Sync we can't read: how Privt ID works

Privt Voice Pro syncs your notes across devices through our servers — and we cannot read a single one of them. Not "we don't," not "we promise not to." Cannot. Here's the machinery behind that sentence.

Keys wrap keys

Your vault has a root key, generated on your Mac and protected by its Secure Enclave. Every note is encrypted with its own fresh key, wrapped by keys that chain up to that root. When you upgrade to Pro, you choose a passphrase — and that passphrase, run through a deliberately slow derivation (Argon2id, about a second of your Mac's full effort), wraps a copy of your root key. That wrapped copy is what our servers store.

What travels to us: sealed blobs. What never travels: your passphrase, your root key, any key that opens anything. Even login never carries the passphrase — you prove you know it with a derived verifier, the same pattern Bitwarden uses.

The consequences, stated plainly

We cannot reset your passphrase, because we never have it — your recovery phrase is the escape hatch, and it never leaves your hands either. A subpoena served on us yields sealed blobs and the minimal metadata sync requires: sizes, timestamps, an email. And deletion means destroying keys, not just data — ciphertext without its key is mathematically gone.

Privt ID is built to be the identity layer for everything we make next. One account, held together by keys we can never touch. What we can't read, we can't lose, sell, or be forced to hand over.