securitylab_n•July 13, 2026•🇷🇺Translated from Russian

Tired of Instant Messaging, Users Flock to Virtual Pigeons: Roost App Revives Postal Delivery with Birds and Animals

Users press the send button, yet the recipient receives nothing for seconds or even minutes. Instead, a virtual bird appears on screen, picks up the letter, and flies across a real-world map toward the addressee. The journey can last several hours or even days. This built-in delay is not a server error but the central feature of the Roost messenger, which has rapidly gained popularity across social networks.

Before sending a message, Roost lets users choose their courier. A falcon travels faster than a hummingbird, while more relaxed users can entrust their letter to a snail or a turtle. The base speed is tied to the real capabilities of the chosen animal, so delivery time depends on both the courier and the distance between correspondents. The route is shown on a map, and the application provides an estimated arrival time in advance.

Birds can be trained in mini-games to gradually increase their speed, and every flight grants experience points. There is no hard speed cap, allowing a favorite pigeon to eventually outpace other creatures in a user’s virtual aviary. The app features more than one thousand birds and animals that users can collect, upgrade, name, and describe.

Core Features and Social Mechanics

Roost blends messaging, social networking, and a collection game. There is no traditional news feed or endless scrolling. Users add friends by name, create group chats called “nests,” and exchange messages with anonymous correspondents via the Pen Pals function. Each nest holds up to 11 participants, and a separate bird must fly to every member. According to GamesBeat, shortly after launch the app saw more than 100,000 active conversations daily.

Creator Background and Explosive Growth

Roost was developed by Logan Mendelson, who works as a product manager for trust and safety at Ticketmaster. The project began as a small experiment for friends. Mendelson first shared the concept on TikTok, and the public version launched at the end of April. The developer had not planned to turn the pigeon-themed diversion into a large social platform.

The real surge began after a post by Karen Lewis on Threads (owned by Meta Platforms Inc.). She described how her daughter and friends communicate in Roost using English from the time of Elizabeth I, with friends replying in the same style. The post received approximately 147,000 views and turned the little-known app into a viral phenomenon.

Within three days the user base grew from 10,000 to 100,000. After roughly five weeks the number approached 300,000 and then surpassed that figure. The creator states that in less than two months Roost attracted more than 300,000 users. A friend of the developer also reported that birds now deliver over one million messages per week and have collectively flown more than one billion virtual miles.

Monetization and Technical Controversies

Mendelson spent nothing on advertising. Users organically shared videos, screenshots, and invitations. The developer has not yet raised external funding and plans to sustain the service through in-app purchases. Core functions remain free, while the app sells rare birds, a subscription with extra features, and lifetime founder-club status.

The first controversy has already emerged: Mendelson used AI-generated bird images, prompting criticism from parts of the community. He acknowledged the concerns and launched a contest for artists to replace the generated illustrations with original artwork. During development he also used Claude Code and believes that without AI assistance it would have been extremely difficult for one person to maintain a service of this scale.

Privacy and Data Handling Concerns

Beneath the charming surface lie significant privacy limitations. Roost requests precise coordinates because geolocation is required to calculate routes and flight times. Users can choose to show friends their exact location, only the city, or hide the endpoint entirely. However, flight direction can still reveal the approximate district of both sender and recipient.

Conversations are not protected by end-to-end encryption. The privacy policy explicitly states that messages are stored in plaintext and remain accessible to server systems. Data transmission is protected by TLS and server storage uses Google Cloud encryption, yet employees and automated systems can technically read message content. Texts from messages, profiles, and anonymous letters are also sent to OpenAI for automated moderation, although the developer claims that names, emails, and account identifiers are not transmitted alongside the text.

Registration requires an Apple or Google account, a phone number, date of birth, and location permission. Current rules allow Roost only for users over 18, an interesting restriction given that many publications portray the service as a new teenage trend.

