From a shaky first commit to a complete ecosystem across 6 platforms. Six months of sleepless nights, doubts and small victories. And one promise that never bent: your privacy, above all else.
It all starts from an empty folder and an idea: a messaging app that puts privacy first. The first commit is bare, an Xcode skeleton, a SwiftUI project with more hope than code. "tentativo sistemazione login" reads the second commit, a few minutes later. Nothing works yet, but the journey has begun.
Initial Commit
In 24 hours, push notifications and the WebSocket connection come to life. The backend manages to deliver a message from one device to another, in real time. The profile photo implementation fails on the first attempt. "App compila update profilo fallito" but the next morning it works. Messages appear. For the first time, two devices are talking to each other.
The commit message says it all: "Chat funzionante, profilo funzionante" For the first time chats persist, messages arrive, the profile updates. The foundation is there. From here on, we build.
The timestamps don't lie: commits at 00:52, at 2:13, at 2:30, at 4:53, at 5:07. A burst of late-night commits takes the app from "it works" to "it feels real". Typing indicator, read receipts, deeplinks, badges. At 4:53 comes the first of the ghosts that will haunt the project: "fix chat fantasma e push" At 5:07, exhausted: "risolti" A single word. Then silence until tomorrow.
Five days after the first commit, end-to-end encryption comes to life. From this moment on, every message is born sealed: only two people in the world can read it, the one who writes and the one who receives. No one else. Not even those who spent their nights building Taski. It's not just one feature among many: it's a promise carved into the code, the reason all of this exists. It's the moment an experiment becomes a pact of trust.
The all-caps commit message doesn't lie. Push notifications with encrypted preview, message replies, encrypted messages with the correct timestamp. In just 6 days, Taski has the complete foundations of a secure messenger. "NOTIFICHE FUNZIONANTI" shouts a commit shortly before. The excitement is palpable in the git log.
Still at night, at 1:06. Matching users by phone number. Login via SMS. Taski stops being an experiment and becomes something you could install on your mother's phone.
On December 4th, groups enter the code. The git log tells an epic in four acts: "Gruppi funzionanti" "Gruppi perfettamente funzionanti" "Gruppi quasi perfetti" "GRUPPI PERFETTI" The next day, again: "Logica gruppi perfetta" Five commits, five rising levels of certainty. Or maybe of self-persuasion.
21 commits in 4 days, and doubt seeps into every line: "Per ora BENE" "Sistamazione spunte? Forse!" "chat eliminate sembra funzionare" "Abbinamento chat quasi perfetto" "sistemato forse tutto" It's not certainty: it's hope. The receipts work, then they stop. The ghost chats appear and disappear. The typos in the commits betray the exhaustion: "Sistamato", "nofifiche", "implemenzazione". But the code moves forward.
While the world celebrates, the commits don't stop. Voice message transcription. Link previews. Video. On December 23rd: "Posizionamento messaggi quasi perfetto" On the 27th: "Forse ci siamo, chat sistamata" "Chat sembra ok" "Seems". "Maybe". "Almost". The words of someone who has learned not to trust. On December 26th, Boxing Day: "Sistemato problema freeze UI in chat" No day of rest for the app.
Real-time voice and video calls arrive, built on WebRTC with signaling over WebSocket. Ringback tone, missed-call handling, automatic speaker on video calls. And the voice too, like every written word, travels end-to-end encrypted. "Nascondi tasto videochiamata (da riabilitare)" tells the struggle between ambition and stability. On January 5th: "Chiamate quasi perfette" Again that "almost". And then the real enemy: "Fix call zombie: terminate active call when app goes to background or is killed" The ghost calls, the ones that stay active when the app dies, will haunt the code for weeks.
The error code most feared by iOS developers: 0x8BADF00D ("ate bad food").
It means the system killed the app because the main thread was blocked.
"fix: prevent watchdog crash (0x8BADF00D) from background reloadData"
It will appear three times in Taski's history. Each time, hours of debugging to figure out which operation
was holding the main thread hostage. In April, the backup. In May, the AI search.
The watchdog does not forgive.
The backend becomes a Cloudflare Worker: serverless, distributed on the edge, always close to whoever is writing. It's the first commit of a dedicated repository. From here will come 844 deploys in five months: 844 times someone held their breath while pressing «enter». The heart of Taski begins to beat at a new rhythm.
