Every app you use is guessing whether the person on the other end is real, is human, and is actually where they say they are. That's not a bug in any single app. It's a missing layer in the internet itself. We built it.
When you match with someone on a dating app, you're trusting their photos are real. When your kid gets a DM, you're trusting the sender is who they claim to be. When your company shares credentials over Slack, you're trusting the device on the other end hasn't been compromised. When you join a group chat, you're trusting the invite link wasn't forwarded to a stranger.
None of these things are verified. They're assumed. The internet has protocols for everything — transporting data, addressing machines, encrypting packets — but there is no protocol that answers the most basic question humans ask before they trust someone:
Are you real? Are you who you say you are? Are you actually here?
Platforms filled this gap by positioning themselves as the trust layer. "Trust us with your data and we'll tell you who's real." Then they monetized the position. That's not a trust layer. That's a surveillance business model wearing a safety badge.
Your "identity" online is whatever you typed into a sign-up form. Name, photo, age, location — all self-reported, all fakeable, all unverified.
GPS coordinates can be spoofed in seconds. "Nearby" on every social app means "claims to be nearby." Nothing binds a person to a place.
You can't tell if you're talking to a real phone or an emulator, a genuine device or a compromised one. Hardware attestation exists but nobody uses it for social identity.
"People near you" is a database query, not a physical measurement. Nobody is actually verifying that anyone is in the same room, building, or city.
Loxation binds four things together that have never been bound before: your device, your identity, your location, and your physical proximity to others. Into one cryptographic object. On your device. Verified by math, not a corporation.
Your device proves it's genuine via Secure Enclave, StrongBox, or TPM. Not a script. Not an emulator. A real phone in a real hand.
Your cryptographic identity changes with your physical location. You at a bar is a different key than you at home. Can't be faked, can't be stolen.
Bluetooth and UWB ranging prove you're physically near the people you're talking to. Relay attacks fail because you can't fake the speed of light.
All encryption keys are derived from your compound identity. Leave the location, and the keys become mathematically underivable. The room closes behind you.
This isn't "trust us." This is: the math doesn't work unless you're a real device, with a real identity, in a real place, near real people. No server has to enforce this. The cryptography enforces itself.
Trust scores propagate through real relationships. Friends-of-friends inherit partial trust. Isolated contacts with no social context get flagged — all computed on-device, reading relationship structure, never message content.
You already know the internet is fake. You've been catfished, or you know someone who has. You've seen the bots, the spam accounts, the "people nearby" who are actually halfway across the world. You've had group chats leaked. You've had DMs screenshotted. You've had conversations mined for ad targeting.
You've been told this is just how it works. That the trade-off for being connected is being surveilled. That if you want privacy you have to give up safety, and if you want safety you have to give up privacy.
That's not a trade-off. That's a failure of engineering.
Loxation is the first platform where the people you talk to are verified as real, verified as nearby, and verified as actually who they say they are — without a corporation sitting in the middle reading everything. Your messages are encrypted with keys that literally cannot exist outside the physical space where the conversation happened. When you leave, the keys stop working. Not because a server revokes them. Because the math breaks.
Every interaction on the current internet requires you to make assumptions. Is this dating profile real? Is this person actually in my city? Is this recruiter legitimate? Is this group chat secure, or has the invite been forwarded to strangers?
You compensate with gut instinct, reverse image searches, and hope. That's not a system. That's coping.
Loxation replaces assumption with verification. When you connect with someone, their device has been hardware-attested, their location has been cryptographically verified, and their proximity to you has been measured by physics — Bluetooth and UWB ranging that can't be spoofed. You know the person you're talking to is real, is here, and is using a genuine device. Not because an app told you so. Because the cryptography requires it.
You know the false choice: either hand your kid a device connected to platforms that read every message on a server, or give them encrypted apps with zero safety tooling and hope for the best. Surveillance or blindness. Neither is acceptable.
Loxation is the third option. On-device intelligence — a local graph database that maps the social topology around your child, tracking relationship patterns without ever reading message content. Who contacts them, how often, through what social connections. When a new contact with zero mutual friends starts messaging with rapidly increasing frequency, the device flags it. Not because it read the messages. Because the shape of the relationship is suspect.
Apple's on-device AI analyzes flagged threads for tone escalation, coercion language, and grooming patterns — running entirely on the Neural Engine, with zero network calls. Sensitive content is blocked before it's shown. You get a trust-score dashboard and approval gates for low-trust contacts. You never see message content. Your child's privacy is real. Their safety is also real.
"Zero trust" has become a marketing term that means "trust our cloud instead of your perimeter." That's not zero trust. That's relocated trust. The actual promise — never trust, always verify — requires verifying that a device is genuine, that a person is who they claim, and that they're where they're supposed to be. No enterprise tool does all three.
Loxation's Trust-State Object binds device attestation, cryptographic identity, physical location, and peer proximity into a single signed object that expires in seconds. Every operation — decrypting a message, joining a group, rotating a key — requires a valid TSO. Stolen credentials don't work from another location. Compromised devices fail attestation. Remote attackers can't fake proximity.
Four independent trust signals, bound into one cryptographic object that can't exist unless all four are simultaneously valid.
Bluetooth Low Energy and Ultra-Wideband measure physical distance between devices. Ephemeral BLE identifiers are cryptographically linked to your MLS identity. You can't relay what physics won't allow.
RFC 9420 group encryption with TreeKEM for groups. Noise Protocol Framework over BLE for 1:1 channels. Forward secrecy, post-compromise security. All keys derived from the compound identity.
Rukuzu — a local graph database — maps relationship topology. Trust scores propagate through friend connections. Isolated strangers get flagged. The graph reads structure, never content.
Apple Secure Enclave, Android StrongBox, or TPM prove the device is genuine and unmodified. Attestation keys are embedded directly into MLS credentials. No emulators. No scripts. Real hardware.
The internet was built with layers for everything. A layer to transport packets. A layer to address machines. A layer to encrypt connections. A layer to render pages.
But there was never a layer for trust.
No protocol-level answer to: is this person real? Are they who they claim? Are they where they say? Can I verify any of this without handing my data to a corporation?
Every pathology of the modern internet traces back to this absence. Catfishing works because identity is a text field. Grooming works because proximity is theater. Phishing works because devices are invisible. Surveillance capitalism works because platforms positioned themselves as the trust layer — and then monetized the position.
Loxation is the trust layer. Not a promise from a company. Not a checkbox on a settings page. A cryptographic proof that the person you're talking to is real, is here, and is using a genuine device. Enforced by math. Verified by physics. Controlled by you.
The internet doesn't need another app. It needs a trust layer. Now it has one.
Available now on iOS and Android.