Privacy & trust

A list of where everything is kept is, in effect, a list of everything you own. We built Syntropium so that we don’t have that list — not because we promise not to look, but because what we hold can’t be read.

This page describes how the system works today and what we have committed to do next. Each statement is marked:

Now — true of Syntropium as it runs today.
Commitment — something we have decided to do and have not done yet.

What stays on your device

Now Without Premium, everything you enter — every container, item, description, tag, value estimate and photo — is stored only on the device you entered it on: in the browser’s own storage for the web app, or in the app’s private storage on iPhone. None of it is sent to us. There is no account, and the app works without a connection.

Now On your device, your catalog and photos are stored as ordinary app data, protected by your device’s own lock and encryption, like your notes or photo library. Anyone who can use your unlocked device can open the app and see them.

Now The apps contain no analytics, advertising or tracking code, and this website sets no cookies and runs no scripts.

With Premium: what our server holds

When you turn on Premium sync, our server starts keeping a copy so your devices can stay in step. That copy is:

Now Your catalog, encrypted. Each thing is encrypted on your device before it is sent, using a key that only your devices hold. The server stores each one as an opaque block it cannot decrypt. Which container something is in, whether it is a container or an item, its name — all of that is inside the encryption, so the server cannot see how your catalog is organised either.
Now Your photos, encrypted. Each photo is encrypted on your device with its own key, and that key is kept inside your encrypted catalog.
Now An account ID. A random identifier, with no name, email address or phone number attached to it.
Now Your devices. For each device that can sync: the public half of its passkey (which can check a signature but cannot sign or decrypt anything), the device name shown in your device list, and when it was added and last used. Your key, wrapped so that only your passkey can unwrap it, is stored too, so a fresh install can get it back by signing in.
Now Account details we need to run the service: whether your subscription is active, how many things and how much storage you use, and when the account was created and last active.

What our server can see

Encryption hides content, not the fact that content exists. Our server can see, and cannot avoid seeing:

Now how many things your catalog holds, and roughly how large each encrypted block and photo is;
Now when each one was last changed, and when your devices connect to sync;
Now the account details above;
Now for each signed-in session, the network (IP) address it connected from and the browser or app version it reported, kept with that session’s record for security and deleted automatically, at the latest about three months after the session ends.

What our server never sees

Now The contents of your catalog: names, descriptions, tags, quantities, value estimates, or what is inside what.
Now The contents of your photos.
Now Your encryption key, or anything that could produce it. We hold no master key, no spare copy and no way to unlock your data on your behalf.
Now A password — there isn’t one.

If we are ever compelled to hand over what we hold about an account, what we can produce is the encrypted data and the details listed above. We have no means to decrypt it.

Where your key is kept on your devices

Now So that you don’t have to unlock sync every time you open the app, each device you turn sync on for keeps your key:

in the web app, in the browser’s storage, wrapped by a second key that the browser will use but will not let any script read out;
on iPhone, in the iOS Keychain, set to this device only — it is not copied to iCloud.

Turning sync off on a device, or removing the device from your account, deletes its copy. Someone with your unlocked device can read your catalog through the app, just as they could without Premium; they cannot copy the key itself to another device.

Passkeys, no passwords

Now You sign in to Premium with a passkey, using your device’s Face ID, Touch ID, fingerprint, PIN or a hardware security key. A passkey can’t be guessed, reused on another site, or phished, and there is no password database to leak. Your passkey is stored by your device or your passkey manager (such as iCloud Keychain or Google Password Manager), not by us. The same passkey prompt that signs you in also unlocks your encryption key on that device.

Premium needs a browser or device that supports passkeys with the PRF extension — current Safari, Chrome, Edge, Brave and Firefox, and iPhone with iOS 18 or later. Without that, Syntropium still works fully on the device; it just can’t sync.

If you lose every device

We cannot recover your synced data. If you lose every device that syncs and lose access to the passkey account that signs you in (for example, your Apple Account or Google Account), the encrypted copy on our server can’t be unlocked by anyone — including us. There is no reset link and no support override. This is the price of a server that can’t read your data, and we think it is worth paying, but you should know it before you rely on it.

Losing one device is not a problem: your other devices still have everything, and you can remove the lost one from Settings. Even losing all of them is not a problem if your passkey is synced through iCloud Keychain or Google Password Manager — sign in on a new device with it and your catalog comes back.

To protect yourself:

Add a second device. A phone and a computer, or a phone and a tablet. Each one is a full copy and can bring a new device back in by pairing.
Keep a backup. Export a backup from Settings now and then (it includes photos) and keep it somewhere that isn’t the device itself. A backup can be imported on any device, with or without Premium.
Keep your passkey account healthy. Know how you sign in to iCloud Keychain, Google Password Manager or your password manager, and keep its recovery options up to date. That is what brings your passkey to a new device.

Whatever happens to sync, the catalog on each device you still have stays yours. Turning sync off, or losing it, never deletes what is in front of you.

Your email address

Now The sync service has no place to store an email address. Accounts are identified by a random ID and signed in with a passkey; you never type an email to sign in.

Now During the beta, nobody pays. Beta invitations are made out through a small billing service that we run ourselves, on our own server but separate from the sync service. It holds the email address an invitation was sent to, and it is the only part of Syntropium that does.

Commitment When Premium goes on sale, payments and email move to a payment provider that acts as the seller (we intend to use Lemon Squeezy). From then on, your email address lives with them, not on our servers, and messages about your subscription come from them. The sync service still won’t hold it. We will update this page when that happens.

Complimentary accounts

Now The person who runs Syntropium and a small number of beta testers have permanent complimentary (free) Premium accounts. They get the same end-to-end encrypted sync as anyone else, with the same limits and no extra access to anything. Their data is encrypted in exactly the same way. Complimentary accounts exist to say thank you and to let us use the product every day; they are disclosed here so they are not a hidden tier. We don’t name the testers.

How you can check our claims

A privacy promise should be something you can check, not only something you are asked to believe. We have committed to:

Commitment Publishing the encryption code. The sync engine — the part that encrypts, decrypts and merges your data on every device — will be open source under the MIT licence before Premium goes on sale.
Commitment An independent review. An independent cryptographer will review the encryption and sign-in design before Premium goes on sale, and the findings will be published here.
Commitment A full audit later. A formal third-party security audit before the next major version, with the report published in full.
Commitment A security disclosure policy with a way to report problems, published before Premium goes on sale.
Commitment A yearly transparency report, starting a year after public launch, listing any legal requests we received and what we provided.

If anything on this page stops being true, we will change the page before the change takes effect — not after. Questions are welcome at hello@syntropium.app. The formal versions are the draft privacy policy and terms.