Signal is the new app of the moment in Hong Kong.

Since June 30, the city’s residents have been flocking to the messaging app, driving it to the top spot on both Apple’s App Store and Google Play. It also saw a surge in American users who organised and participated in Black Lives Matter protests nationwide.

Here’s what you need to know about the hot privacy-conscious app.

Encryption for everyone, not just the tech-savvy

Signal was created by American cryptographer and Twitter’s former head of security Moxie Marlinspike. His goal was to build an easy-to-use digital tool that helps ordinary people keep their communications secure.

The free app is developed by a non-profit organisation supported entirely by grants and donations. Over the years, it has received close to US$3 million from the Open Technology Fund run by the US Agency for Global Media, the government agency that also oversees Voice of America.

Signal boasts millions of daily users, with US whistle-blower Edward Snowden among them. The European Commission also told its staff to switch to Signal earlier this year.

The app has already been blocked in some countries such as Egypt, Oman, Qatar and United Arab Emirates. Surprisingly, it still works in mainland China… for now.

Why are Hongkongers turning to Signal?

Late at night on June 30, Hong Kong adopted a new security law that went into effect the next day. Crafted by Beijing, the rules grant local authorities sweeping powers to crack down on acts of secession, subversion, terrorism and collusion with foreign forces. Secret surveillance can be approved by the city’s leader.

Downloads of Signal surged immediately after the legislation was unveiled. Residents told the South China Morning Post that they started taking various cybersecurity measures to protect their privacy. Some people quit social media. Others are using VPNs – software that allows users to hide the origin of their traffic by encrypting and re-routing it.

Is Signal really secure?

Signal uses end-to-end encryption, just like WhatsApp and iMessage. That means when you send a message, it’s scrambled into a series of unreadable codes that make no sense to anyone who intercepts it during transmission. Only the intended recipient has the key to decrypt and read the message. Hackers, police, your phone company and even Signal itself are all unable to see the content of whatever you send.

The code behind Signal is open source, meaning researchers are free to examine for flaws. It’s widely held up as an example of sound encryption. WhatsApp’s encryption is even based on the Signal Protocol.

Signal also famously encrypts metadata that other messengers like WhatsApp don’t. So the organisation can’t even see who is talking to whom or when.

In 2016, US prosecutors issued a federal subpoena to the group behind Signal, requesting data on two suspects using the app. Authorities sought information that included names, phone numbers, email addresses and IP logs. None of the data was turned over, according to court filings published by the American Civil Liberties Union.

Can’t I just use other end-to-end encrypted messaging apps?

You can, but there are some features that make Signal unique.

For one, Signal conversations are only stored locally on devices. This contrasts with WhatsApp, for example, which lets users back up their chat records on iCloud or Google Drive, neither of which adopt end-to-end encryption for all data. Apple, however, has stressed that only the company itself holds the encryption key to iCloud data.

Signal also offers a few options for additional layers of protection. A photo or video can be set to automatically delete after it’s been viewed. You can also turn on disappearing messages, which will erase messages after a set period of time – anywhere from five seconds to a week.

Signal also recently introduced a blur feature in the image editor. This hides the faces of people shown in a photo with a fuzzy box.

I use Signal, so I can relax, right?

All technology has limits – even Signal.

As much as you value privacy, the people you message can always take screenshots of your conversations or save images you sent without telling you. Also, if their phones are compromised, any data on their device – including your chat history and phone number – could also be exposed.