Ghost Sync
The Vault With No Address
Every “private” cloud service makes the same promise: we encrypt your data. Most of them mean it. It still doesn't matter, because encryption was never the weak point — the filing system was. Lock a diary and put it in a drawer with your name on it, and a thief doesn't need to pick the lock. They just need to know which drawer is yours.
Ghost Sync is built so there is no drawer with your name on it.
Not live yet — sync is switched off for the private beta. This page describes how the system is designed and the reasoning behind it. It is not a running service today: during the beta, nothing you write has a path off your device. Sync ships only once it has survived 500 people trying to break it.
No account folder
One pile. No labels.
Picture a single warehouse holding every note from every Ghost Sync user — identical, sealed, encrypted containers thrown into one undivided pile. No aisles. No shelves labeled by owner. No index that says “here are the 4,000 things this person owns.” Just an ocean of indistinguishable locked boxes. Nobody — not an employee, not an intruder, not a legal demand — can point at a cluster of them and say “these belong to the same person,” because there is no cluster to find. Your notes sit in the same undivided storage as everyone else's, with nothing that marks them as yours.
Math, not a directory
You don't need a directory. You need a memory.
So how do you find your own notes in a pile with no labels? The same way you'd find a specific grain of sand if you knew its exact coordinates — math, not a map. Your 12-word is a formula. Feed it in, and it tells you precisely where every one of your notes lives, every time, with mathematical certainty. There is no account to log into and no lookup table for anyone to breach, subpoena, or misuse. The only “directory” that exists is one only you can compute — and it's never written down anywhere but your own device.
Your notes (green) are indistinguishable from anyone else's until your Recovery Seed computes exactly which ones are yours.
No shared master list
Every device keeps its own private journal.
Most sync systems solve “multiple devices, one account” with a shared master list somewhere in the cloud — which means, once again, there's a single object that says “here is everything this person owns.” Ghost Sync doesn't work that way. Every device you use keeps its own append-only journal of what it created or deleted. Nothing is shared or overwritten between devices, because nothing needs to be. Set up a new device and it doesn't ask a server “what does this person have?” — it computes where each of your journals lives on its own and reconstructs your history from them, the same recovery approach cryptocurrency wallets have used for over a decade to rebuild an entire portfolio from nothing but a seed phrase.
Anti-fingerprinting
Nothing looks like anything.
Even a perfectly locked box gives something away if it's a suspicious size or shape. So we're rolling out size-padding: it pads what gets encrypted to match one of a small handful of standard sizes, so a two-word note and a ten-page one look identical from the outside. There is no shape to profile and no size to fingerprint — nothing that would let anyone tell your activity apart from anyone else's just by watching what moves in and out of storage. This hardening is still rolling out, not a finished guarantee yet.
Paying without being identified
You can pay, and we still don't know which vault is yours.
Most services bill by keeping a running tally — “this account used 12MB this month” — and that tally is, by definition, a name tag glued directly onto your data. Ghost Sync's billing is designed around anonymous-credential technology: you prove you're paid up with a small, reusable token, the same category of technology browsers already use billions of times a day to prove “I'm allowed to do this” without revealing who “this” is. The system that checks whether your storage is paid for is built to be mathematically incapable of being connected back to the transaction that paid for it.
Cleanup without an identity to target
Old data doesn't get found and deleted. It fades.
Most cloud services stay tidy with an administrator — or a script wearing one's badge — hunting down abandoned accounts. That requires knowing whose account it is. Ghost Sync doesn't have that option, on purpose. Every stored note carries its own expiration, like food with a sell-by date. If you're actively using the app, it quietly renews your notes before they'd ever expire, spread out on a random schedule so it never looks like one coordinated batch. If an account goes truly silent, its data simply ages out — nobody has to go looking for it, because nobody can.
The honest part
Not vague marketing about “military-grade encryption.”
None of this is running yet — sync is off for the beta — and we would rather say that plainly than imply otherwise. When it does ship, every mechanism above will be built from techniques with a real track record elsewhere: the recovery method crypto wallets use, the append-only logs that power decentralized networks, and anonymous-credential billing already running at internet scale. For the exact cryptographic construction behind the vault itself — the encryption, the key math, what happens if a server is breached — read the full security architecture.