Pudu: Exposed

Pudu is a private-beta chat app at pudu.chat. On 21 October 2026 its author posted that he was tired of Discord alternatives that copy Discord, and that Pudu would rethink the experience. The same day’s homepage, price list, privacy policy, and desktop repo describe a Discord-shaped product, a paid tier the app says you cannot buy yet, and one person who can read the messages. In the replies he said the familiar layout is intentional, that paid subscriptions are not live yet, and that the app does not have live end-to-end encryption.

Checked 21 October 2026. Quotes are from the live site, the production JavaScript served that day, the public GitHub releases, and the launch thread. An earlier pass the same day saw one comment, from AutoModerator, because the comment archive had not caught up. Reddit’s Atom feed for the thread, read at 15:23 UTC, contained the post and 49 comments. That feed does not include a score, and a feed can stop at its own limit.

On this page

• The post
• The replies
• The screenshot
• Clubs, channels, roles, voice
• The price list and the lock
• Who can read the chat
• The Orb Company
• The desktop files
• The person shipping it
• Dates
• Sources
• Corrections

The post

Posted 21 October 2026, 07:46 UTC, by u/nikgraphx on r/DiscordAlternatives. Title: “Tired of Discord alternatives just copying Discord, so I’m building something different.”

I’ve been exploring Discord alternatives, and honestly, most feel like Discord clones with a few tweaks. Even the new popular thing Yapper, despite gaining attention, still feel pretty rough in terms of design and experience.

So I’m building Pudu, a little passion project where I’m using Discord as a starting point, but trying to rethink the overall experience rather than just copying it.
I’m not claiming it’s perfect or better than everything else. I’m just a designer who loves building things, and I’d genuinely appreciate some feedback, criticism, or ideas.

The post links pudu.chat, says the app is in beta with a waitlist, and offers early access by Reddit DM. A line in parentheses says: “We have web, windows app and mac app. Android is under internal testing, ios coming soon.” The public download manifest that day listed Mac and Windows installers. This check did not find a Play Store or App Store listing for Pudu. The privacy policy says it covers mobile apps.

A few hours later he edited the post:

I can see how my title and comparisons set expectations I haven’t met yet. The questions about privacy and what makes Pudu worth using are fair, and I’m taking them seriously. But the mockery and comments saying I’ve built nothing because I use third-party services haven’t been useful.

I’m not asking anyone to switch or trust an unfinished app blindly. I just wish there were more room to share early work without the conversation turning into this.

AutoModerator’s comment, posted with the thread, asks developers to set a user flair. The next section is the rest of that feed: what people asked, and what he answered.

The replies

The comments below are from Reddit’s Atom feed for the launch thread, retrieved 21 October 2026 at 15:23 UTC. Times are UTC. Where he edited a comment, the feed has the later text. The earlier text is quoted from a screenshot another user attached.

What is different

At 08:06, u/nuclearbananana asked: “what’s different about it?”

At 08:17, u/nikgraphx answered:

The layout is actually pretty familiar to Discord, and that’s intentional. I don’t think there’s a need to reinvent something people are already comfortable with.

My focus is more on refining the overall experience, making things feel cleaner, more polished, and easier to use, while gradually exploring new ideas and features. For example, I’m working on a public room system out of servers and all.

It’s still very early, and I’m not claiming we’ve reinvented anything.

At 13:32, replying to a comment that the pitch was a Discord clone without end-to-end encryption, he wrote: “Yeah, fair, my pitch didn’t line up well with the screenshot. The familiar layout is intentional; I’m not trying to reinvent navigation just to look different.” At 15:21, u/AbstractMelons wrote: “Your entire pitch is not copying discord and instead rethinking it, then you say that your UI is intentionally pretty much exactly discord and that you are not reinventing anything?”

At 11:09 he wrote: “Make it -10000 guys : )”

Encryption, and the reply he replaced

At 10:05, u/Blaze5VA quoted the privacy policy line “Messages and calls are not end-to-end encrypted.” and called that concerning for an India-based app already offering two paid tiers. The comment asks what stops staff from opening private messages, files, and group conversations, whether that access is restricted, logged, and audited, and says the technical ability to read those conversations is separate from an accusation that anyone is doing it. It links pudu.chat/privacy and pudu.chat/terms.