Versioning for E2EE key rotation. A heartbeat system for calls. Stickers with dedicated storage and TTL. A push queue built on Durable Objects, with confirmation ACK from the client. Anti-abuse rate limiting on SMS. A real-time pub/sub presence system. Every week a new system, built brick by brick, often until dawn.
Sometimes elegance has to step aside. The notifications duplicate, the filters don't hold, and at a certain point you just need the thing to work. "Forza retry push bypassando dedupe" The next day: "Fix push duplicate" And the classic cycle: the fix of the fix. A script that becomes familiar. There will be days when the same piece of backend gets deployed 34 times: 34 small hopes, one after another.
A lost notification is a message that never arrives. So the notification system is rebuilt from the ground up: they travel at the speed of real time, yet none is ever lost. Even when you're offline, they wait, safe, until they reach you. Speed and reliability, without having to choose between the two. It's the beginning of a performance obsession that will define the months ahead: every detail polished is a message that arrives a moment sooner, a user served better.
Durable Objects introduce a brand-new kind of bug: zombie sessions. WebSockets that look open but are already dead. Friends' presence flickering, appearing and vanishing. "Fix forceDelivery for zombie WS sessions" "alarm-based stale sweep for zombie WS detection" "self-heal stale state" The code learns to heal itself: a periodic alarm sweeps the stale connections and cleans up the state. It's not elegant. But at three in the morning, «it works» is the most beautiful word in the world.
A single commit halves the traffic between Durable Objects. The idea: instead of querying each user's presence one at a time, a sharded PresenceRegistry batches the queries together. One call instead of dozens. Costs collapse, latency drops. That line of code, written in silence, no user will ever see. But everyone will feel it.
Durable Objects are powerful, but they cost as long as they stay awake. The Hibernation API puts them to sleep when they're not needed, keeping the WebSocket connections open without consuming resources. ChatRoom and UserHub both move to hibernation. "eliminate ~99.7% DO GB*s" the commit rejoices: an almost moving saving, the fruit of weeks of study. Then, the next day, the price: "Fix presence false-offline after hibernation wake" The awakening is not always gentle. Here, every victory is paid for with a new problem to love.
Every D1 migration is open-heart surgery on the live database, without ever being able to turn it off. Adding a column, creating an index, removing a constraint: tiny gestures that, if wrong, would stop everything. 94 migrations in six months, one every two and a half days. None ever caused a single second of downtime. Behind that perfect silence, a heart that beat hard every single time.
React, Vite and Tailwind. The web client arrives with pairing via QR code, full E2EE and real-time WebSocket. In just 17 days it becomes a complete client: chat, media, calls. "SECURITY: Remove open user search" Caution isn't an afterthought: it's already part of the DNA. Protecting people comes before amazing them.
Stories arrive on Taski: shareable, ephemeral and encrypted. Message reactions with emoji. Likes on stories with avatar push. The app starts to feel complete, no longer a project but a product.
"Hey Siri, manda un messaggio con Taski" and off it goes, end-to-end encrypted, without a single tap. You can verify in person that you're really talking to who you think you are, by scanning a code. And share photos and videos from any app, always protected. Security that stops being a burden and becomes a natural gesture.
In a single day, six commits bring Taski to the Apple Watch: chat, photos, avatars, logo in the toolbar, real-time sync, parallel fetch. The next day, the reckoning: fixes for the UI freeze, decrypt moved off the main thread, locks made asynchronous. The screen is the size of a postage stamp, but the problems are enormous. And yet, the next morning, the messages arrive there too.
Tauri 2 wraps the web client in a native app. macOS and Windows on the same day. Native menu bar, system notifications with encrypted preview, direct reply from the notification, dock badge, auto-update and Handoff with iOS. Four different screens, one single conversation that follows you wherever you go. It will take 85 commits to make it complete, and each one is a piece of life left inside it.