Availability and Philosophy

Roost is available on iPhone and Android. The iOS version requires iOS 18 or newer, supports only English, and is distributed free with in-app purchases. On Google Play the app has already exceeded 100,000 installations.

The creator describes Roost as a “slow social network.” While conventional messengers compete on instant delivery and capture attention with notifications, Roost sells the experience of waiting. The recipient is not ignoring the message, causing anxiety, or showing a “read” status. The pigeon simply has not arrived yet.

Related articles

Securitylab•Other

10 Services for Instant Video Meetings by Link Without Registration

The article reviews ten platforms designed for quick video calls that require minimal setup. Services such as Bitrix24 Sync and SaluteJazz stand out because they allow organizers and guests to join meetings without creating accounts. Other options like Yandex Telemost, VK Calls, Google Meet, Zoom, Microsoft Teams, Jitsi Meet, MTS Link, and Kontur.Talk offer varying levels of registration requirements, participant limits, and time restrictions on free plans. The comparison highlights differences in meeting duration, guest access policies, screen sharing, and integration with corporate tools. Practical advice is provided on testing connections, checking mobile support, and understanding technical limits that may affect long sessions. The review concludes that choosing the right service depends on team size, need for extended calls, and existing ecosystem preferences.

AntiMalware•Other

Heterogeneous IT Infrastructure Management Persists Among Russian Companies

A recent AM Live viewer poll revealed that 54% of participants manage their heterogeneous IT infrastructure only partially, with just 3% achieving unified control across multiple vendors. The discussion took place during the broadcast titled 'IT Ecosystems: Convenience, Savings, or Dependency?' and highlighted ongoing challenges in the Russian market amid import substitution efforts involving companies such as Orion Soft and Astra Group. 23% of respondents reported using separate platforms with independent management, while 16% relied on a single vendor's unified ecosystem. Key drivers for interest in unified platforms included automation needs (78%), cost reduction (64%), compatibility issues (61%), and specialist shortages (53%). Experts Sergey Rychikhin and Alexander Gavrilenko emphasized that true ecosystems require technological integration, consistent user experience, scalable architecture, and unified support rather than simple branding alignment. Recommendations included clearly defining integration requirements and exit conditions in contracts to mitigate vendor lock-in risks.

Securitylab•Other

BGP Anycast and Traffic Filtering: How Distributed DDoS Protection Works

Powerful DDoS attacks can leave servers intact while blocking user access by overwhelming network links or equipment before traffic reaches applications. Scaling server resources offers little help in such cases. One effective defense distributes incoming traffic across multiple geographically dispersed scrubbing centers using BGP Anycast, which advertises the same IP addresses from different locations. Routers then direct packets to the nearest or most appropriate node based on BGP policies. This architecture allows each center to filter malicious traffic locally before forwarding clean data to the protected infrastructure. The approach proves especially useful against volumetric attacks but requires careful management of routing, load distribution, and application health checks. Providers such as Qrator Labs and Akamai Prolexic operate large anycast networks with multi-terabit capacity.

Securitylab•Other

Freedom Holding Corp Builds Integrated Financial Ecosystem Across Banking, Insurance, Telecom and AI

Freedom Holding Corp., listed on Nasdaq under FRHC, has grown from a brokerage founded by Timur Turlov into a diversified group operating in 24 countries with its core market in Kazakhstan. The company now encompasses Freedom Bank Kazakhstan, Freedom Life and Freedom Insurance, Freedom Telecom, Freedom Cloud, and the Arbuz marketplace, all unified through the Freedom SuperApp launched in April 2024. In the financial year ended 31 March 2026 the group reported revenue of $2.19 billion and net profit of $153.3 million, while banking assets reached $5.36 billion. Freedom Holding is also investing heavily in AI infrastructure, planning a 100 MW sovereign data center and a $2 billion AI hub in partnership with NVIDIA and the Kazakh government. The company has expanded into Tajikistan, Turkey and is seeking licenses in Georgia and France while maintaining strong growth in deposits and active users.