How sync works

We run the mailbox.
We can't open it.

Here's what happens when two of your devices sync — and what our server can and can't see.

In four sentences

Your devices share a sync code, exchanged by QR when you pair them. From that code each device derives two things: the encryption key and the address of a mailbox on the internet. One device drops a sealed envelope there; the other picks it up and opens it. The code never leaves your devices — which is why the mailbox can't be opened, not even by us.

Why there is anything in between at all

Two phones don't find each other on the internet by themselves. They sit behind routers, switch networks, are sometimes off. The mailbox is the one place both can reach.

At home on the same Wi-Fi, it isn't used — the devices talk to each other directly, encrypted as well.

What's in the mailbox

Stored

The sealed envelope, at most 2 MB
The address — a 64-character random number
A fingerprint of the write permission
Version number, time of last drop, expiry date
Whether the family has Premium, and until when

Never stored, never visible

The sync code and the key
The content: no sleep times, no name, no birthday
Who you are: no account, no e-mail, no login
How many children, how many devices

What every internet connection involves, and so applies here too: the infrastructure provider, Cloudflare, sees the connecting IP address — like any website. We don't log it.

It cleans up after itself

If no new envelope arrives for 30 days, the mailbox deletes itself, contents included. You can also empty it yourself at any time. There is no store at our end that grows.

The honest price

Because we don't have the key, we can't give it back to you. Lose all your devices and the sync code, and the mailbox stays shut. That is the same property that makes it worthless to an attacker.

Where it lives

In the EU. Operated on Cloudflare infrastructure that creates the mailboxes exclusively in EU data centres.

We run the mailbox.We can't open it.