Ghost Sync
The Vault With No Address
Every “private” cloud service makes the same promise: we encrypt your data. Encryption matters, but it is not the whole story — the filing system matters too. Lock a diary and put it in a drawer with your name on it, and a thief doesn't need to pick the lock. They just need to know which drawer is yours.
Ghost Sync is designed so there is no drawer with your name on it.
Off by default, unaudited — read this as design. This page describes how the system is designed and the reasoning behind it. Ghost Sync is compiled into the source, but every in-app switch starts off, nothing is sent until you turn it on, and our scripted release builds leave it out unless we choose to include it. The relay code is live and has had no independent audit, and we have not verified every property below against it. A successful beta is not a guarantee of security.
No account folder
One pile. No labels.
Picture a single warehouse holding every note from every Ghost Sync user — sealed, encrypted containers in one undivided pile. The design has no aisles, no shelves labeled by owner, and no index that says “here are the 4,000 things this person owns.” Just a lot of similar-looking locked boxes. The goal is that an employee, an intruder, or someone with a legal demand would find it hard to point at a cluster of them and say “these belong to the same person,” because the design leaves no obvious cluster. Your notes are meant to sit in the same undivided storage as everyone else's, with nothing that marks them as yours. Metadata such as timing, size and your IP address could still reveal something to the relay and to Cloudflare.
Math, not a directory
You don't need a directory. You need a memory.
So how do you find your own notes in a pile with no labels? The same way you'd find a specific grain of sand if you knew its exact coordinates — math, not a map. Your 12-word is a formula. Feed it in, and it is designed to tell your device where your notes live, deterministically (for a Key Chest vault, the lookup comes from a random key instead). The design has no account to log into and no lookup table for us to hold. The only “directory” is one your device computes from your words, and it is not designed to be written down anywhere else.
In the design, your notes (highlighted) are meant to look like anyone else's until your Recovery Seed computes which ones are yours.
No shared master list
Every device keeps its own private journal.
Many sync systems solve “multiple devices, one account” with a shared master list somewhere in the cloud — which means there's a single object that says “here is everything this person owns.” Ghost Sync is designed differently. Every device you use keeps its own append-only journal of what it created or deleted, and nothing is meant to be shared or overwritten between devices. When you set up a new device, it is designed not to ask a server “what does this person have?” — it computes where each of your journals lives and reconstructs your history from them, an approach similar to how cryptocurrency wallets rebuild a portfolio from a seed phrase.
Anti-fingerprinting
Nothing looks like anything.
Even a perfectly locked box gives something away if it's a suspicious size or shape. So we pad: before encryption, each item is padded up to one of seven standard sizes, from 1 KiB to 5 MiB, each four times the last, so a two-word note and a ten-page one look much more alike from the outside. The sizes still step up, so a very large item remains distinguishable. The aim is to reduce what anyone could learn about your activity by watching what moves in and out of storage. Timing and volume are not hidden, there is no cover traffic, and this hardening is not independently reviewed.
Paying without being identified
Designed so you can pay without us linking payment to a vault.
Most services bill by keeping a running tally — “this account used 12MB this month” — and that tally is, by definition, a name tag glued directly onto your data. Ghost Cloud meters something else: a monthly write allowance (a pass covers at most 24 bundles, about 258 MiB of writes a month), not the bytes you keep stored. No storage size is promised. Your app makes and blinds the pass id itself, using a blind signature, so the desk that sells passes never sees it. We keep no link between your payment and your notes. What is not yet closed: network addresses and timing, and while few people subscribe, timing could narrow who a pass belongs to. Paid plans are not launched, and the first launch is a free monthly allowance. Payment providers keep their own records of payments. The full list of what each part knows is on the privacy page.
Cleanup without an identity to target
Designed so old data isn't hunted down. It fades.
Most services stay tidy with an administrator — or a script wearing one's badge — hunting down abandoned accounts. That requires knowing whose account it is. Ghost Cloud is built without that option, on purpose. Your device is the master copy. A relay copy expires 90 days after its last write unless it is refreshed, and reading, restoring, exporting and deleting never stop. If you're actively using the app, it renews your copy before it expires, so a quiet vault ages out without anyone needing to look for it. Keep your own backups of anything you cannot afford to lose.
The honest part
Not vague marketing about encryption strength.
None of this is switched on by default and none of it has had an independent audit, and we would rather say that plainly than imply otherwise. The mechanisms above are meant to be built from techniques with a track record elsewhere: the recovery method crypto wallets use, append-only logs, and anonymous-credential billing. That does not make this design free of flaws, and this page is not a warranty or a guarantee of security. For the cryptographic construction behind the vault itself — the encryption and the key math — read the full security architecture.