The comment says the policy “explicitly acknowledges that authorized team members may access user information” for operations, abuse investigations, support, and legal compliance. The policy text on this recheck does not contain the phrase “authorized team members.” It says production dashboard access is limited to Nikhil Kumar, and that server administrators and infrastructure providers can technically access server-processed information. The payments section says “authorized support staff” can handle a billing issue. The same policy says there is no complete audit trail of every direct dashboard or database read. That paragraph is quoted under Who can read the chat.

His first reply is not the text in the feed. u/Blaze5VA posted a screenshot of it, preview.redd.it/u4kt2go8qswh1.jpeg, taken while the reply still said “Now.” The reply in that image:

Take a chill bro, it’s been a few weeks only. I will implement encryption and everything. I mentioned it is so early beta. What do you expect? It’s not a big company, I’m a solo guy, come on?

By 15:23 the same comment, phzx70h, timestamped 10:10, read:

Fair questions. Pudu is an early solo-built beta, and these are areas I need to improve. The policy is explicit about the current lack of end-to-end encryption. I’ll review administrative access, retention/deletion and provider disclosures, and publish what’s actually verified. Paid subscriptions aren’t live yet.

u/Blaze5VA answered that the message had been drastically changed, and that “I’ll implement encryption” does not say whether that means encryption in transit, encryption at rest, or end-to-end encryption. At 10:26 u/nikgraphx wrote: “Yeah, that was my reply. I got defensive and replied before properly taking in your message. I changed it after reading it again, but I should’ve handled it better in the first place.” He added that he had been “too casual with the whole ‘encryption and everything’ thing,” and that saying “early beta” did not answer what protects the data now. At 13:32 he wrote: “Pudu doesn’t have live E2EE right now. I’m not going to sell work in progress as a finished safeguard.”

Retention, the company name, and Simple Task

The same comment calls the retention policy remarkably vague, says there is no firm timeline for deleting data from backups and logs, and says the infrastructure providers are not disclosed enough. It also says a directory check could not show whether “The Orb Company” is an incorporated business or a trading name, and that this is not by itself an accusation. On Simple Task, it quotes the Play data-safety row “Data isn’t encrypted,” and says that label does not prove the same thing about Pudu. On the GDPR, it names Article 13 (lawful basis, retention criteria, rights to object, restrict, and portability) and Article 27 (an EU representative), and says these are compliance concerns from the published policy, not confirmed legal violations.

The policy checked the same day names Supabase, Cloudflare, LiveKit Cloud, Plunk, Gmail, Userjot, KLIPY, Paddle, GitHub, and the browser push providers. It lists cleanup periods for messages, files, mail, reports, push jobs, and unapproved waitlist requests. It also says this:

We do not currently keep manual production database or user-file backups. We have not verified a single maximum deletion period for all provider-managed backup copies and logs, so we do not promise that those copies disappear immediately or within the application cleanup periods above. We are reviewing those provider commitments.

At 13:32 he agreed that “vague retention wording isn’t good enough” and said he was working through it. The policies still give no CIN, GSTIN, registered office, or company number. A directory search for this product still does not return a matching Indian registration. The Play listing for com.theorbcomany.simpletask does include the data-safety row “Data isn’t encrypted.” That row is Simple Task’s disclosure. The privacy policy does not name a lawful basis for each purpose, does not name an EU representative, and describes rights as depending on applicable law: access, correct, obtain, erase, withdraw consent, or raise a complaint. It does not set out a separate portability or restriction procedure. This page does not decide whether that text breaks the GDPR.

Managed services, and AI

At 08:38, u/FrenchToastRoast981 asked what his use of AI had been during development. At 09:06 he answered: “Yeah, I do get some help from AI here and there, mostly with debugging, figuring out certain things, or speeding up parts of development. But I’m actively working on the project myself, from design to development and the overall direction.” He called AI “a helpful tool rather than something doing the whole work for me.” The application source is not in the public repo, so that description cannot be checked against the code.

