What Is Metadata, and Why Does It Matter?
Metadata is data about your data — the information surrounding a message rather than its contents. For a text or call, metadata includes who you contacted, when, how often, for how long, your approximate location, your device and IP address, and the size of what you sent. Even when the message body is encrypted, this metadata can reveal an enormous amount about your life.
There is a famous line, attributed to a former NSA and CIA director: "We kill people based on metadata." The point is stark: you do not need to read the words of a conversation to understand a relationship, a schedule, a source, or a movement. Patterns alone are often enough.
Content vs. metadata
Content is what you said — the text, photo, or audio. End-to-end encryption protects content extremely well. Metadata is everything about the exchange except the words. Consider a phone call: the content is the conversation; the metadata is that number A called number B, at 2:47 a.m., for 18 minutes, from a particular cell tower. Encryption can hide the first and still leave the second fully exposed.
What metadata can reveal
They know you called a phone-sex line at 2:24 a.m. and spoke for 18 minutes, but not what you talked about. They know you called a suicide-prevention hotline, an HIV testing service, or a divorce lawyer — the call itself tells the story. They know a journalist repeatedly contacted a specific person inside a company right before a leak. Aggregated over time, metadata maps your relationships, routines, health, politics, and beliefs, without a single word of content.
Where metadata comes from
- Identifiers: the phone number or account that ties a conversation to your real identity.
- Social graph: your contact list and who you talk to reveal your network.
- Timing & frequency: when and how often you message paints a behavioral profile.
- Network data: your IP address and connection times expose location and presence.
- Device data: hardware and OS fingerprints help link activity across services.
- Message size & type: even encrypted, the length and cadence of traffic can leak information.
Why metadata matters
Most "encrypted" messengers still collect abundant metadata — many require a phone number, keep server-side contact graphs, and log connection data. For ordinary users this fuels profiling and data breaches. For activists, journalists, whistleblowers, and their sources, metadata can be the difference between safety and exposure, because it identifies who is talking to whom, which is exactly what an adversary wants to know. This is why serious privacy design treats metadata minimization as a first-class goal, not an afterthought.
Common misconceptions
- "If my messages are encrypted, I'm anonymous." Encryption hides content, not the metadata that links you to your contacts.
- "Metadata is harmless because it's not the actual message." Patterns of contact often reveal more, and more reliably, than any single message would.
- "There's nothing I can do about metadata." You can minimize it: avoid identifiers like phone numbers, route traffic through anonymity networks such as Tor, and prefer tools that do not build server-side contact graphs.
How much metadata does a typical messenger keep?
Messengers differ enormously in how much metadata they retain, and the differences are easy to overlook. A service that requires a phone number inherently keeps an identifier tied to your legal identity. Many keep a server-side contact graph so they can tell you which of your contacts also use the app — convenient, but it means the provider holds a map of your social network. Others log connection times and IP addresses for "abuse prevention," building a record of when and from where you were online. At the other end of the spectrum, privacy-first designs avoid phone numbers entirely, keep no readable contact graph on their servers, and route connections so that even the network layer does not reveal who is talking to whom. When comparing apps, the honest question is not just "is the content encrypted?" but "what does this service still know, and could be compelled to reveal, about my relationships and habits?"
How OSHI minimizes metadata
OSHI is built to collect as little metadata as possible. It requires no phone number and no email, so accounts are not tied to a real-world identity. It can route traffic over Tor to hide network location, and it can deliver messages peer-to-peer over mesh networking with no central server in the path at all. Combined with anonymous, end-to-end encrypted messaging and an open-source, auditable codebase, OSHI aims to protect not just what you say but the fact that you said it.
Related guides & features
End-to-end encryption Anonymous messaging What is Tor Mesh networking Perfect forward secrecy All OSHI features Compare OSHIFrequently Asked Questions
What is metadata in messaging?
Metadata is the information about a message rather than its contents: who you contacted, when, how often, for how long, your location, IP address, device, and message size.
Why is metadata a privacy risk if my messages are encrypted?
Because encryption hides the content but not the metadata. Knowing who you talk to and when can reveal your relationships, routines, health, and beliefs without anyone reading a single word.
Can metadata identify me?
Yes. Identifiers like a phone number, plus your contact graph and IP address, can tie an otherwise encrypted conversation directly to your real identity.
How can I reduce the metadata I leak?
Use tools that do not require a phone number, route your traffic through anonymity networks like Tor, and avoid services that build server-side contact graphs.
How does OSHI reduce metadata?
OSHI requires no phone number or email, can route traffic over Tor, and can deliver messages peer-to-peer over a mesh network with no central server, minimizing the metadata that exists at all.
Private messaging, by design
OSHI is a free, open-source, Swiss encrypted messenger. No phone number, no ads, no tracking.