Developer Builds Decentralized Messenger to Navigate Russian Laws 149-FZ and 152-FZ

A solo developer has created a lightweight messenger called Gram using the $mol framework and HyperBaza technology, designed to operate without collecting personal data or requiring logins. The project specifically examines compliance with Russian Federal Laws 149-FZ and 152-FZ, which regulate instant messaging services and personal data processing. The application supports encrypted peer-to-peer messaging, group chats via registries, and proof-of-work spam protection, while running primarily offline with optional decentralized nodes. Because messages remain encrypted on servers and no user identification occurs, the developer argues that obligations under the laws do not apply to private or home use. Public nodes must be shut down to avoid legal requirements such as phone-based identification and six-month message storage. The full source code is available on GitHub, and the service can be forked for deployment outside Russian jurisdiction.

HabrTranslated from Russian

Read at source

A solo developer has released Gram, a lightweight messenger built entirely alone using the $mol framework and HyperBaza technology. The application enables encrypted messaging without logins, passwords, or any personal data collection and is intended only for home or personal use.

The project serves as a practical case study of Russian Federal Law 149-FZ, which defines an instant messaging service organizer as any entity providing systems for exchanging electronic messages where the sender selects the recipient and no public information is hosted. The developer notes that Gram can function offline, does not guarantee instant delivery, and performs all decryption exclusively on user devices.

Key features include direct dialogs by known ID, creation of invite-only conversations, and public registries that users can join voluntarily. All correspondence is end-to-end encrypted via HyperBaza, while push notifications cannot access message content. A built-in proof-of-work mechanism requires CPU effort for each message to deter spam bots.

Under 152-FZ on personal data, the application collects nothing, so no obligations arise. However, 149-FZ obligations fall on whoever operates public HyperBaza nodes because those nodes handle message relay without decryption. The law explicitly exempts citizens acting for personal, family, or household needs, allowing private use but requiring public nodes to be disabled.

The application cannot technically satisfy several legal requirements: identifying users by phone number, providing decryption keys, or storing readable message content for six months. Source code is published on GitHub, and users outside Russian jurisdiction may run their own nodes on gh-pages or local instances.

Metadata such as sender, recipient, and timestamps remains visible on servers. Due to the decentralized architecture, revocation of access to old messages in group chats is impossible. A poll on the original post showed most respondents believe the public node operator would be considered the organizer of information distribution.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi