The honest version of the privacy claim — what we keep, how your keys are custodied, and how to read and rebuild the exact OS you're running. We can't decrypt content we never hold the keys to; here's the detail, and how to check it yourself.
We do keep ordinary operational records — here's exactly what, and what we never hold.
| Data | Where | Kept for |
|---|---|---|
| Waitlist email | Identified side, separate from the store | Until you unsubscribe / delete |
| Billing & payment | Identified side + processor | As required for tax / accounting |
| Support tickets | Identified side | Support retention window |
| Store objects | Encrypted, content-addressed in the network | While leased; reaped after |
| Store metadata (sizes, refs, timestamps) | Gateway ledger | While leased |
| Your content (plaintext) | nowhere never holds it | — |
| Usage ↔ payment link | Designed not to exist (blind tokens) | — |
What may be producible under legal process is covered in our law-enforcement policy. [placeholder — counsel review before publishing.]
Your keys are derived from your passphrase on the device, per device. They live only in the running session's memory — nowhere never receives them — and on power-off the session and its keys are wiped from the handset. The tokens you spend to keep data alive are blind-signed, so the gateway can't link your usage to your payment.
Your encrypted data can't be recovered — not by you, not by nowhere. There is no master key and no reset.
Your data roams; hardware-rooted trust can't. Anything that's just data on the device — apps, their data, messages, files, settings, accounts — seals to the store and restores on login. What stays put is the small set of things deliberately bound to one physical device for security.
| What | Roams? | Why |
|---|---|---|
| Messages, call log, contacts | Yes | Just data (system databases). |
| Files, photos, notes, settings | Yes | Just data. |
| Most apps (games, readers, browsers…) | Mostly | App data roams unless the app pins a hardware-backed key. |
| WhatsApp / Signal | Chats yes, login no | History roams; the account is registered to a device, so it re-verifies per phone. |
| Banking / payments | No | They check device attestation + hardware-bound keys, which don't move. |
| DRM video (e.g. Netflix HD) | No | Per-device media keys. |
| Authenticators / passkeys | No | Device-bound by design — that's the point of them. |
Your messages, call log, and contacts roam (they're data). Your phone number, SIM / eSIM, and carrier service do not — they belong to the physical SIM and your carrier, not to nowhere. Log in on another phone and your message history is there, but calls and texts over the cellular network use whatever SIM is in that handset. nowhere never roams or provisions your number.
The OS, the client, and the architecture are open (Apache-2.0). Every release ships its source snapshot plus a signed image with SHA-256 checksums, so you can read the exact code for the version you're running and rebuild it to confirm the image matches — you don't have to take our word for it.
For the whole picture — components and trust boundaries, the key model, an adversary → what-they-get table, and an honest list of what nowhere does not defend — read the architecture & threat model, published with the source.