Mialuna

Releases

• Nov 4, 2026 0.19.0
  # Mialuna 0.19.0 — Stories delete themselves A story was only ever *hidden* after its 24 hours: the photo or video stayed on the media server, and a relay that ignores the expiration kept serving it. Now Mialuna takes your stories down. ## New - **Your stories are deleted when they expire.** Once a story of yours is over, Mialuna asks **every relay** it knows (the ones you only read from too) and your media servers to delete it, photos and videos included. All the stories that are due go in one request and one signature. - **It is on by default.** *Settings → Delete my stories when they expire* turns it off. It runs 20 seconds after the app starts, every 10 minutes while it runs, and when you come back to the app. Stories are remembered from the moment you publish them, or when this phone sees one published from another, so it works for stories made on any of your phones. - **Amber and remote signers are never asked from a timer.** With a key on the phone it happens by itself; with Amber or a bunker, Settings shows how many stories are waiting and a *Delete now* button, and you approve only then. - **Close-friends stories need no signature.** Their encrypted files are deleted with the one-off upload key kept on your phone, and nothing is sent to your friends (their apps already let go of an expired story).

  More…

  - **If a server or relay fails,** it is asked again later: after 15 minutes, then after longer pauses up to 6 hours, eight tries in all. Relays and servers are retried separately. The files are only asked for once a relay has answered, so that the check that no other post of yours still shows a file always has something to look at. - **PRIVACY.md now describes deleting in full:** what is asked of whom and in what order, who learns what, when it runs, what stays on the phone, and the two small lists that signing out does not remove (the one-off upload keys and the ids of deleted posts). ## Changed - Deleting a post now sends the deletion request to every relay Mialuna knows, those you only read from included (it went to the write relays only). - A file used only by a post that has already expired no longer counts as "in use": a relay that ignores the expiration and still serves an expired story could otherwise keep its file on the server for good. ## Good to know - Deleting is a **request**. A relay may ignore it, and anyone who already saved a copy keeps it. Some media servers say "deleted" while a copy stays in a cache or in another storage behind them (`blossom.band` was seen doing this). - Stories that expired **before** this version are not covered: Mialuna only knows the ones it saw while they were live. - Signing out removes the list of stories waiting to be taken down; what was not deleted by then stays where it is. Details: [PRIVACY.md](https://github.com/Lwb89dev/mialuna/blob/v0.19.0/PRIVACY.md), [docs/nostr-compatibility.md](https://github.com/Lwb89dev/mialuna/blob/v0.19.0/docs/nostr-compatibility.md). ## Install on Android 1. Download `mialuna-0.19.0.apk` from the release assets. 2. Open the APK on a device running **Android 7.0 or later** and allow installation from your browser or file manager if Android asks you to. 3. It is signed with the same key as 0.16.0 to 0.18.0, so it installs over them and keeps your data. Do not uninstall the old version first. The APK includes `arm64-v8a`, `armeabi-v7a` and `x86_64` native libraries. ## Verification Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine; the source was formatted with the real Dart 3.13.7 formatter). The source passed static analysis and all **959 automated tests**, including new ones for the cleanup (what is asked when, with whom's signature, retries, files shared with a live story, close-friends stories, and the Settings switch). This release has **not** been tried against real relays or media servers for the cleanup, and the APK itself has **not** been launched on a device yet. (The deletion of files from a media server was tried live in 0.18.0 with a throw-away key: `blossom.primal.net` and `nostr.download` removed them; `blossom.band` answered "deleted" but kept serving them from another storage.) - APK SHA-256: `6d6d57828aa632d4690d8a7a39c6f610a9cdd3e7e29f82afe4a1bfd6bfe36110` - Signing certificate SHA-256: `5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50` (the same as 0.16.0 to 0.18.0) Full changelog: [CHANGELOG.md](https://github.com/Lwb89dev/mialuna/blob/v0.19.0/CHANGELOG.md)
• Nov 3, 2026 0.17.2
  # Mialuna 0.17.2 — The caption box follows the composer A small fix release. ## Fixes - **The caption box could show text the composer no longer had.** The box only copied the composer's caption into itself when the box was empty. After a caption changed elsewhere (a story shared from the Home rail, a reset after publishing, a draft that was read late), the box kept the old words while the composer was empty, so the next keystroke brought the old text back into the post. The box now always shows what the composer holds, including an empty caption, and never moves the cursor while you type. Three new widget tests cover it; the first one failed before the fix. Everything in 0.17.1 (Reels no longer crash, the notification battery hint, PNG/WebP orientation) is unchanged.

