End-to-end encryption, explained without the jargon
In the first post we said your coordinates are end-to-end encrypted with the Signal protocol. That sentence does a lot of heavy lifting, so let’s slow down and unpack it, no maths degree required.
The postcard and the sealed letter
Most apps do encrypt your position while it’s travelling: on the road, nobody can read it. That’s not where the problem is. It’s at the destination. Your position lands on their server, where it’s decrypted, read in the clear, stored, analysed… and sometimes sold. The encryption stops at their door. It’s like sending a letter in an armoured van that swings wide open the moment it arrives and the destination is them.
End-to-end encryption goes further: the letter stays sealed even as it passes through the server. Locked on your phone, it only unlocks on your friend’s. Neither the courier nor the company in the middle can open it.
The “ends” are the two phones. The server is just a courier carrying an envelope it can’t open.
A lock anyone can close, but only one person can open
Here’s the clever part that makes it work without ever sharing a secret password.
Each person has a pair of keys: a public one and a private one. The public key is like an open padlock you hand out to anyone, they can snap it shut around a message, but once it’s closed, they can’t reopen it. Only the matching private key, which never leaves your phone, can open it.
So when your friend wants to send you a message, they lock it with your public padlock. From that moment, the only key in the world that can open it is the private one sitting on your device. The courier carrying the envelope is powerless, it has the padlock, but not the key.
Why we use the Signal protocol
Locking each message once is good. The Signal protocol does something better: it uses a fresh lock for every single message.
That property has a name, forward secrecy, and the consequence is worth understanding. Even if someone somehow stole the key to today’s message, it wouldn’t help them open yesterday’s or tomorrow’s. Each message has its own disposable lock that’s thrown away after use.
The Signal protocol is the same family of cryptography behind Signal Messenger and WhatsApp’s private messages. It’s been studied by cryptographers for years and is widely regarded as the state of the art for private communication. We didn’t invent our own scheme, rolling your own cryptography is how security disasters happen, we build on the one the experts already trust.
What this means for your location in Fenzly
When you share your position, Fenzly doesn’t upload “Steve is at 46.20, 6.14” to a database. Your phone takes the coordinates, seals them individually for each person you’re sharing with, and only then sends the sealed envelopes through our server.
The server’s job is to pass envelopes along. It can see that an encrypted blob is travelling from one account to another, but not what’s inside. The same goes for your saved places and your circles, they’re sealed on your device before they ever touch the network. We call this the blind server, and it gets its own post next.
What encryption does not do
Honesty matters more than marketing here, so the limits:
Encryption protects a message in transit and at rest on the server, it does nothing for a phone that’s already unlocked in the wrong hands. If someone has your unlocked device, they see your messages the same way you do. The sealed letter is open once it reaches its destination; that’s the whole point.
It also can’t hide that communication happened. The courier knows two accounts exchanged something, even if the contents are opaque. Fenzly is designed to keep even that metadata as thin as possible, more on that in the blind-server post.
And encryption is only as strong as where the keys live. In Fenzly those private keys never leave your phone, which is exactly why backing them up matters so much, lose the phone without a backup and even we can’t recover your account. That trade-off deserves its own article too.
That’s the foundation. Next we’ll open up the blind server: how a location app can run when the company behind it genuinely can’t see where you are.