Zero knowledge, explained without the cryptography

Zero knowledge, in the sense used by consumer software, means the service provider cannot see what you store with them. Not that they promise not to look. That they are structurally unable to.

The cryptography is genuinely complicated. The idea is not, and you can evaluate a claim without understanding the mathematics.

The hotel safe analogy, and where it breaks

The usual explanation is a hotel safe: you choose the code, the hotel cannot open it.

It is a decent start and it hides the important part, which is that hotels keep a master code. Almost every system that looks like zero knowledge has some equivalent, usually introduced for a good reason, and the whole question is whether one exists.

The better test is simpler. If you lose everything, can they get your data back? If yes, they can read it. There is no arrangement in which a company can restore your content without being able to access it.

Recovery and privacy are in direct tension. Any service that can fully recover your data can also read it.

What the key situation actually determines

There are three realistic arrangements.

The company holds the keys. Everything works smoothly. Password resets restore your content, search works on the server, you can log in on any device. The company can read everything.

The keys are derived from your password and held only on devices. The company cannot read content. Losing the password means losing the content, unless there is a recovery mechanism, and any recovery mechanism is where the compromise lives.

The keys are generated on the device and never leave it. Strongest, and it makes moving to a new device something the user has to participate in rather than something that happens invisibly.

How to test a claim

Try a password reset. If your history is intact afterwards and you were not asked for any other secret, the company holds the key.

Look for a warning. Products with real end to end encryption warn you, repeatedly and slightly annoyingly, that lost keys mean lost data. Marketing that promises both perfect privacy and effortless recovery is describing something that does not exist.

Check whether search happens on the server. Instant search across years of history, on a new device, before anything has downloaded, means the server can read it.

Look for a published protocol or an independent audit. Not proof by itself, and their absence is informative.

What it costs

Worth being direct about, because vendors who only list benefits are selling something.

Lost data is permanently lost. Server-side search is unavailable or limited. Adding a device requires a real step. Web access is harder. Support cannot look at your account to diagnose a content problem. And features that need the server to understand content, including most AI features, either do not work or have to be moved onto the device.

Where Duoheart sits

Questions, answers, messages and calls are encrypted on the device with a key generated there and never sent to our servers.

Which means the costs above are ours too. We cannot recover a couple's content for them. We cannot search it. Support cannot look at what you wrote, which occasionally makes support conversations more awkward than they would otherwise be.

Optional AI features work only on text a user explicitly submits for that purpose. The encrypted conversation is not sent anywhere, because we could not send it even if we wanted to.

The short version

Ask one question: if I lose my password and my phone, can you get my content back? The answer tells you everything the marketing page does not.