Security
How Cairn protects your location, and an honest list of what the server can still see.
The encryption
- Your identity is a key pair made on your phone. The private key never leaves it. There's no email, phone number or password.
- Locations are end-to-end encrypted with X25519 key agreement and ChaCha20-Poly1305, separately for each person you share with. Only they can decrypt it.
- Your display name is encrypted too, so the server doesn't know what you're called.
- Your location history is encrypted to you alone. Nobody else can read it, including us.
- All traffic to the server uses HTTPS.
Pairing
You pair by scanning each other's QR code in person, or with a one-time invite code that expires after 24 hours. A key that arrives over the server can never quietly replace one you checked in person, so a server can't slip its own key in. If a contact's key changes unexpectedly, Cairn stops sending them updates and asks you to scan their code in person again.
What the server can and can't see
| Data | Can the server read it? |
|---|---|
| Your location | No, it's end-to-end encrypted |
| Your display name | No, it's end-to-end encrypted |
| Your location history | No, it's encrypted to you |
| Your public key | Yes (it's a random-looking identifier) |
| Who you're paired with, and how precisely you share with each | Yes |
| Who sends locations to whom, and when | Yes |
| When you were last active | Yes |
| Your IP address | Yes, like any server you connect to |
To give away less about your movements, Cairn sends updates on a fixed schedule rather than when you move, and pads updates so their size doesn't give away whether you're on the move.
What this protects against
- A curious or compromised server can't read where you are, what you're called, or your history.
- It can still see the "who and when" in the table above. Hiding who's connected to whom is a goal for the future, and it's harder than hiding content.
- Your IP address is visible to the server. If that matters to you, connect through a VPN.
- For full control, run your own server. Then nobody else sees even the metadata.
Reporting a vulnerability
Please email dev@cappylabs.uk with details, and give us a chance to fix it before you publish. Our security.txt has the same details. The code is public: github.com/CappyTech/cairn.