The chat is born in SwiftUI: elegant, declarative, modern. And slow. The keyboard appears and disappears like a ghost, and nothing hurts more than something that almost works: "Usato UIkit per chat da risolvere problema tastiera fantasma" On December 28th 2025, the first attempt to switch to UIKit. Then months of hybrid coexistence: SwiftUI wrapping UIKit calling back into SwiftUI. On March 7th, the crash that breaks all patience: "il datasource rows e il batch update non restano coerenti e UIKit abortisce con SIGABRT" On March 20th, the radical decision: rewrite the entire chat in Objective-C. Not Swift, not SwiftUI. Objective-C. The language of the grandparents. But UICollectionView in ObjC has no bridge overhead, none of SwiftUI's layout quirks, no ghosts. In 4 days, 20 commits take the chat from SwiftUI to ObjC: bubbles, input bar, emoji, replies, thumbnails, video, tappable links, music player, native media viewer. The result: smooth scrolling, zero jank, zero crashes. Sometimes progress means going backwards.
Artificial intelligence enters Taski on tiptoe. A sparkle button in the input bar rewrites a sentence: more formal, more casual, corrected, translated. Never imposed, always offered: a gentle help that stays one step back, within the boundaries of the privacy promised on day one.
In a single day, 10 commits build a complete conversational assistant, living alongside the chats in the list. Photo and PDF attachments, Markdown rendering, PDF document generation, a rate limit of 20 requests per hour, auto-switching between models. "AI memo creation with reminders + Siri App Shortcut" The AI turns a message into a reminder and schedules it for you via Siri. Technology that, for once, seems to take care of you.
An Auditable Key Directory: a registry of public keys protected by a hash-chain, with client-side signatures. If someone tried to secretly swap your key to spy on you, the cryptographic chain would expose them in an instant. It's an obsession: making betrayal impossible, not just unlikely. "Houston, we have a problem!" jokes the space-themed maintenance screen added the next day. Because even in the most serious moments, you need to smile a little.
Until yesterday the AI lived in a room of its own. Now you just type @TaskiAI in the middle of a conversation and it answers right there, in the flow of the chat, in front of everyone. In groups it becomes one more participant: one that can answer, summarize, translate, and never sleeps. The reply appears like magic among the humans' messages, a natural part of the conversation.
An assistant that forgets everything with each message is just an echo. So TaskiAI learns to remember: the facts you share with it stay, conversation after conversation. But with one iron rule — the memory is end-to-end encrypted like everything else. Your memories with the assistant are yours alone: not even the server knows what TaskiAI remembers about you.
April is a month of creative explosion. Spotify integration with PKCE auth. Voice TaskiAI with GPT Realtime for voice conversations. AI anti-abuse system with Llama Guard 3 + Haiku double-check, 7-day auto-suspension. Ban system with real-time broadcast via WebSocket. The app isn't just beautiful — it's also safe.
59 commits in 24 hours. The project's absolute record. A day when everything happens at once: critical bugs, new ideas, fixes upon fixes. The diary of that day is an entire novel. More than Taski Desktop accumulated in its whole life. Sleeping, that day, was a luxury someone chose not to allow themselves.
Three days in a row: 34, 34 and 41 commits across iOS and Worker. AI anti-abuse, ban system, real-time broadcast, push queue dedup, image context for TaskiAI. The Worker reaches 34 deploys in a single day: on average, one every 42 minutes. For three days, sleeping was optional. Passion, sometimes, looks an awful lot like madness.
Two rounds of security audits. Constant-time comparisons on all sensitive data, atomic D1 queries for AI mentions, size checks before every upload. Every endpoint put through the sieve, every input validated. No one asked for it, no one will notice. But this is where trust is truly built: in the details that stay invisible.
TaskiAI Voice gains a web search tool: during a voice conversation it can search the web, announcing each search out loud for transparency. Country mapping by language, a maximum of 3 searches per call. Here, honesty too is a feature: no silent magic, no secrets.
First as a Capacitor wrapper, then the migration to a native Kotlin client. On May 17th and 18th, in long late-night sessions in front of the monitor, it takes shape: WebSocket, E2EE, FCM push, encrypted media. A cruel bug surfaces between iOS and Android: the encrypted pushes simply don't arrive. The solution is two lines in iOS's Notification Service Extension, which stayed invisible for weeks because a cache was covering the path. Two lines, weeks of searching. Ten critical bugs fixed after the latest audit. The sixth platform is alive. Now anyone, on any phone, can message each other safely.
