Architecture
How sync works without a server.
beatrax syncs between your own devices, end-to-end encrypted, with no account and no service in the middle that can read anything. This is roughly how.
The problem with a normal sync
The usual way to sync an app is to put the data in a server and have every device talk to it. That server becomes the source of truth, which means it can read everything, and it means somebody has to run and pay for it forever.
beatrax takes the other route: every device holds a full copy, and they reconcile with each other directly.
Every change is an entry in a log
Rather than syncing the database, beatrax syncs the history of changes to it. Each edit becomes an entry in an append-only log, signed by the device that made it and stamped with a hybrid logical clock so entries from different devices can be ordered consistently even when their wall clocks disagree.
The database is then a materialised view of that merged log — replay the log and you get the same database, deterministically. Two devices that have seen the same entries always arrive at the same state.
Conflicts resolve by rule, not by luck
When two devices edit the same thing while apart, the merge is decided per field by a documented rule rather than whichever synced last. Sets merge as sets; deletions win over concurrent edits where that is the safe answer; imported rows deduplicate on the same fingerprint the import pipeline already uses, so the same statement imported on two devices does not become two ledgers.
Devices prove who they are
- Each device generates its own identity — A signing key and a key-agreement key, created on the device on first run. The private halves never leave it.
- Pairing is deliberate and verified — A new device joins by QR code or a typed word-code carrying a one-time secret, and both screens show a safety number that must match before anything syncs.
- Sessions are mutually authenticated — Paired devices establish a forward-secret encrypted session, so a recorded session cannot be decrypted later even if a key is compromised afterwards.
Direct when possible, relayed when not
Two devices awake on the same network discover each other and sync directly — nothing leaves your home. When one is asleep, changes wait in a store-and-forward relay.
The relay is deliberately incapable of being interesting: it holds ciphertext it has no key for, cannot tell what changed, and forgets it once delivered. It is a mailbox, not a database.
Encrypted where it rests, too
Sensitive fields are encrypted on disk with a key derived from your passphrase and released only when you unlock the app. Removing a device rotates the shared group key and re-wraps it to the devices you kept — so a device you have removed cannot read anything sent after you removed it.
Where this is up to
The merge engine, device pairing, encrypted transport, relay and at-rest encryption have all landed on the development line. Wiring the mobile client as a fully synced peer is the piece still in progress. The roadmap tracks it honestly.