  More…

  ## Install on Android 1. Download `mialuna-0.17.2.apk` from the release assets. 2. Open the APK on a device running **Android 7.0 or later** and allow installation from your browser or file manager if Android asks you to. 3. It is signed with the same key as 0.16.0, 0.17.0 and 0.17.1, so it installs over them and keeps your data. Do not uninstall the old version first. The APK includes `arm64-v8a`, `armeabi-v7a` and `x86_64` native libraries. ## Verification Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine). The source passed static analysis and all **842 automated tests** (the three caption tests and the version check were run again after a final tidy-up of the new test file). The fix was checked in widget tests only; this release APK itself has **not** been launched on a device yet. - APK SHA-256: `e34b6dff20c9149aeee2523e67e179fa862cd6389480f54d2d72583d96ff9dac` - Signing certificate SHA-256: `5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50` (the same as 0.16.0, 0.17.0 and 0.17.1) Full changelog: [CHANGELOG.md](https://github.com/Lwb89dev/mialuna/blob/v0.17.2/CHANGELOG.md)
• Nov 3, 2026 0.17.0
  # Mialuna 0.17.0 — Reliable story receipts, a Home that refreshes A fix-and-polish release. Story views no longer get lost, Home refreshes after your phone has slept and scrolls more smoothly, and you can switch off new-follower notifications if people spam you with follows. ## Highlights - **Pull-to-refresh works after the phone has slept.** Connections to relays often die silently in the background, and the refresh used to be sent into them and bring nothing back. Mialuna now checks a quiet relay before refreshing (and when the app returns to the foreground) and replaces a dead connection at once. - **Smoother scrolling in Home.** Single-picture posts no longer sit in a carousel that competed with vertical scrolling, cards keep their real shape instead of jumping when they scroll back into view, and cards that did not change are no longer rebuilt every time a page of posts arrives. - **Show new followers (Settings).** Off, new followers no longer appear in Notifications, the bell's count or on the phone. Likes, comments and zaps still do. On by default. - **Home follows who you follow.** Replacing one followed account with another used to leave Home (and the story rail) showing the old people.