At 14:19, u/Hadgebury listed Supabase in Singapore, LiveKit Cloud, Cloudflare and Turnstile, Plunk routed through Cloudflare into Gmail, Userjot, Paddle, and KLIPY, and called the app a patchwork of managed services. A follow-up said the core that makes it work is not his, “Based On Deconstruction Of His Software Code And Security Analysis,” and mentioned “Hallmarks Of Vibe Coding / Heavy AI Use.” The provider list matches the privacy policy. The comment does not include the analysis, or a specific bug. At 14:45 he answered that he uses managed services because he is building a community app, “not my own database company, payment processor and global video network,” and that “A list of providers isn’t a security finding.” At 14:59 he wrote: “Okay, let me start working on my own database infrastructures, my own servers, own GIF, sticker database and everything, and I’ll come back to this project in next 10 to 15 years. Thank you.” At 15:09, u/Glittering-Roof7519 wrote “AI slop gg.” At 15:14 he replied “Thankyou!”

Why anyone should switch

At 12:11, u/BewilderedTurtle asked why someone would use this instead of a more mature alternative, why he built a new app instead of contributing to an existing one, what is unique, and why anyone should trust him with personal data. The comment opens with “the obvious slopcode scam.” At 13:36 u/nikgraphx answered that those questions can be asked without deciding it is a scam first, that he is not claiming Pudu already beats mature alternatives, and that “You shouldn’t trust me with your data just because I’m enthusiastic about the project.” At 14:11 u/BewilderedTurtle wrote “So basically no actual reasons aside from trust me bro” and “I didn’t call this a scam. You brought up yapper unprompted.” At 15:00 the same user wrote: “And yet you fail to provide even a single reason.” At 15:01 u/nikgraphx replied: “Yes I do, I’m sorry. Just ignore this post. Turn off your notifications. Thank you.”

At 13:16, u/mightvefkup wrote “This is real sus.” The next comment ties that to people getting scammed by an app called Yapper. At 13:29 he wrote: “Pudu isn’t connected to Yapper. Judge it on what I’ve actually built and said.”

At 10:02, u/Higherfalls said the site felt like a real attempt, asked about a dark mode, and added: “I can’t seem to apply for the beta.” At 14:54 he replied with pudu.chat/waitlist. In the bundle served that day, a visit to /waitlist is the “Apply for the beta” screen. The HTML returned for that URL before JavaScript runs is the homepage. At 08:15, u/Cute-Broccoli3433 wrote that they had already been using the beta and had watched it grow from a web app to a desktop app. He thanked them. That account’s public overview also contains comments from September 2025 and February 2026.

The screenshot

The homepage hero is a picture of the desktop app. Its alt text, in the HTML served on 21 October 2026, is: “Pudu desktop app showing Club channels, a conversation and the People sidebar.”

The picture is a macOS window in three columns.

• A left rail of Club icons, with a home bubble and a plus.
• A channel column for a Club named Pudu HQ: Members, Welcome, Rules, Announcements, a CHANNELS group (General, Media, Tech, Game), and a VOICE CHANNELS group with one room, The Lounge.
• A message pane: a General tab, search, mentions, reactions, a composer labeled “Write a message,” and a GIF button.
• A People column grouped Online, Away, and Offline. The card says “13 members · Private Club.”
• A user chip at the bottom left: Nik, a crown, “Online · @nik.”

The sample thread in that image is people talking about the chrome: reactions, joining a voice channel, and the sidebar. The homepage copy around the image is four lines: “Your people. Your kind of place.” “Chat with friends, hang out in voice, and make a Club for the things you love.” “Private beta · Made for your people.” The footer says “Made with 💜 by The Orb Company.”

The header offers Pricing, Download, Privacy, Log in, and Sign up. The hero offers “Apply for beta access” and “Already invited? Log in.” Both doors are on the same page.

Clubs, channels, roles, voice

The web app is a React bundle. On 21 October 2026 the shell was /assets/index-Dj8Ib3in.js, and the signed-in workspace was /assets/Workspace-DZTpEghX.js. Strings in that workspace, and the release notes on the public desktop repo, name the product’s pieces:

• Clubs you drag by their icons. Channels you drag by the row. Text channels and voice channels. Private channels. A welcome page, a Rules page, and Announcements.
• Fixed roles already in the product: owner, admin, moderator, member. The settings copy says “Custom roles are coming soon” and “Existing owner, admin, moderator and member permissions remain available.”
• Friends, direct messages, blocks, and reports. “Choose a reason and send it to the Pudu moderation team.”
• Calls through LiveKit. Noise suppression with Off, Standard, and Enhanced, restored in version 0.4.40 on 20 October 2026. Screen sharing, cameras, and a grid.
• Club discovery for approved beta users. Invite links. A member list and a right-click menu.

