POV: the security engineer
Most apps that call themselves "private" or "secure" mean something specific and limited by that claim. They mean the connection between your device and their server is encrypted. They mean they're not selling your data to advertisers, at least not directly. They mean they take reasonable precautions.
What they don't mean is that the data doesn't exist on a server somewhere that can be accessed by people who aren't you.
For a secrets app, "reasonable precautions" isn't the right frame. The question is: who can see this data, under what circumstances, and what would it take for that to happen? That's a threat model. Here's the one that matters for Gossip Finder.
The Threat Model: Who Can See Your Secrets?
Every piece of sensitive data has an attack surface — a set of ways it can be reached by someone who isn't supposed to reach it. For a cloud-based app, the attack surface looks like this:
The company itself. Even if they don't look at your data, they could. The data exists on their infrastructure. Engineers with database access, in principle, have the data. Good companies have internal controls that make this unlikely. "Unlikely" and "impossible" are different things.
A breach. Cloud services get breached. The list of major data breaches at well-intentioned companies is long. Your data, encrypted in transit and at rest under the company's key, is only as safe as the company's key management — and keys are frequently part of what gets compromised.
A court order or government request. In most jurisdictions, a company that holds your data can be compelled to produce it. This is routine. The company doesn't have to be malicious; they just have to exist as a legal entity that can receive a subpoena. Companies publish transparency reports documenting exactly how often this happens.
A rogue employee. Insider threats are statistically significant in any organization. Someone with database access and a bad motive is a non-zero risk in any cloud-based system — a variant of the same insider-threat problem that drives corporate mole hunts and produces the leak investigations documented in the case files on this blog.
For a secrets app specifically — an app whose entire function is storing information about who in your friend group you trust with what — this threat model is disqualifying. The information most worth protecting is precisely the information you'd most regret having on a server.
What "No Cloud" Actually Buys
Gossip Finder has no server. This is not a marketing position. There is no server to subpoena. There is no database to breach. There is no employee with access. There is no company infrastructure that holds your data, because your data doesn't leave your phone.
The threat model contracts dramatically:
Remaining threats: someone who has physical access to your unlocked device; someone who knows your PIN; someone who can compel you specifically (as opposed to a company) to produce data.
Eliminated threats: the company (us — we can't see anything), a data breach on our infrastructure, a court order to the company, rogue employees with database access, bulk data requests, advertising partners, any party upstream of your phone.
This is not a claim that the app is unhackable or that your phone is invulnerable. Your phone exists and can be compromised. Those risks are real, but they're a different category — they're about your device security, which is true of everything on your phone, and not specific to this app.
What the app eliminates is the entire class of risks that come from data living somewhere you don't control. The only copy of your trap data lives in an encrypted SQLite database on your device, locked with a PIN stored only as a salted hash, backed by iOS Keychain or Android Keystore, optionally protected by biometric unlock.
How the Encryption Works (Without the Lecture)
The technical implementation uses SQLCipher — an open-source extension that applies AES-256 encryption to the SQLite database at the page level. The key is stored in the platform's secure enclave (iOS Keychain / Android Keystore), not in plain text anywhere.
The export format (.gfb) is also AES-256 encrypted and requires your password to open. If you export a backup and lose the password, the backup is unreadable — including to us.
The 12-word recovery phrase follows the BIP39 standard (the same standard used in cryptocurrency wallets). It's generated on-device and never transmitted. Lose the phone without the phrase, lose the data. That's the trade — and for a secrets app, it's the right trade.
Same trick, in your pocket. Tell each friend a slightly different version — Gossip Finder tells you which one came back.
The Honest Limits
Local-first design solves a specific set of problems. It doesn't solve all of them, and saying so clearly is part of what "literal about privacy" means.
If your phone is physically seized: the encrypted database exists on the device. The encryption is strong, but physical access to a device changes the threat profile. PIN-only devices are more vulnerable than ones with strong device encryption enabled at the OS level — which is a setting you control, not us.
If someone knows your PIN: the vault opens. The same is true of your banking app, your photo library, and your messages. This is a device-security problem, not an app-security problem.
If you share your export file: the export is encrypted with your chosen password, but the file exists once exported. It can be transmitted. You control whether and where you export.
Cross-device sync doesn't exist: because the data lives locally, it lives on one device. There's a deliberate encrypted export/import mechanism, but nothing syncs automatically. This is a genuine limitation if you switch phones frequently. It's also the reason there's nothing to intercept in transit.
On iOS (iCloud backup): a backup taken while Gossip Finder was installed will contain a snapshot of the encrypted database. The encryption remains — the backup is unreadable without your PIN — but the snapshot exists. To ensure complete data removal from iCloud: (1) disable app backup for Gossip Finder before uninstalling, or (2) delete the relevant iCloud backup snapshot after uninstalling. On Android, Gossip Finder opts out of Google device backup (allowBackup: false), so no backup snapshot is created.
None of these are hidden. They're the natural consequences of a design choice that eliminates a much larger class of risks in exchange for specific tradeoffs that you control.
Why Does This Matter Specifically for a Secrets App?
It matters because the data this app stores is uniquely sensitive: records of which friend received which variant, which version came back, who the canary trap pointed to. That information should not exist on a server. Most apps don't need this threat model. A to-do list app with cloud sync is fine. A note-taking app where you can see your notes from any browser is fine. Those apps don't hold information that is, by design, about specific trust relationships in your social life.
Gossip Finder does. Which friend got which variant. Which variant came back. Who the match pointed to. These are records — the same kind that record labels keep about their watermarked promo copies — of your most sensitive social reasoning. The correct place for this data is your phone — not our servers, not our analytics pipeline, not a backup bucket with access logs.
Ink & Switch, the research lab behind the local-first software essay, put it plainly in their foundational 2019 paper: "Cloud apps require trust in the service provider to always be available, not to look at your data, and not to shut down." For most apps, that trust is reasonable. For a secrets app, it's asking too much.
Gossip Finder is offline-only by design, not by accident. There's no server because an app about secrets shouldn't have one.
That's the architecture. You can verify it: there's no server to find.
Sources
- Kleppmann, M., Wiggins, A., van Hardenberg, P., & McGranaghan, M. (2019). Local-First Software: You Own Your Data, in Spite of the Cloud. Ink & Switch. https://www.inkandswitch.com/essay/local-first/
- RxDB. Why Local-First Software Is the Future and its Limitations. https://rxdb.info/articles/local-first-future.html
Scope of use: Gossip Finder is built for your personal social life — friends and family, using information you yourself chose to share. The corporate and institutional examples on this blog are historical case studies. They are not guides for workplace monitoring, employee investigation, legal evidence gathering, surveilling a romantic partner, or accessing any device or account you don't own. For the full ethical framework, see Is It Fair to Set a Trap for a Friend?.
Privacy: Gossip Finder collects no user data. There is no server. All information stays on your device.