1. Zero-Knowledge Guarantees
In Hearthly, privacy is mathematically guaranteed rather than policy-promised. All confidential assets—vault passwords, notes, calendar details, and inbound messages—are sealed on the client using AEAD primitives before leaving the device.
Ciphertext Boundary
Lod Softworks servers function purely as an untrusted blind rendezvous, relay, and encrypted ciphertext store. The server has no knowledge of your master keys, no ability to decrypt payloads, and no recovery backdoor.
2. Key Hierarchy & Hearth Leases
Each hearth maintains an independent cryptographic root. Joining a hearth grants a signed, revocable hearth key lease:
- Device Keypair: Generated locally during bootstrap and guarded via platform hardware keystores (Android KeyStore, Apple Secure Enclave, or Windows DPAPI).
- Hearth Symmetric Lease: 256-bit AES-GCM or XChaCha20-Poly1305 key rotated upon member revocation or administrative request.
- Inbound Mail Keys: Dedicated public-key mail sealers allow external mail to be encrypted immediately upon arrival at the server boundary before resting on disk.
3. Optical QR Pairing Flow
Pairing child devices or new family tablets avoids passwords and network intercept risk through direct optical handshake:
The inviting guardian displays a high-density optical QR holding a signed single-use invitation challenge.
The joining device scans the code, signs the challenge with its newly minted device key, and seals its public identity.
4. Paper Recovery Kits
Because Hearthly has no master corporate backdoor, account recovery is anchored in physical reality. When creating a hearth, owners receive a print-ready Recovery Kit:
- 01. Perforated, numbered seed phrase fragment cards
- 02. JetBrains Mono glyph differentiators (no 0 vs O confusion)
- 03. Multi-signature guardian approval for emergency recovery