Igloo雪屋 · XUEWU
A room that exists only right now.
Runs on your own computer · Direct over Tor · End-to-end encrypted
Close it, and it melts away like snow.
What it is
Igloo (雪屋) is a private chat room that runs on your own and your friends’ own computers: no platform, no account, no "official server". You open a room on your machine and hide it behind a Tor onion service; a friend gets in with the invite card you send them privately plus "the password of this moment". Everything is end-to-end encrypted — even the host’s computer only relays ciphertext. Close the app, and the room melts away with the conversation.
The room runs on the host’s computer
No third-party server, no platform backend. The room exists while the host has the app open; close it and it melts away like snow.
Direct over a Tor onion service
You and your friends never see each other’s IPs; a network observer only sees "someone is using Tor". People on different networks (campus, hotspot, home) can all join.
End-to-end encrypted
Only the people in the room can read messages. The host’s computer just relays ciphertext — it cannot read anyone else’s content either.
Two doors: card + 5-minute password
Getting in takes the privately sent card plus the password shown on the host’s screen right now (it rotates every 5 minutes). Kick = key rotation: the old card dies instantly.
Burn after use
Messages live only in memory and never touch disk; they disappear after 15 minutes; closing the room wipes everyone’s content together — there is no such thing as a "chat history" here.
Anti-leak kit
If screen-recording software is detected, the chat area instantly turns into a snow screen; every surface carries the viewer’s own watermark; if someone copies content, the whole room is told.
Honest limits
These "can’t do"s are all real test results — we put them on the front page because they are this app’s character.
What it blocks
- Carriers and network-level surveillance (content is end-to-end encrypted)
- Platforms, hosting providers, server backends (none of them exist here)
- IP tracking between members (Tor onion service)
- Strangers scanning for rooms (card + rotating password, two doors)
- Someone casually browsing your computer (a closed Igloo leaves no records)
What it cannot block
- Admin-level or kernel-level monitoring (no software can)
- Phone cameras or external cameras (watermarks only help trace it afterwards)
- A member who deliberately leaks (watermark + copy broadcast are deterrence and traceability, not prevention)
- A device that is already compromised
- "Unmonitorable by any means" — we do not promise that sentence
We only promise what we have actually verified.
Real-machine test results
We publish the acceptance results as they are — including the unflattering one.
| Packaged .dmg, room straight from the app (embedded Tor, two processes) | Create → join → kick → old card rejected: all passed (2026-10-06) |
| Screen-recorder detection (real QuickTime) | Detected in ~1s, snow self-shield triggered; recovered automatically after quit |
| One-tap "close" from the checkup | Flagged "should be handled" → asked → closed a real live process |
| System screenshot (instant action) | Caught in 2 of 3 rounds, missed 1 — reported only when caught, no pretending |
| Copy broadcast | Two-window automated assertion passed (up → broadcast → received, both directions) |
| Message encryption | Zero plaintext in logs, zero card leaks; flipping one character of ciphertext fails the open |
| Residue check after closing | Zero keyword hits across 266 files (messages never touch disk) |
Three steps to start
No sign-up, no server — just two computers with Igloo installed.
Download
macOS 13 or later · Apple Silicon (M-series). All five languages are built in — nothing else to download.
download the .dmg → drag "雪屋" into Applications → on first launch, allow it one of two ways:
- ①right-click the icon → "Open" → "Open" again;
- ②if a double-click was already blocked (more common since macOS 15), go to System Settings → Privacy & Security, find the blocked-app notice and click "Open Anyway". Only once — after that it opens normally.
Why unsigned?
Apple signing and notarization require a $99/year developer account, and this personal project doesn’t buy one — so the page says so plainly. macOS will warn about an "unidentified developer": that is Apple’s default stance toward unpaid developers, not evidence that the build is broken. But it does mean you should verify where it came from (below).
How do I know this download is really ours?
Download only from this page or GitHub Releases, and check the fingerprint (run shasum -a 256 on the file and compare it with the string below). Any "Igloo" from another source is not ours.
Windows / Intel Mac?
Igloo is built on Electron and could work in theory, but so far only the Apple Silicon macOS build is packaged.
8bf04b8f1aa2b6a2979ce89f75b168e8825ef957c02c0b95c1647daa80945e6dFAQ
Why does it take so long ("establishing Tor connection")?
Tor first has to pick circuits and download network descriptions; the first bootstrap usually takes tens of seconds to a few minutes — it is not stuck. The waiting screen shows the real stages as they happen (Tor connection → room connection) and offers a "cancel" after three seconds.
What if I can’t connect?
Two common causes: ① the password expired — it rotates every 5 minutes, so ask for "the one right now"; ② the host closed the room, or the network hiccuped. The UI tells you which one it is; it never pretends to be connecting.
Is it really "unmonitorable"?
We do not promise that sentence — no software can. Igloo does two things: it blocks network-level surveillance (end-to-end encryption + Tor), and it does its best on the device side (a checkup for screen recorders, remote control, login items, with a heads-up when something looks off). If the other side’s monitoring sits at the lowest level of your OS, or they have your admin rights: no software can stop that, and neither can Igloo.
Does it collect my data?
Zero telemetry, zero update checks, zero cloud. Apart from talking to the local Tor process, it makes no network requests. The only disk write is one line of language preference (mode 0600); messages, keys and cards live only in memory and are zeroed on close. You can verify it yourself: after closing Igloo, look at ~/Library/Application Support/雪屋 (just that one line) and any xuewu* files under /tmp (nothing is left). Our own residue checker found zero keyword hits across 266 files.
What can it be used for?
Private communication: friend groups, family, conversations that need to stay private. Please follow the laws where you live.