Anonymous sync without accounts: how the device key works

The app has no sign up screen, and it still syncs between an iPhone and an iPad. People ask how, usually with a slight suspicion that it is doing something worse than an account rather than something better, which is fair.

The design is simple. The first device generates a random key locally. That key is the only identifier the sync layer knows. Data is encrypted on the device before it leaves, with a key derived from the same secret, and the server stores opaque blobs against an identifier it cannot link to a person. To add a second device you transfer the key, which is a QR code on screen and a camera on the other device. There is no email, no password, and no user table, because there is nothing to put in one.

The limits are real and I would rather state them than let people discover them. Lose every device and the data is gone, because I cannot reset a password that does not exist. The server sees timing and size metadata even though it cannot read content. And the QR transfer has to happen with both devices physically present, which some people find inconvenient and which is the point.

This post covers the key generation, the encryption envelope, the conflict resolution, the recovery options that exist, and the ones I decided not to build.

Outline

Status: outline. The introduction above is finished copy. Everything below is the section plan for the full draft, targeted at about 1 900 words.

1. Why no accounts. The product reason, and the maintenance reason.
2. Key generation. What is generated, where, and what derives from it.
3. The encryption envelope. What the server stores, and what it can infer anyway.
4. Adding a second device. The QR transfer, and why it requires physical presence.
5. Conflict resolution. Two devices, one day, different values.
6. Recovery. The one option that exists, and the three I rejected.
7. What the server can still see. Timing, size and IP, stated plainly.