What Is Metadata, and Why Does It Matter?
Metadata is data about your data — the information surrounding a message rather than its contents. For a text or call, metadata includes who you contacted, when, how often, for how long, your approximate location, your device and IP address, and the size of what you sent. Even when the message body is encrypted, this metadata can reveal an enormous amount about your life.
There is a famous line, attributed to a former NSA and CIA director: "We kill people based on metadata." The point is stark: you do not need to read the words of a conversation to understand a relationship, a schedule, a source, or a movement. Patterns alone are often enough.
Content vs. metadata
Content is what you said — the text, photo, or audio. End-to-end encryption protects content extremely well. Metadata is everything about the exchange except the words. Consider a phone call: the content is the conversation; the metadata is that number A called number B, at 2:47 a.m., for 18 minutes, from a particular cell tower. Encryption can hide the first and still leave the second fully exposed.
What metadata can reveal
They know you called a phone-sex line at 2:24 a.m. and spoke for 18 minutes, but not what you talked about. They know you called a suicide-prevention hotline, an HIV testing service, or a divorce lawyer — the call itself tells the story. They know a journalist repeatedly contacted a specific person inside a company right before a leak. Aggregated over time, metadata maps your relationships, routines, health, politics, and beliefs, without a single word of content.
Where metadata comes from
- Identifiers: the phone number or account that ties a conversation to your real identity.
- Social graph: your contact list and who you talk to reveal your network.
- Timing & frequency: when and how often you message paints a behavioral profile.
- Network data: your IP address and connection times expose location and presence.
- Device data: hardware and OS fingerprints help link activity across services.
- Message size & type: even encrypted, the length and cadence of traffic can leak information.
Why metadata matters
Most "encrypted" messengers still collect abundant metadata — many require a phone number, keep server-side contact graphs, and log connection data. For ordinary users this fuels profiling and data breaches. For activists, journalists, whistleblowers, and their sources, metadata can be the difference between safety and exposure, because it identifies who is talking to whom, which is exactly what an adversary wants to know. This is why serious privacy design treats metadata minimization as a first-class goal, not an afterthought.
Common misconceptions
- "If my messages are encrypted, I'm anonymous." Encryption hides content, not the metadata that links you to your contacts.
- "Metadata is harmless because it's not the actual message." Patterns of contact often reveal more, and more reliably, than any single message would.
- "There's nothing I can do about metadata." You can minimize it: avoid identifiers like phone numbers, route traffic through anonymity networks such as Tor, and prefer tools that do not build server-side contact graphs.
How much metadata does a typical messenger keep?
Messengers differ enormously in how much metadata they retain, and the differences are easy to overlook. A service that requires a phone number inherently keeps an identifier tied to your legal identity. Many keep a server-side contact graph so they can tell you which of your contacts also use the app — convenient, but it means the provider holds a map of your social network. Others log connection times and IP addresses for "abuse prevention," building a record of when and from where you were online. At the other end of the spectrum, privacy-first designs avoid phone numbers entirely, keep no readable contact graph on their servers, and route connections so that even the network layer does not reveal who is talking to whom. When comparing apps, the honest question is not just "is the content encrypted?" but "what does this service still know, and could be compelled to reveal, about my relationships and habits?"
How OSHI minimizes metadata — and what it still sees
OSHI is built to collect as little metadata as possible. It requires no phone number and no email, so accounts are not tied to a real-world identity — your identity is a Curve25519 keypair generated on your device. It can route traffic over Tor to hide network location, and it can deliver messages peer-to-peer over mesh networking with no server in the path at all. The code is open source under the MIT license.
What OSHI's relay can see
A page about metadata is the wrong place to be vague about our own. When a message travels over the internet rather than the mesh, it passes through OSHI's relay, and that relay observes the sender's and recipient's public keys, a timestamp, and the size of the message. It cannot read the message — the content is end-to-end encrypted and the relay never holds a key. But the pattern above is exactly the kind of metadata this page describes, and it exists. "Reduced metadata" is true; "zero metadata" would not be, and you should distrust any messenger that tells you otherwise while still routing your traffic.
The mesh path is the exception, and it is a real one: over Bluetooth LE and Wi-Fi, messages hop directly between devices — roughly 100 m for a direct hop, further only through other people's phones — and no server observes anything, because no server is involved. Where OSHI genuinely differs from a phone-number messenger is that there is no identity-linked account, no server-side contact graph built from your address book, and an offline path that leaves no server-side record at all.
Related guides & features
End-to-end encryption Anonymous messaging What is Tor Mesh networking Perfect forward secrecy All OSHI features Compare OSHIFrequently Asked Questions
What is metadata in messaging?
Metadata is the information about a message rather than its contents: who you contacted, when, how often, for how long, your location, IP address, device, and message size.
Why is metadata a privacy risk if my messages are encrypted?
Because encryption hides the content but not the metadata. Knowing who you talk to and when can reveal your relationships, routines, health, and beliefs without anyone reading a single word.
Can metadata identify me?
Yes. Identifiers like a phone number, plus your contact graph and IP address, can tie an otherwise encrypted conversation directly to your real identity.
How can I reduce the metadata I leak?
Use tools that do not require a phone number, route your traffic through anonymity networks like Tor, and avoid services that build server-side contact graphs.
How does OSHI reduce metadata?
OSHI requires no phone number or email, builds no server-side contact graph, can route traffic over Tor, and can deliver messages peer-to-peer over a mesh network with no server at all. It is not zero metadata: on the internet path, OSHI's relay sees sender and recipient public keys, timestamps, and message sizes. It cannot read the messages.
Private messaging, by design
OSHI is a free, open-source, Swiss encrypted messenger. No phone number, no ads, no tracking.