Sync and sharing

One note, on an iPhone and an Android phone

Condei 5 min read

The same Condei note open on a Mac, an iPhone and an Android phone, with the checklist in the same state on each.
On this page

Condei is a notes app for iPhone, iPad, Mac and Android. Your notes are written in Markdown, stored on your device, and synced between your devices. Which route a note takes depends on the devices you own, and one of those routes is a paid one, so this post lays out all three plainly.

The apps are coming soon to the App Store and Google Play. This is how they work.

The notes live on your device first

Condei works offline. Your notes live on your device, and syncing is what happens on top. Edits made offline sync when you reconnect.

Whichever route a note takes, it is encrypted on your device before it leaves it. Everything that travels, and everything that is stored along the way, is sealed.

Between Apple devices: iCloud

Between your Apple devices, notes sync through your own private iCloud database. Condei encrypts them before iCloud sees them, so Apple stores sealed records and not your notes.

This route does not involve our server at all. An iCloud vault never depends on Condei's servers, and it is free.

A second Apple device needs the key as well. On Apple devices that use iCloud sync without a Condei account, a copy of the master key is placed in your iCloud Keychain, which Apple encrypts end to end, so your other Apple devices can open the same notes. Apple encrypts iCloud Keychain end to end and we never see it, but the key does leave the device it was made on, and we say so. Accounts do not use this route.

Android, and everything that crosses: our server

iCloud is Apple's. It does not reach an Android phone. For Android, and for syncing across the two worlds, notes go through Condei's server.

On Android you can also use Condei without an account. The notes are then kept on your phone, encrypted with a key made on it, and nothing about them is sent to us. If you connect a Google account, the app can back the Local Vault up, already encrypted, to Condei's own hidden folder in that account's Google Drive. Google stores it and cannot read it.

With a free Condei account, several Android phones and tablets sync with each other through our server at no cost, just as Apple devices do through iCloud. Only a mix of the two needs Condei Nor.

With an account, the server is a relay, and it stores opaque ciphertext. A device sends the changes it has made since it last synced and receives the changes other devices have made, as sealed items. The server cannot read, index or merge them.

Apple devices sync through your private iCloud database, which has no link to Condei’s server. Android syncs through Condei’s server, and Condei Nor links Apple devices to the same server so the two sides meet there. Between Apple devices, notes sync through your own private iCloud database, encrypted by Condei first, and Condei’s server is not involved; that route is free. Android syncs through Condei’s server. Syncing Apple and Android together also goes through Condei’s server, and that is Condei Nor. There is no link between iCloud and Condei’s server. Your privateiCloud databaseEncrypted byCondei firstFreeApple devicesiPhoneiPadMacAndroidPhoneTabletCondei’s serverStores sealed itemsCondei NorApple with Android Your privateiCloud databaseEncrypted byCondei firstFreeApple devicesiPhoneiPadMacCondei NorApple withAndroidCondei’s serverStores sealed itemsAndroidPhoneTablet
Two routes. iCloud never touches our server; the server route is the one that crosses between Apple and Android.

How a change travels

When you edit a note on your Android phone, the phone seals it and sends it to the server. A device that has the app open holds a live connection to the server, and when another of your devices commits a change the server tells it so. That message carries no note: it is a hint, and the device then runs an ordinary sync pass and fetches what changed. The design aims for a change to appear on screen within about a second.

Notifications work the same way. A push to a sleeping device is a doorbell and never a document, and everything it speeds up also works without it.

A note edited on device A is sealed, sent to the server, announced to device B as a hint, then fetched and opened on device B. Device A seals the edit and sends it to the server, which stores it without reading it. The server then sends device B a hint that something changed. The hint contains no note. Device B asks for what changed, receives the sealed item and opens it with its own key. If the hint is lost, the next sync pass fetches the change anyway. Device A(editing)Condei’s serverDevice BYou edit the note.The device seals it.1sealed item2Stores the sealed item.Cannot read it.3Hint: something changed4Asks for what changed5sealed itemThe device opens itwith its key.The hint carries no note.If it is lost, the next sync pass fetches the change anyway. Device A(editing)Condei’sserverDevice BYou edit the note on deviceA. The device seals it.1It sends the sealed item tothe server.2The server stores the sealeditem. It cannot read it.3Hint: something changed. Itcarries no note.4Device B asks for whatchanged,5receives the sealed item,and opens it with its key.The hint carries no note. If it islost, the next sync pass fetchesthe change anyway.
A change moving from one device to another. The note is only ever sealed on the wire and on the server.

Attachments take the same care. Each one is encrypted on your device under its own key and uploaded as ciphertext. A single attachment can be up to 100 MB.

When two devices edit the same note

If you edit the same note on two devices before they have synced, Condei keeps both. The newer edit stays as the note, the older one is filed beside it with "conflicted copy" and the device and date in its title, and you decide what to keep. Nothing is silently overwritten.

Our server cannot do the merging for you, even in principle, because it only ever sees ciphertext. Any merging has to happen on your device, after decryption.

Condei Nor

Condei Nor is the optional subscription that syncs across Apple and Android together. It is hosted, end-to-end encrypted sync, and nothing else about writing is held back for it. History, locked notes, boards, tables and reminders are free in every vault.

One Condei Nor subscription works on every platform. If you change platform you are not asked to buy a second one.

Condei Nor's launch prices are £3.99 a month, or £29.99 a year with a one-month free trial. The trial is once per person and only on the annual plan. Your App Store or Google Play shows your own local price and taxes, and you subscribe and cancel there. The full details are on the pricing page, and there is more about the product on the Condei Nor page.

For an Apple user who buys an Android phone, the move is to bring the vault into a Condei account, and that is what Condei Nor pays for.

Getting your key to the new phone

A synced note is only useful if the new device can open it. Sign in on the Android phone, then choose Approve from another device. Both screens show the same six-digit code. You check that they match, then approve on the device you already have. It takes under a minute, and you never type your recovery code.

Our server relays the request, but the key itself travels sealed, so what we hold is a public key exchange and a blob we cannot open.

If no other device is to hand, Use your recovery code gets you in instead. We cover it in a separate post.

Sharing across the two worlds

Condei Nor. You can share a note or a folder with up to three people and write in it together. Shared notes are end-to-end encrypted: the people you share with can read them, we cannot. Editing a shared note needs Condei Nor for the person editing, and anyone without it can still read.

If you stop

If Condei Nor ends, nothing is deleted. Your account carries on as a free account, and devices of the other platform can download your notes for 90 days. Ending a subscription pauses the hosted service. It does not make the notes on your devices unreadable.

The routes at a glance

Your devicesHow notes move
Apple devices onlyYour private iCloud database, encrypted by Condei first. Free.
Android devices onlyCondei's server, as sealed items, with a free Condei account. Or a Local Vault on one phone, with no sync.
Apple and Android togetherCondei's server, with Condei Nor.

Neither route gives us a key. That is the same promise as in the first post: the server carries notes it cannot read, whichever phone they came from.