery is not guaranteed.
Last month in numbers
Monthly numbers are shown with JavaScript.
Common questions
Can you tell me if it arrived?
No. The broadcast is one-way and we have no way to know; that's on purpose.
Can my relative reply?
Not for now. Any way of replying from inside Iran could put them at risk.
What if someone else gets the code?
A code only lets people send to that person, not read their messages. If their phone was taken, whoever holds the cancel code should cancel it on the cancel page.
Why does the news pause for a few minutes?
So that messages air during the day, not only after midnight. Each broadcast lasts a few minutes, and the screen shows when the news returns.
Why no photos or voice?
Each card is only 336 bytes so the broadcast stays quick and reliable for everyone.
Does it cost anything?
No. It is free and takes no money.