Several Discord-shaped controls are present as labels and then marked unfinished. “Boost messages, game activity and AFK controls are not available yet.” “Ban management is coming soon.” “Audit logs are coming soon.” “Safety setup is coming soon.” “VIP Club is a working name. More details will arrive later.” The VIP section adds: “No boosting, payments or paid benefits are available in this beta.”

A voice channel can show “Remote calls require a connected LiveKit project.” That string is an error state in the same bundle, next to “Join voice channel.”

The price list and the lock

pudu.chat/pricing is titled “Pudu pricing · Pudu Plus and Club Plus.” The page says “Start free. Choose Plus when you want a little extra.” Prices below are the amounts in the pricing bundle PublicPricingPage-VR8CXGkc.js on 21 October 2026. The page also offers INR.

The yearly toggle says “save about 10%.” Against twelve times the monthly price, the dollar Club Plus year is 10.0% less, Pudu Plus in dollars is about 10.6% less, and the rupee years are about 9.8% and 9.9% less. The slogan matches the numbers.

The buttons say “Get started with Pudu Plus” and “Get started with Club Plus.” In that bundle they point at /signup?plan=…. The signup copy in the main bundle says something else: “Join the private beta to get started.” “Tell us a little about yourself. We’ll email you when a beta invitation is available.” “This email doesn’t have beta access yet.” The terms, updated the same day, say beta access is by approval and that joining the waitlist does not promise approval, a release date, or a permanent place in the service.

Inside the app, the paid Club features are still a preview:

• “Club Tags are coming with paid plans.” “Preview a short badge for your Club. This beta cannot enable or purchase tags.”
• The invite-page background and the custom invite link open a dialog that says “Coming soon with paid Club plans.” The example address is pudu.chat/invite/weekend. “Custom addresses will become available with paid Club plans.”
• The VIP block: “No boosting, payments or paid benefits are available in this beta.”

So the public price list sells a Club Tag, a vanity invite, and an invite background, and the build that was current the same morning says this beta cannot sell them. On the launch thread at 10:10 UTC he wrote, in the edited reply: “Paid subscriptions aren’t live yet.” The pricing page, with the Plus and Club Plus buttons, was still being served when this page was checked again later that day. The refund policy, also dated 21 October 2026, says Pudu does not add an automatic money-back guarantee. For a Paddle checkout, Paddle is the merchant of record. Canceling a subscription and asking for a refund are separate steps. Signing out, uninstalling, or leaving a Club does not cancel the charge.

Who can read the chat

The homepage does not mention encryption. The Reddit post does not mention it either. The privacy policy does, and it is specific. Last updated 21 October 2026. Operator line: “Pudu is operated by Nikhil Kumar (Nik), using the name The Orb Company, in India.”

Pudu currently has one operator, Nikhil Kumar. Production dashboard access is limited to him and protected by two-factor authentication.

Messages and calls are not end-to-end encrypted. Server administrators and relevant infrastructure providers can technically access server-processed information; normal user access controls do not prevent privileged administrative access. We do not currently have an independent audit or a complete audit trail of every direct dashboard or database read.

That is the operator saying the limit in plain language. Administrative access is described as something he uses to run the service, review reports, handle a verified support or deletion request, or comply with law. The same paragraph says a direct look at the dashboard or the database is not fully logged, and nobody outside has audited it.

Where the data sits, from that policy:

• Supabase holds sign-in, profiles, messages, memberships, and files. The policy says the application database and file storage are in Singapore. The web bundle calls https://fxrdoruypyiuptzpthxb.supabase.co.
• LiveKit Cloud carries live audio, video, and screen sharing, plus participant names and room metadata.
• Cloudflare serves the site and runs Turnstile, and sees IP addresses and browser data. Support mail to [email protected] is routed through Cloudflare and handled in Gmail.
• Plunk sends service email. Userjot receives in-app support, including the account identity. KLIPY serves GIF, sticker, and clip search and receives an identifier linked to the account plus the search terms.
• Paddle receives card details if someone checks out. Pudu keeps customer, transaction, and subscription references. GitHub hosts the desktop downloads and sees the download request. Browser push goes through Google, Mozilla, Apple, or Microsoft. The policy says the push payload is a generic alert and conversation identifiers, rather than the message body.