Sometimes the right answer isn't "fix it" but "accept it". In rare conditions, a second notification arrives after 60 seconds: a safety net for when the first one isn't confirmed. Hours of analyzing the problem, with the help of AI. Three previous attempts to fix it had broken more important things. The conclusion: better a notification duplicated one time in a thousand than a notification lost. iOS, almost always, deduplicates it via collapse-id, and the case that remains is extremely rare. The bug is documented and accepted. Not everything needs to be fixed: some things must be understood, and let go. It's one of the hardest lessons to learn, for those who write code, and perhaps not only for them.
A complete offensive audit: trying to break with your own hands what you've built, before someone else does. Six fixes deployed: XSS protection, rate limiting on the admin, elimination of error oracles, country-based SMS blocking, CORS whitelist, locked-down admin panel access. You don't wait for the attack sitting still: you go looking for it. Paranoia, here, is the highest form of respect toward those who entrust you with their most intimate messages.
Apple App Attest integrated: attestation and assertion, trust tiers for devices. Only genuine apps, verified by Apple's Secure Enclave, can talk to the backend. Every bypass header removed. The chain of trust is now whole, from Apple silicon all the way to the server. None of this is visible while using the app. But it's what lets you sleep soundly.
Even the most polished product, sooner or later, needs to explain itself. So Taski Support is born: not a dead FAQ page, but a real assistant, with an AI brain all its own, separate from the rest of the app. When something goes wrong, you open a request and on the other side there's someone who answers — at any hour, in any language. Because an app that puts people first can't leave them alone exactly when they need help.
The most ambitious milestone of all, and it arrives at work session number 400. Until now the AKD verified your key chain; Key Transparency goes further: an append-only log in the style of Certificate Transparency, with a Merkle tree, inclusion proofs and consistency proofs. The server cannot lie to one user without lying to everyone, and lying to everyone leaves a mathematical trace impossible to hide. Clients exchange the head of the log piggybacked in encrypted messages (gossip): if the server showed two different versions of the truth, someone would notice. And the final touch: the log lives on two independent cloud infrastructures, run by different companies, one co-signing the other's state. To forge the truth you would have to corrupt both of them in the same instant. No magic: just mathematics and cryptographic signatures. Live on Worker, web and iOS on the same day. It's the destination of an obsession that began that first December. Trust, from today, is no longer asked for: it's proven.
TaskiAI already knew how to write, summarize, read photos and documents, create reminders. On June 3rd it learns something new: to generate video. You ask, and from an idea something that moves is born, right there in the chat, next to the everyday messages. Another step for an assistant that never stops learning.
Remember the accepted bug? The second notification that occasionally arrived one too many times, the one we'd decided to let live because it seemed impossible to catch. Weeks later, one night in front of the logs, the truth surfaced: it wasn't inevitable at all. It was a race condition: two events competing, and every so often arriving in the wrong order. Once the mechanism was clear, a small in-memory marker was enough to put the race back in order. No lost notification, no extra ghost. What we'd agreed not to understand, in the end we understood. And what you understand, you can solve.
For months the heart of Taski lived at a service address, a borrowed technical subdomain. Then one night someone from outside tries knocking at that very back door — and finds it. No harm done: the real defenses were elsewhere. But the message is clear: it's time to close the last service door. The backend moves entirely under taski.chat, its name, its address. No more back rooms: one house, one door, watched.
AKD and Key Transparency made it impossible to change keys in secret. One thin shadow remained: what if it were the server itself, from the very start, faking your identity? On June 6th that shadow vanishes. Every person now has a single identity key, living only on their own devices, never touching the server or the web. The first time you meet someone, their mark is imprinted; from that moment, if anything doesn't match, you know. AKD, Key Transparency, Identity Key: three locks on the same door. Trust is no longer a promise from the server: it's mathematics in your own hands.
Your account lives on one phone at a time: yours. Web and desktop stop being entrances and become windows that open only if you invite them, by scanning a code from the device in your hand. And when you move to a new phone, your keys aren't born again from scratch nor do they pass through the server: they migrate from one device to the other, from you to you, like a baton handed over in person. So if someone tried to steal your number to get in from a new screen, Taski still asks for the phone in your hand: your SIM alone isn't enough to be you.
