End-to-end encryption, explained without the jargon
In the first post we said your coordinates are end-to-end encrypted with the Double Ratchet, the same protocol family as Signal. That sentence does a lot of heavy lifting, so let’s slow down and unpack it, no maths degree required.
The postcard and the sealed letter
Encryption in transit, the standard on the internet, protects your position while it’s travelling: on the road, nobody can read it. The limit is at the destination. Your position arrives on the service’s server, where it is decrypted so that the service can process it. From then on, its protection depends on that company’s rules and security. The encryption stops at the server’s door. It’s like sending a letter in an armoured van that is opened on arrival, at the sorting office.
End-to-end encryption goes further: the letter stays sealed even as it passes through the server. Locked on your phone, it only unlocks on your friend’s. Neither the courier nor the company in the middle can open it.
The “ends” are the two phones. The server is just a courier carrying an envelope it can’t open.
A lock anyone can close, but only one person can open
Here’s the clever part that makes it work without ever sharing a secret password.
Each person has a pair of keys: a public one and a private one. The public key is like an open padlock you hand out to anyone, they can snap it shut around a message, but once it’s closed, they can’t reopen it. Only the matching private key, which never leaves your phone, can open it.
So when your friend wants to send you a message, they lock it with your public padlock. From that moment, the only key in the world that can open it is the private one sitting on your device. The courier carrying the envelope is powerless, it has the padlock, but not the key.
Why we use the Double Ratchet
Locking each message once is good. The Double Ratchet does something better: it uses a fresh lock for every single message.
That property has a name, forward secrecy, and the consequence is worth understanding. Even if someone somehow stole the key to today’s message, it wouldn’t help them open yesterday’s or tomorrow’s. Each message has its own disposable lock that’s thrown away after use.
The Double Ratchet is the family of cryptography behind Signal Messenger, WhatsApp’s private messages and Matrix, the messaging network adopted by the French administration and the German armed forces. It’s been studied by cryptographers for years and is widely regarded as the state of the art for private communication. Fenzly uses Olm, the Matrix implementation of it, through vodozemac, an open-source library whose core was independently audited. We didn’t invent our own scheme, rolling your own cryptography is how security disasters happen, we build on the one the experts already trust.
What this means for your location in Fenzly
When you share your position, Fenzly doesn’t upload “Steve is at 46.20, 6.14” to a database. Your phone takes the coordinates, seals them individually for each person you’re sharing with, and only then sends the sealed envelopes through our server.
The server’s job is to pass envelopes along. It can see that an encrypted blob is travelling from one account to another, but not what’s inside. The same goes for your saved places and your circles, they’re sealed on your device before they ever touch the network. We call this the blind server, and it gets its own post next.
What encryption does not do
Honesty matters more than marketing here, so the limits:
Encryption protects a message in transit and at rest on the server, it does nothing for a phone that’s already unlocked in the wrong hands. If someone has your unlocked device, they see your messages the same way you do. The sealed letter is open once it reaches its destination; that’s the whole point.
It also can’t hide that communication happened. The courier knows two accounts exchanged something, even if the contents are opaque. Fenzly is designed to keep even that metadata as thin as possible, more on that in the blind-server post.
And encryption is only as strong as where the keys live. In Fenzly those private keys never leave your phone, which is exactly why backing them up matters so much, lose the phone without a backup and even we can’t recover your account. That trade-off deserves its own article too.
That’s the foundation. Next we’ll open up the blind server: how a location app can run when the company behind it genuinely can’t see where you are.
Updated September 2026: the first version of this article named the Signal protocol. Fenzly has since moved to Olm, the Double Ratchet implementation behind Matrix, whose core library was independently audited. The mechanism described here (a fresh lock per message, forward secrecy, per-recipient sealing) is unchanged.