Deleting a message removes the body from the active database and leaves a “Message deleted” placeholder on replies. A report does not keep a separate copy of the body. Attachments from deleted messages are queued for removal after a one-hour grace period. Account and conversation history otherwise stay until the user deletes them, asks for account deletion, or moderation removes them. The policy also says Pudu does not currently keep manual production database or user-file backups, and that it has not verified a maximum deletion time for provider-managed backup copies and logs. The sentence is quoted under The replies.

The age rule is an honor system plus a contact address. The policy says Pudu is for people 16 and over, or older where local law requires it. Under 18, a parent or guardian is supposed to review the terms and authorize use. “Do not create an account for someone under 16.” Where the law requires verified parental consent, the policy says that consent must be arranged first and tells you to email support. It does not describe an ID check, a face scan, or a payment-card age check.

The Orb Company

The footer on every public page says the product is made by The Orb Company. The privacy policy and the refund policy are narrower: Nikhil Kumar, using that name, in India. Contact is [email protected]. The terms are governed by Indian law, except where mandatory law where the user lives says otherwise. The policies do not give a CIN, a GSTIN, a registered office, or a company number.

A search of company directories for “The Orb Company” plus this product does not return an Indian registration that matches pudu.chat. Other businesses that use Orb in the name, and other directors named Nikhil Kumar, are different people. This page does not attach those records to him.

pudu.chat was registered on 13 October 2026 through Hostinger operations, UAB. Nameservers are Cloudflare (sean.ns.cloudflare.com, ines.ns.cloudflare.com). The registration record shows a transfer lock and an expiration of 13 October 2027. It does not show a registrant name.

The desktop files

Desktop downloads are not built by the website. The site fetches downloads.json from GitHub user nikgraphx. On 21 October 2026, 09:30 UTC, that file’s current release was 0.4.46 for Mac (Apple silicon and Intel) and Windows x64.

• Windows installer: Pudu-0.4.46-win-x64.exe, 125,756,459 bytes, from github.com/nikgraphx/Pudu-Desktop/releases/download/v0.4.46/.
• Mac Apple silicon: Pudu-0.4.46-mac-arm64.dmg, 146,275,204 bytes. An Intel DMG sits beside it.

The download page in the web app says the Windows beta installer is not digitally signed yet, and that SmartScreen may warn about an unknown publisher. It says macOS may ask you to approve Pudu in Privacy & Security on first open. The repo README is blunter: the Mac builds use an Apple Development signature, are not Developer ID signed, and are not notarized. The Windows EXE is not Authenticode-signed. The README says not to turn Gatekeeper or Windows security off globally, and that an approved beta account is still required after you install.

The same README is behind the file it points at. It still tells a Windows user to download Pudu-0.4.7-win-x64.exe, install 0.4.6, let the app fetch 0.4.7, and click Restart to update. It says “Actual Windows replacement/relaunch is awaiting tester confirmation.” The live manifest and the GitHub release list had already moved on to 0.4.46.

The repository description is: “Official Pudu desktop installers and update files. Application source is maintained separately.” The README says the repo contains installers and update metadata, and does not contain application source or signing keys. nikgraphx’s public GitHub account, created 21 August 2023, listed three repositories on 21 October 2026: this installer bucket, a small Mac utility called FixGreen, and a fork of Raycast extensions. None of them is the Pudu application source.

Release pace, from the GitHub releases API the same day: 45 release objects. One is a metadata tag, windows-updates. The app tags run from 0.4.3, published 15 October 2026, through 0.4.46. Thirteen versioned releases landed on 15 October. Eleven landed on 20 October. The note on 0.4.46 is two bullets: clearer sign-in and password-reset errors, and “Password-reset buttons stay in place while you click, plus the latest Pudu refinements.”

The public repo was created 15 October 2026. The domain was registered two days earlier. The Reddit post calling it a little passion project went up on the morning of version 0.4.46.