Your messages have always been encrypted while they travel. Now they stay encrypted even while they sleep inside your phone. Every chat, every photo, every voice note rests under lock, and that key lives in a hardware vault inside the phone, one that opens only when the device is unlocked and truly yours. So if your phone is stolen while merely locked, or ends up on a forensic lab bench, they don't find your conversations: they find noise. On iPhone and on Android alike.
Before, you searched for a word and Taski found only those who had written exactly that word. Now it understands what you mean: search for 'the group dinner' and it brings back the message where someone suggested meeting up to eat, even if they never called it that. Reading the meaning is a small artificial-intelligence model that runs entirely inside your phone, on its neural chip: no word, no thought, ever leaves the device. Search gets smarter at the very moment it becomes more private.
An offensive audit finds the thinnest crack left: from a secondary device, or from the web, someone could have rewritten your identity key and stepped into your place. From here on, that key is written only from the phone in your hand, your primary device, and from nowhere else. Around it, other defenses tighten: the web now enters with a single-use ticket instead of a pass written into the address, and any attempt to roll a key back to an unsigned version is simply refused. The doors that matter most now have a single key: yours.
When you block someone, you now truly disappear, in both directions. No last seen, no 'typing...', no profile photo that keeps updating: no crack left to glimpse you through. The way it should be, the way you're used to elsewhere. A wall, not a curtain.
Every call seemed to last about the same, a minute and a half, two, never really more. It wasn't the truth: it was a heartbeat the server kept forgetting to write down. With that ghost caught, the recorded duration is the real one again, from the first ring to the last word. And there's more: if the other person suddenly kills the app mid-call, the call ends instantly on both sides, on iPhone, Android and web, with no screens left hanging in the void.
The model that gives TaskiAI its thought and voice moves to a newer, sharper generation. It answers better, reasons better, understands better what you ask of it. The part that has your back on privacy stays exactly the same: smarter, not more intrusive.
Talking to TaskiAI becomes more natural and immediate. While you chat it can search the web to answer you with fresh news, and it does so in your language, with your accent, as if it were a local. A conversation, not a command.
Describe the sticker you have in mind and TaskiAI draws it: in cartoon style, anime, or exactly as you picture it. Start from a photo of yourself and it becomes a sticker with your face, a little piece of you to drop into a chat. Imagination turns into a sticker in seconds.
You can't always listen to a voice note. Now you can read it: the transcription appears in full, word for word. And when you have several to catch up on, they play one after another on their own, without touching a thing, while the person who sent them sees the 'played' check appear in real time.
Pick up to thirty photos and they leave together, arriving as a tidy grid with a +N on the last one, instead of a burst of bubbles. And even the heaviest files no longer hit tight limits: documents up to half a gigabyte go through without a hitch. On iPhone, Android and web, all the same.
Behind the scenes, Taski is getting ready to carry many more people at once. Delivery and read receipts rest on sturdier foundations, notification queues have ceilings that don't clog, groups reach up to five hundred and twelve people, address books sync in tidy chunks. And the server learns to remember who you are without asking all over again at every step. Invisible work, so that everything stays smooth even when there are many of us.
And then the care for detail, the kind that makes no headlines but is felt every day. A long press on the chat list opens a preview of the conversation and its shortcuts. The reminders calendar opens and closes with a natural gesture. Reply quotes always land in the right place, even when the original message is far away. A hundred refinements that, put together, change how it feels to use Taski every day.
iPhone. Apple Watch. Mac. Windows. Web. Android.
4,121 commits. 844 worker deploys. 94 database migrations. 369 web commits. 85 desktop commits. 644 Android commits.
End-to-end encryption on every message, call, photo, video, sticker.
Integrated AI that respects privacy. Anti-abuse with dual AI model.
Hash-chained key directory for cryptographic transparency.
Apple App Attest for hardware trust.
59 commits in a single day. Commits at 5 in the morning. Typos in commit messages
that betray the exhaustion. "Forse", "sembra", "quasi perfetto" —
the words of someone building something bigger than themselves.
From Initial Commit to here: 195 days. From an empty folder to an ecosystem.
Every commit is a step forward. Every bug fixed is a lesson learned. Every feature is a promise kept.