Instead of looking for one security slogan, ask twelve concrete questions.
The short answer
A privacy-conscious shared-home app should explain where content is readable, when it is encrypted, what the server and suppliers hold, what goes into notifications and analytics, how a new device is approved, and how export and account deletion work. The important thing is being able to understand the data flow rather than counting marketing labels.
1. Where is the content readable?
If an app displays a list or document, the device must be able to read that content. Find out whether plaintext appears only on approved devices or also on the service’s servers or administrative systems.
Ask the provider: where exactly is content decrypted?
2. When is the content encrypted?
HTTPS transport encryption and encrypting content before sending it are not the same thing.
HTTPS protects the connection to a server. End-to-end or client-side encryption can mean the server stores ciphertext rather than readable household content. Look for a concrete explanation rather than a padlock icon standing in for the details.
3. What can the server still see?
Even when content is encrypted, a service may need technical metadata: account and device information, membership, ordering of changes or sync timestamps.
Good documentation says this directly. “Encrypted” should not be shorthand for “the server knows nothing”.
4. Does content search stay on the device?
Search can happen locally or depend on a server-side query and index. If a service claims strong content protection, check how search works and whether it creates an additional readable copy of an index outside the device.
5. What is placed in a notification?
Notifications may travel through third-party infrastructure and can be visible on the lock screen. Ask whether they contain task names, amounts, document titles, note excerpts or identifiers tied to a specific household item.
The less content the push mechanism needs, the smaller that data path becomes.
6. How is a new device added?
Simply signing in to an account does not always need to be enough to unlock shared encrypted content. In an end-to-end encrypted system, the device needs a secure way to receive or recover the relevant keys.
Check whether a new device requires approval, a code, QR scan, matching characters or another explicit step.
7. What happens if a phone is lost?
Privacy and recovery pull in different directions. If the provider can always recover every key by itself, it is worth understanding what the end-to-end encryption claim really covers. If recovery is impossible, users need to understand the risk of permanent data loss.
Look for a documented recovery process and a way to revoke a lost device.
8. How does export work?
Export should be a deliberate operation. If you can download a readable ZIP or file, that copy is no longer protected by the app’s normal controls and you need to know where it is being saved.
It is useful when a service clearly distinguishes a readable export from an encrypted one and explains the consequences of each.
9. How are an account and shared data deleted?
In a two-person household, one account and the shared space are not the same thing. Deleting one person should not silently erase the other person’s account, but a former member should not keep access indefinitely either.
Read the rules for separation, export windows, retention and final deletion.
10. What enters analytics?
“Anonymous analytics” can mean many different things. Check whether the analytics system receives titles, amounts, document identifiers or other domain data.
A privacy-focused usage-study model can restrict events to a predefined allowlist and keep analytic identifiers separate from a person’s sign-in identity.
11. Which suppliers process data?
Notifications, authentication, hosting, error handling and support email may involve different suppliers. A privacy policy should explain their roles and the kinds of data involved.
Do not assume that end-to-end encryption eliminates every other technical data flow.
12. Can the provider describe the limitations?
This is one of the strongest trust signals. Useful documentation explains not only what is protected, but also what is not.
Examples of honest boundaries include:
- content is readable on an unlocked approved phone;
- the device lock screen and device security still matter;
- technical metadata may be processed separately from ciphertext;
- a readable export must be protected by the user;
- encrypted content does not remove the provider’s legal and operational responsibilities.
How Home Cadence describes its design
The Home Cadence design requires domain content to be encrypted on the device before transport and server storage. The local database is intended to be encrypted, content search is intended to run on the device, FCM is intended to carry only a SYNC_REQUIRED signal, and a new device is intended to require approval before it can access shared content.
The server is still expected to hold necessary technical metadata and ciphertext. We therefore do not use a claim such as “nothing leaves your phone”.
This describes the canonical product design and the boundaries of the pilot being prepared. Before public use, every claim must match the verified runtime.
Copyable checklist
Before creating an account, check:
- where content is readable;
- when and where it is encrypted;
- which metadata the server can see;
- where search runs;
- what push notifications contain;
- how a new device is approved;
- how recovery and revocation work;
- which export options exist;
- how account and shared-data deletion work;
- what enters analytics;
- which suppliers process data;
- whether limitations are described as clearly as benefits.
Questions
Does end-to-end encryption mean no data reaches the server? No. It can protect content while the service still processes ciphertext and technical metadata required to operate.
Can a push notification be privacy-conscious? It can be limited to a neutral signal. Technical delivery data still exists around the notification channel.
Does encryption mean the phone itself no longer needs protection? No. An unlocked device has to decrypt content to display it. Screen lock, updates and access control still matter.