Encryption.

Everything shared in your group is end-to-end encrypted. This page explains how that works, in plain terms. What we do with data more broadly is covered in the Privacy Policy.

1. Encrypted before it leaves your device

   When you post anything to a group, your device encrypts it first, and our servers only ever receive the encrypted result. That covers everything shared in your group: group name, messages, reactions, commitments, check-ins, events, and profiles. Fellowing can’t read any of it, even if we wanted to (we don’t).

2. Every group holds its own key

   Each group has its own encryption key. When an admin approves you into a group, that key is shared with you in a way only your devices can unlock. Reading the group’s content requires the key, and only members hold it. Our servers never do.

3. When someone is removed

   The group’s key rotates: a new key is created and shared with the remaining members, so everything shared from that moment on is sealed off from the person who left. The group also disappears from their app. Still, it’s safest to assume that what someone could already read, they could keep; encryption can’t reach back and unshare it.

4. Every change is signed

   Everything you write is signed with keys only your account holds, so your group always knows who made what changes. A check-in from you can only have come from you.

5. You hold the keys

   Access to your account’s keys is controlled by a passkey or a recovery phrase. The passkey is created by your device, protected with Face ID, fingerprint, or your device PIN, and can sync with iCloud or a password manager so you can use Fellowing across your devices. The recovery phrase is 24 words that encode the same key, shown only on your screen and kept wherever you choose. Neither ever touches our servers. That’s why we can’t read your data, and it’s also why we can’t reset either one.

6. What our servers actually do

   They store and relay encrypted data, and they hold no group keys. The small amount of technical metadata they handle in readable form (connection and delivery plumbing, never names or content) is listed item by item in the Privacy Policy.

7. Built in the open

   The encryption is implemented by our fork of Jazz, an open-source sync engine that implements a novel but simple protocol using proven cryptographic primitives. You can read the protocol documentation and the code rather than take our word for any of this. Questions or concerns: email security@fellowing.com.