Our Question Diary Deutsch

Security · Protocol v0.7.1 · not yet externally audited

How the encryption works

Everything is locked on the phone before it leaves. Our server is a mailbox for locked envelopes, and the other person only borrows the keys to your answers.

This page shows step by step what happens in the background. The short version is on the Security page, the complete one in the protocol and the threat model. The protocol is authoritative.

Robin and Kim are an invented couple. Robin is drawn in the accent colour, Kim in the text colour, the server dashed and keys in a stronger tint.

  • Locked before it leavesQuestions, answers, comments and names are encrypted on the phone. Only your two phones hold keys.
  • Answers open togetherA gate key waits on the server and is released only when both of you have answered.
  • Keys are borrowedThe copy of your answer key on the other phone runs out after 7 days unless it is renewed.

The big picture

Readable text exists only on your phones. Everything in between is a locked envelope.

Robin's phone Plain text lives only here 12-word recovery code keys in the device keystore encrypted local database locks every item before sending Our server (EU) Stores locked envelopes public keys and gate keys locked key copies (leases) who is paired with whom has no key to any content Kim's phone Plain text lives only here own 12-word recovery code keys in the device keystore encrypted local database unlocks after checking signatures upload sync sync upload wake-up Apple / Google push sees a sealed 304-byte note sealed note
Nothing readable ever crosses the dashed boxes. TLS protects the connection on top, but even someone inside the server only finds locked envelopes.

Every key grows from 12 words

On the first launch the phone draws 128 random bits and shows them as 12 English words (BIP-39). All personal keys are derived from them (HKDF-SHA256), so the words alone bring an account back on a new phone. They are never sent anywhere.

12 words 128 random bits derive master secret Account ID a random number, no name, email or phone Sign-in key proves to the server that it is you Signing key seals every item, so tampering shows Receiving key the partner locks keys so only you open them Private content key locks your private questions and notes
The same 12 words always give the same keys. After a restore the other phone has nothing to do. The server only stores the public halves of the signing and receiving keys.

Both keep it

Pair question key

Locks shared questions, display names and "discussed" marks. It is never taken back, so shared questions survive a separation.

Yours, only lent

Answer key

One per person. It opens your answers and comments. The other person only gets a lease that expires after 7 days without renewal.

New for every item

Item key

Encrypts exactly one answer or comment and is itself locked with the answer key. A new answer key only re-locks these small keys, never the text.

Connecting two phones

Robin invites Kim with a QR code or a link. The secret part sits after the # of the link, which browsers never send to a server. With it, both phones can prove to each other that the server did not slip in someone else's keys.

Robin Server Kim creates invite ID + secret invite ID + hash of a token (no secret) QR code or link: secret + Robin's key fingerprint after the # redeem token + proof made with the secret Robin's public keys checks them against the fingerprint Kim's public keys + proof checks the proof: keys not swapped pair question key, locked for Kim passed on, server can't open it Both confirm, optionally after comparing their safety codes. The connection is now active.
Each phone then sends the other a lease for its answer key, locked with the other person's receiving key (HPKE). From here on both phones pin each other's keys and warn if the server ever shows different ones. The safety codes protect a link sent through a compromised messenger.

Sharing a question

A question starts private. Sharing makes a copy for your shared space and leaves the private note behind.

Private question locked with Robin's private content key has a private note Share Shared copy note stays private padded to a fixed size pair key lock + signature upload Pair space keeps the envelope opens a gate for answers sees size and time only sync Kim's phone checks the signature opens it with the pair question key One envelope as the server sees it Header: version, ID, space, author Locked content, padded to 1, 4, 16 or 64 KiB Signature
Padding means a two-word question and a long one look the same size to the server. The signature (Ed25519) lets Kim's phone reject anything the server altered.

Answers open only when both have answered

An answer gets one extra lock, the gate key. The phone uploads the answer first and then hands the gate key to the server. The server passes it on only once the other person has deposited an answer too.

Gate key server hands it out only after both answered Robin's answer key Kim holds it only as a 7-day lease Item key new for every answer Robin's answer text Nobody yet Gate created when the question is shared. Robin answered Server keeps Robin's gate key. Kim only sees that Robin answered. Both answered Server gives each gate key to the other person. Both can read. The server alone has no answer key. Kim alone has no gate key.
To read Robin's answer, Kim's phone opens the locks from the outside in: gate key, then the leased answer key, then the item key. Whoever answers second triggers the reveal, even if the other phone is offline. Answering again after reading is shown to the other person.

Leases, withdrawing and separating

Kim's phone renews its lease on Robin's answer key at every sync. Robin's phone signs the lease anew every day, with a date. If the lease is gone, 7 days pass without renewal or Robin's signature is older than 30 days, the phone deletes the key and every answer that depends on it. Withdrawing a single answer works the same way: Robin switches to a new answer key and the old one runs out.

Robin taps Separate server deletes all leases Kim's phone, online Robin's answers deleted at the next sync Kim's phone, offline since day 1 lease runs out, answers gone Shared questions (pair question key) never revoked, stay readable for both 012345678910 days
Dots are syncs that renewed the lease. Robin's phone shows Kim's state honestly: "deletion confirmed" once Kim's phone synced, otherwise "unreadable by day 8 at the latest". The time comes from the server's signed clock, so moving the phone's clock does not stretch a lease. Undoing a separation needs both of you. After 365 days the connection dissolves and each person keeps the questions privately, with their own answer added as a note.

Notifications without content

Only four events send an immediate push: a new shared question, both answers revealed, a new comment and a separation. The sending phone seals the note itself, so neither our server nor Apple or Google learn even the type.

Robin's phone type + item ID, padded and sealed to Kim's push key Our server forwards the blob unchanged Apple / Google see 304 bytes and a neutral fallback text Kim's phone opens the note on the device Shown "Robin shared a question" never its text On the phone only: the 7-day reminder, the "one year ago" look-back and notices before a connection dissolves.
Each push type can be switched off; the phone then simply doesn't send it. No pushes travel while a couple is separating.

The building blocks

We invented none of these methods. The core of the app is written in Rust and uses maintained, widely reviewed libraries.

Used forMethod
Encrypting contentXChaCha20-Poly1305
Locking a key for another personHPKE (RFC 9180) with X25519
SignaturesEd25519
Deriving keysHKDF-SHA256
Recovery codeBIP-39 word list, 12 words, 128 bits
Hiding sizesPadding to 1, 4, 16 or 64 KiB

What encryption can't do

  • A modified app or a tampered phone can keep everything it was ever able to read. Screenshots and photos can't be prevented.
  • A phone that stays offline can read withdrawn or separated content for up to 7 days. If someone took over our server and kept handing out old leases, it would be at most 30 days.
  • The server working together with the other person could open an answer early.
  • With a modified app, the other person could give a meaningless answer to unlock yours. Answering again afterwards is shown to you.
  • Losing both the phone and the 12 words means losing your own content.
  • There has been no external audit yet.

What the server still learns and how to report a vulnerability is on the Security page.