The person shipping it

The privacy policy names Nikhil Kumar, Nik. The same person is u/nikgraphx, github.com/nikgraphx (display name Nik, location India), @nikgraphx, and the site nikgraphx.com. That site’s contact mail is [email protected]. The about line there: “Nikhil Kumar, usually Nik.” He describes himself as a self-taught designer and developer. The tools row on that page is Framer, Figma, FlutterFlow, Canva, VS Code, Xcode, Arc, Raycast, and Spotify.

The freelance menu on the same site includes “Discord setup & moderation”: channels, roles, bots, onboarding, or help running the community. Two portfolio entries are Discord servers he configured, Pikaicons and Exponent, each with a discord.gg invite. In September 2026, the Reddit account that later announced Pudu was still inviting people to Discord for his own communities: bunnysmp.in, discord.gg/phamily, and phamily.in. The portfolio describes Another Phamily as branding and a site, “Originally built in Framer, later rebuilt in code with AI assistance.”

His earlier app under the same trade name is Simple Task, a to-do list. The Play Store id, which his own portfolio and his X account both link, is com.theorbcomany.simpletask. “Company” is missing the p. On 19 August 2025 he posted it to r/FlutterFlow as “entirely built in FlutterFlow,” with that Play id and an App Store link. The portfolio now describes the same app as “Android · Flutter & Firebase.” The Play data-safety section for that listing includes the row “Data isn’t encrypted.” That row is Simple Task’s disclosure. On 6 May 2026, on r/FlutterFlow, he wrote that he had moved one of his primary projects to Codex. In January 2025, stuck on local notifications for the to-do app, he wrote that he had tried ChatGPT and could not get it working. Those two posts are about his other projects. On the Pudu launch thread he said he uses AI for debugging and for speeding up parts of this project, and that he is doing the work himself. Pudu’s application source is not public, so neither statement can be checked against this app’s code.

On 11 October 2026 he posted that Simple Task was getting close to 5,000 downloads. That number is his. This page does not have a separate Play Console count.

Dates

Sources

Opened 21 October 2026 unless a line says otherwise.

• pudu.chat homepage HTML, including the hero alt text and the footer.
• Pricing, Privacy, Terms, Refunds, Download. The download URL returned the marketing homepage; the download copy cited above is in /assets/DownloadPage-HlFXe7pN.js.
• Bundles served that day: /assets/index-Dj8Ib3in.js, /assets/Workspace-DZTpEghX.js, /assets/downloads-DzBMSMrb.js, /assets/PublicPricingPage-VR8CXGkc.js, /assets/LegalPage-Bx1CNxer.js. Bundle hashes change when he ships. The sentences quoted from them were in those files on this date.
• Homepage image /marketing/app-window.webp.
• The launch post and its comments, including u/Blaze5VA at phzwu70. The first pass used the Arctic Shift archive, which at that time had only AutoModerator. The replies section is Reddit’s Atom feed for the thread, retrieved 21 October 2026 at 15:23 UTC. The replaced reply is the text visible in the screenshot u/Blaze5VA attached. u/Cute-Broccoli3433’s public overview feed, same day.
• github.com/nikgraphx/Pudu-Desktop, its README, downloads.json, and the releases API listing through v0.4.46.
• github.com/nikgraphx public profile and repository list.
• RDAP for pudu.chat via rdap.identitydigital.services: registered 13 October 2026, registrar Hostinger operations, UAB.
• nikgraphx.com. Play listing linked from that site and from his X account: com.theorbcomany.simpletask.
• Earlier posts by the same Reddit account: Simple Task on the App Store (19 August 2025), Simple Task introduced (18 February 2025), and the 6 May 2026 FlutterFlow comment about moving a project to Codex.

Corrections

This page records what those URLs said on 21 October 2026. If a Pudu page changes later, the new text does not rewrite the old text. A correction to this page belongs next to the sentence it fixes, with the date of the check. Company filings and Play install counts that were not public in a form this page could verify are left out on purpose. Other people and companies that share a common name with the operator are left out too.

An earlier version of this page, written the same day, said the launch thread had one comment, from AutoModerator, and that there were no user complaints to summarize. That was the Arctic Shift copy. On the recheck, Arctic Shift still returned no body for comment phzwu70. The replies section replaces that sentence. Direct reddit.com HTML from this network was a block page. The Atom feed was readable.