Your documents, where you sleep, what you do and your booking references are locked on your iPhone before they leave it. We keep them for you, and we cannot open them.
Every trip has its own key, made on a phone and kept in the Keychain, the place your iPhone keeps passwords. When you add a hotel, a plan, a seat or a passport scan, your iPhone locks it with that key and only then sends it. Our server receives a locked box. It can store the box and deliver it, but it never has the key.
Locks the stay, the plan or the document before it sends it.
Stores it and passes it on. It has no key, so it cannot open it.
She is on the trip, so her phone can open it all.
This is what "end to end encrypted" means: your plans and documents are only readable at the ends, on the phones of the people on the trip. A document you mark "Only me" is locked with a key that is yours alone, so not even the people you travel with can open it.
An invitation link lets somebody join a trip. It does not give them the key. Somebody already on the trip has to let them in. So a link that ends up in the wrong hands shows the trip's outline, like its dates, stops and flights, and nothing that is locked. Nobody waiting to be let in can hand out a key of their own, and a phone that already has the trip only takes a new key that comes from the one it holds.
She joins the trip and sees its outline, like the dates, stops and flights. Everything private still reads "Locked".
Their phone hands Ana a copy of the key, locked so only her phone can use it.
The plan, the bookings and the shared files. Our server passed the key along without being able to use it.
When somebody leaves the trip or is removed, the key changes. Everything shared is locked again with the new one, so what you add afterwards stays out of their reach.
Each trip has a security code: twelve groups of numbers, in the trip's menu under Security. Everyone on the trip should see the same code. Each phone puts its own key into the number, so if the numbers match, your phones agree on who is on the trip and on each person's key. Scan the code on the other phone, or read the numbers out loud.
A few things are not locked, on purpose, because the app needs them to work.
Want the details? Read the technical specification, with every key, algorithm and diagram.
