The blind server: how a location app can't see your location

In the previous post we explained end-to-end encryption with an image: your data travels as a sealed envelope that only the recipient can open. That raises an obvious question about the company in the middle, us. If everything is sealed, what does our server actually see?

The short answer: almost nothing. We call it the blind server, and it’s the single design decision the whole app is built around.

Plenty of apps promise they “won’t look” at your data. That’s a policy, it depends on the company keeping its word, on no employee going rogue, on no government order, on no database breach. A promise can be broken.

Fenzly is built so that there’s nothing to look at in the first place. The server can’t read your location, because it never receives it in readable form. That’s a stronger guarantee than a promise: it doesn’t rely on our good behaviour, it relies on maths.

What the server actually stores: opaque blobs

When you share your position, your phone seals the coordinates for each recipient before anything leaves the device. The server receives a scrambled block of bytes and its only job is to hand it to the right account. It can see that an encrypted blob is on its way from one account to another, it cannot see what’s inside.

These blobs aren’t even kept around. Live location updates pass through a temporary relay with a short expiry: once delivered (or once the sharing session ends), they vanish. There’s no historical map of everywhere you’ve been sitting in our database, because we never build one.

Your places and presence never leave your phone

This is where Fenzly goes further than most. Your saved places, home, work, a child’s school, have a name, coordinates and a radius. All of that is encrypted individually for each person you share the place with.

The same is true for the “who’s where” logic. When Fenzly notices you’ve arrived home, that detection happens entirely on your phone. Your presence, in or out of a zone, is never reported to the server. It’s computed on the device, and only the people you’ve chosen to share with ever find out, through sealed events.

Even your contacts are invisible

Most apps know your entire social graph: who your friends are, who’s in which group. Fenzly is designed so the server can’t reconstruct that map.

Your contacts live only on your phone, they’re never uploaded. And the structure of your circles and shared places lives on your device too, not in our database. We removed the server-side tables that used to hold membership entirely, which means the server is now structurally unable to answer “who is in Steve’s family circle?”, the information simply isn’t there to query.

The honest part: what the server still sees

Marketing would stop here. Honesty shouldn’t.

A blind server is blind to content, not to the fact that traffic exists. To route a sealed envelope, the server has to know which account it’s going to, and roughly when. So it can see that two accounts are connected and that they exchanged something at a given time, even though the something is unreadable. This is metadata, and no end-to-end system can reduce it to exactly zero while still delivering messages.

What we can do is keep it as thin as possible: ephemeral relays, no content logs, no location history, no social graph. Even address search goes through a proxy on our side, so when you look up a street the third-party map service never sees your IP or what you typed, only our server does, and it doesn’t keep it.

Why build it the hard way

A blind server makes everything harder for us. We can’t add a feature by quietly reading your data, we can’t recover your account from our side if you lose your phone without a backup, and we can’t show you a clever server-side summary of your movements. Every one of those has to be solved on the device, or not at all.

We think that’s the right trade. An app that can’t betray your location is worth more than one that politely promises not to.

Next we’ll look at a surprising side effect of putting everything on the device: Fenzly keeps working when your network doesn’t.