Cryptography · August 21, 2026

Sync we can't read: how Privt ID works

Privt Voice Pro syncs your notes across devices through our servers, and we cannot read a single one of them. That is a structural fact rather than a pledge: even with full control of our own systems, we cannot open your notes. Here is the machinery behind that claim.

Keys wrap keys

Your vault has a root key, generated on your Mac and protected by its Secure Enclave. Every note is encrypted with its own fresh key, wrapped by keys that chain up to that root. When you upgrade to Pro, you choose a passphrase, and that passphrase, run through a deliberately slow derivation (Argon2id, about a second of your Mac's full effort), wraps a copy of your root key. That wrapped copy is what our servers store.

The only data that travels to us is encrypted blobs. Your passphrase, your root key, and any key that opens anything never leave your devices. Even signing in never carries your passphrase, because you prove you know it with a derived verifier, the same pattern Bitwarden uses.

The consequences, stated plainly

We cannot reset your passphrase, because we never have it, and your recovery phrase serves as the only escape hatch, one that never leaves your hands either. A court order served on us yields encrypted blobs and the little metadata that sync needs: ciphertext sizes, day-coarse update timing, and a few opaque envelope fields such as a random id, a note-or-meeting type, and a version count. None of that includes your email, your name, or your passphrase. Deletion means destroying keys rather than merely erasing data, and ciphertext without its key is mathematically gone.

Privt ID is built to be the identity layer for everything we make next, a single account held together by keys we can never touch. Data we cannot read is data we cannot lose, sell, or be compelled to hand over.