Who else is reading your messages?
Reading someone's messages leaves no trace. Blue Decoy places canaries (digital tripwires) only you know about, and tells you when somebody else finds them.
Request early access Limited availability
The gap
Everything you can check tells you about access you can already see. Device logs, active sessions, password changes, login alerts. If someone is reading your messages through a channel none of that covers, there is nothing to find, and no way to tell the difference between being watched and being anxious about it.
What we do
Blue Decoy places canaries in your own communications: messages that look like the kind of thing someone reading over your shoulder would want to open. They arrive the way real messages do, from senders that hold up to a second look. You know which ones they are, and you never touch them. Nobody else has a reason to. If one is opened, someone who is not supposed to be there found it.
Zero access
We cannot read your messages, your accounts, or your devices, and we never ask to: there is no app to install and no permission to grant. The only conversation we can see is the one we started. Everything else stays where it is, with you.
Works with what you have
Canaries travel over SMS, Signal, email, and more, so they work on any phone or computer you already use: iPhone, Android, Windows, macOS, or Linux. Nothing to install, nothing to configure, and nothing on your device that shows you are using it.
What you learn
- Where the access came from.
- What network it used.
- What device and browser.
- Whether it was a person or automation.
Together those signals tell you what kind of access this was, which is what makes a detection actionable.
How you are told
Discreet notifications, sent out of band (over a separate channel from the one being watched, so the warning never lands in front of the person who is reading your messages). You choose where we reach you.
Interaction with a canary is never legitimate.
There is nothing to configure and no baseline to learn, no threshold to set and no judgment call to make. Automated access from link-preview services and scanners is identified and separated, so what reaches you is access by something that chose to look.
Who it is for
Journalists protecting sources. Executives and legal teams handling material others want early. Government personnel. And people leaving controlling relationships, where knowing whether your messages are being read changes what is safe to say and when it is safe to go.
Boundaries
Blue Decoy works only on accounts you hold: your own SMS number, Signal, and email. It is not a tool for monitoring another person, and it is not built to be.
For organizations
Blue Decoy Enterprise places canaries across an organization's infrastructure, records everything that touches them, and answers with Pseudoscape, deception that adapts to what the attacker does.
Request early access
Leave an address and we will be in touch when a place opens. Nothing else is asked for.
Your address is used to reply to you and for nothing else. How we handle it, and what to do if you think this device is being watched.
Something you would rather not send in the clear? Encrypt it with our public key and write to security@bluedecoy.com.