How it works
The mark is the argument. An iceberg: a small tip above the water, an enormous mass beneath. The tip is what a family sees — a warm, simple app. The mass is everything that makes it sovereign — keys, air-gaps, blind infrastructure — that they never have to understand. The whole product is the discipline of keeping the mass invisible.
We publish the reasoning before the code, so you can argue with the design in the open.
An amnesic, air-gapped Bitcoin cold signer that runs on a spare Android phone.
A warm family wallet — watch-only for savings, gated by your identity, not an email.
Your identity signer — holds your keys so no other app has to.
The same signer, always-on, for the shared family identity — self-hosted.
A de-radioed phone OS — an air gap the hardware enforces, not a setting you remember.
A hardware wallet asks you to trust a company, a supply chain, and a sealed box you can't inspect. Our signer asks for none of that. It runs on an old phone, wiped and put in airplane mode forever, and forgets everything the moment you close it.
Sovereign isn't a word we ask you to trust — it's a property you can check. Three ideas hold it up.
Money keys live nowhere but the amnesic signer, backed up on physical cards. Small spending money lives on the phone like cash in a pocket. Your identity key controls no money at all — lose it and you rotate to a new name; you never lose a sat. Each key gets exactly the protection its risk deserves.
The parts we run — the relays, the name lookups, the encrypted backups — see only scrambled data. The test is simple: if our servers were seized tomorrow, only ciphertext is lost — no keys, no ability to sign for you, no way into your savings. If that holds, it's sovereign. If it doesn't, it's custody.
Sovereignty is a ladder you walk at your own pace — start convenient, take over the infrastructure as you like, or run everything yourself. The same keys travel the whole way.
| Level | Keys | Always-on | Name |
|---|---|---|---|
| 0 · Convenient | Their phones | — | Hosted name |
| 1 · Always-on | + family bunker (their hardware) | Family-run | Hosted name |
| 2 · Own transit | Family bunker | Family | Their relay |
| 3 · Own name | Family bunker | Family | Their domain |
| 4 · Independent | Everything theirs | Theirs | We are just software |
A family can live at the first level forever and still be sovereign — their keys never leave their phones. The right to exit, keys in hand, is what proves it was never custody: you can leave a service; you cannot leave a custodian.
Everything is free and self-hostable — the code is open, and you can always run it yourself. For families who'd rather not run a server, there's a hosted option where we operate the plumbing but never hold your keys. Either way, you hold your keys, and you can walk away with them anytime. A custodian can't offer you that.
