Central – Encrypted Chat & Personal Safety

Gallery

About

Central – Encrypted messaging, personal safety and a social world in one app

Central is a production-grade communication and personal-safety platform. It is live on Google Play, has gone through Google’s closed-beta review and runs on European infrastructure. It replaces what would normally be four or five separate products: an end-to-end encrypted messenger with calls, a safety and lone-worker monitoring system, a social network, a B2B guardian dashboard and a multiplayer social game.

This is not a template or a prototype. It is a large codebase that took over a year of engineering, with real cryptography, real-time systems and a backend split into API and worker services.

Codebase at a glance (approximate)

• Kotlin Multiplatform shared core: ~55,000 lines. This covers networking, encryption, repositories, view models and the whole Compose Multiplatform UI, all shared between Android and iOS.
• Android-specific layer: ~22,000 lines. This includes calls, foreground services, geofencing, widgets, the SOS Quick Settings tile, billing and FCM.
• iOS layer: ~13,000 lines (Kotlin/Native + Swift). This includes CallKit/VoIP push, APNs, Keychain, location, SOS video, maps and StoreKit billing. The iOS app reuses the entire shared core.
• Central City engine: ~12,900 lines of HTML5/JavaScript. It is a single isometric game engine shared by the Android app, the iOS app and the web app.
• Backend (FastAPI/Python): [13,000] lines, 30+ routers, Alembic migrations, test suite.
• Web guardian dashboard + iPhone web app: [57,000] lines.
• Localisation: ~2 × 150 KB of string resources, plus downloadable language packs. Six languages: IT, EN, ES, DE, FR, SQ.

Tech stack

• Mobile: Kotlin, Jetpack Compose / Compose Multiplatform, Ktor, Room (versioned non-destructive migrations), Hilt + Koin, WorkManager, Swift for iOS platform services.
• Backend: Python FastAPI, PostgreSQL, Alembic, WebSockets. It runs on Railway (Amsterdam) as two services: an API and a background worker with 7 scheduled loops.
• Real-time: WebRTC audio calls with a TURN relay (Metered), ICE buffering and call-state resync. WebSocket rooms are used for chat, whiteboards, trips and the city.
• Cryptography:X25519/ECDH key agreement and AES-256-GCM.
• Account-bound key backup (PBKDF2, client-side encrypted).
• Envelope encryption for groups, with key rotation on every membership change.
• Encrypted media and encrypted live trip positions. The server never sees destinations or coordinates.
• Services: Scaleway Object Storage (EU), Cloudflare (DNS/IPv6), Mapbox, FCM + APNs, Resend transactional email, Google Play Billing (consumer plans + B2B packs).
• Offline: an embedded SQLite database of emergency points of interest (hospitals, pharmacies, police) that works without a connection.

Feature set

• Messaging:E2E encrypted 1:1 and group chats; voice notes, files, media, location pins.
• Polls, timed/ephemeral messages, scheduled messages delivered server-side, broadcast lists.
• Pin, block, read receipts.
• Shared real-time whiteboards and collaborative maps inside chats.
• Calls: WebRTC audio calls with call log and failure telemetry.
• Personal safety:One-tap SOS from a widget, the Quick Settings tile or the app, with automatic location and a 30-second front-camera video to up to 5 contacts.
• Daily and weekly check-ins with escalation.
• Geofenced safe zones, agreed by both parties.
• “Safe Trip”: live encrypted tracking to a destination, an offline position queue and automatic alerts if the user doesn’t arrive.
• Multi-device support with remote emergency logout.
• Guardian web dashboard:Live map, alerts with acknowledgement, 5–30 day event timeline with CSV/print export, device management, browser chat.
• Company module with operators, supervisors and CSV shift import.
• Social: photo gallery and feed with likes and comments, communities with posts and events, friend system, onboarding tour.
• Central City:An isometric multiplayer town where each user owns a house, earns in-game coins by using the app and decorates rooms with crafted furniture.
• Visits to friends’ cities by bus, a mine, a farming/professions island and minigames.
• Live presence of other players with privacy controls.
• Trust and compliance:Moderation with reports, sanctions and an in-app appeal flow.
• GDPR data export and account deletion.
• Age gate (14+), no advertising SDKs, no data sale.

Business

• Free, Plus and Premium subscriptions via Google Play.
• B2B packs for companies with lone or field workers (cleaning, security, home care), sold per operator, with a 30-day trial.
• Domain getcentral.net, marketing site, Play Store listing and legal documents (privacy, cookies, terms) included.

What the buyer gets:

• full source code (Android, iOS, backend, dashboard, web app);
• the live Play Store app;
• the domain and brand;
• infrastructure handover and documentation.