  More…

  ## Story views and Stories - **No more lost views.** A story view receipt is delivered only once the author's inbox relay accepted it. Otherwise it waits in a small on-device outbox (a story id and the author's key, for at most 24 hours) and is retried with growing pauses. Amber and bunker signers are never prompted in the background. - **Turning receipts off really stops them.** Receipts still waiting are discarded immediately, and a restart does not bring them back. A receipt a relay already accepted cannot be taken back. - **More than 30 stories** to one author are now sent in further messages instead of being cut at 30. - **A story counts as watched only once it was really shown**: not when a picture failed to load, not when you swipe past it, not while it is held, in the background or buffering. - **Watched stories are remembered per account** (they used to be shared by every account on the phone). - **Stories disappear after 24 hours** even when their expiration tag is missing, malformed or far in the future, and while the app stays open. - **Only receipts for your own live stories are counted**, within bounded memory; anybody could previously name any story id. - **A new story starts clean**: no caption or sensitive-content flag from the last one, and a story's caption no longer overwrites your post draft. ## Privacy and robustness - Receipts and queues are bound to the account that watched; an account switch or sign-out cannot have them signed, sent or written for someone else, and it can no longer carry a signer refusal or a "follow list loaded" signal over to the next account. - The private inbox now remembers every wrap it has opened, so a session that only received story receipts or close-friends content does not decrypt them again at the next start (a signer prompt each with Amber). - PRIVACY.md, the Nostr compatibility notes and the in-app setting text describe the new behaviour (English and Italian). The full audit — every finding, the tests that reproduce it and the risks left open — is in [docs/BUGFIX_AUDIT.md](https://github.com/Lwb89dev/mialuna/blob/v0.17.0/docs/BUGFIX_AUDIT.md). ## Install on Android 1. Download `mialuna-0.17.0.apk` from the release assets. 2. Open the APK on a device running **Android 7.0 or later** and allow installation from your browser or file manager if Android asks you to. 3. It is signed with the same key as 0.16.0, so it installs over it and keeps your data. Do not uninstall the old version first. The APK includes `arm64-v8a`, `armeabi-v7a` and `x86_64` native libraries. It is signed with Mialuna's release key. ## Verification Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine). The source passed static analysis and all **805 automated tests**. The APK's signature was verified with `apksigner`; it has **not** yet been launched on a device or emulator, and the Amber/bunker prompts, video playback counting and background/foreground behaviour still need a check on real hardware (see the audit, section F). - APK SHA-256: `833263a73c5cb1b16d85845a033422b8ff4e9c11206694ab1e62f0a8b0932f18` - Signing certificate SHA-256: `5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50` (the same as 0.16.0) Full changelog: [CHANGELOG.md](https://github.com/Lwb89dev/mialuna/blob/v0.17.0/CHANGELOG.md)
• Nov 2, 2026 0.16.0
  # Mialuna 0.16.0 — First release Mialuna is a media-first, decentralized social network powered by Nostr: photos, videos, Reels and Stories, with no company in the middle. This is Mialuna's first published GitHub release. ## Highlights - **Stories, the Instagram way:** write directly on photos and videos with multiple fonts, colors, backgrounds, resizing, rotation and draggable text. Hashtags in captions and story texts are tappable. Choose public or close-friends distribution, see segmented story rings and check who viewed your stories through encrypted receipts. - **Notifications:** unread counters for notifications and private messages in Home, plus local Android system notifications for reactions, comments, zaps, new followers and messages. No push server or Google messaging service is used, and private-message notifications never reveal the message text. - **Private communication:** end-to-end encrypted direct messages, close-friends posts and encrypted media. Encrypted posts have no unencrypted fallback. - **Web of trust:** an optional, on-device spam filter based on your follow network. Message requests from outside the network stay separate from the main inbox.

  More…

  - **A faster Home:** cached posts appear before network loading, follow lists are remembered locally, paging is more reliable and images load ahead of scrolling. - **Profiles and discovery:** NIP-50 people search, NIP-05 addresses, tappable npubs, hashtag search, Following and Discover feeds. - **English and Italian**, light and dark themes, Amber and remote-signer support, Blossom media uploads, Lightning zaps and Nostr Wallet Connect. - **New Mialuna icon**, regenerated Android adaptive icons and iOS icons, plus a new screenshot gallery in the README. ## Privacy and security - Android backups and device-transfer exports are disabled for application data. - Release builds reject cleartext traffic and user-installed certificate authorities. - Private screens are protected from screenshots and recent-screen previews. - Third-party HTTP fetches are restricted to public HTTPS hosts, with redirect, response-size and destination checks. - Relay and signer URLs are validated, oversized relay messages are dropped and zap receipts are checked against signed requests and paid invoices. - Signing out removes account-specific credentials, decrypted content, lists, preferences and caches. ## Fixes This release also includes improved NIP-51 list preservation, Unicode hashtag parsing, protection against concurrent cache writes, startup race fixes, more reliable story and feed paging, and several memory-lifecycle and UI corrections. ## Install on Android 1. Download `mialuna-0.16.0.apk` from the release assets. 2. Open the APK on a device running **Android 7.0 or later** and allow installation from your browser or file manager if Android asks you to. 3. Keep the existing app signature when installing future updates. Do not uninstall a version you want to upgrade in place, because Android may delete its local data. The APK includes `arm64-v8a`, `armeabi-v7a` and `x86_64` native libraries. It is signed with Mialuna's release key. ## Verification Built with Flutter 3.47.9 and Dart 3.13.7. The source passed static analysis and all **686 automated tests**. A release APK was also launched successfully on an Android emulator. - APK SHA-256: `ffa526e64f738f6a7980a5ff3ed5171ceb6d36e4700fe2188c3b95ae5f672593` - Signing certificate SHA-256: `5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50` Full changelog: [CHANGELOG.md](https://github.com/Lwb89dev/mialuna/blob/v0.16.0/CHANGELOG.md)