Why I built a watch app I cannot read

A watch collection is a strange thing to keep records about. The records are boring on their own: purchase dates, service intervals, serial numbers, what you paid. But put them together and they describe something most collectors never say out loud. What your collection is worth. Where it lives. What you are hunting for next.

That is exactly the data a collection app asks you to hand over. And most apps in this space store it the ordinary way: plaintext rows in a database, readable by the company, its employees, its analytics pipeline, and whoever eventually acquires it.

I did not want to build that. So the private records in Reveliers are encrypted on your iPhone before they are stored anywhere. Wear logs, prices, stories, service records, insurance details, saved collection photos. Each record is sealed on your device with AES-256-GCM and a fresh nonce, using a key that is generated on your phone and lives in your iCloud Keychain. The key never reaches my server. What my server holds is opaque ciphertext.

The honest version of the pitch is one sentence: I cannot read your vault, and I built the architecture so I cannot.

Why bother, for watches

Three reasons, in the order they convinced me.

The first is theft. A readable database of collections is a shopping list with home addresses attached, one breach away from being public. An encrypted vault is not. If someone stole the vault tables tomorrow, they would have ciphertext and no key.

The second is incentives. If I can read your data, then someday there is a product meeting where reading your data is the growth idea. Aggregate valuations, "market insights," a partnership with an insurer or a marketplace. The only reliable way to lose that meeting is to make the data unreadable before it arrives. Encryption is not a policy I promise to follow. It is a capability I removed from myself.

The third is that collectors already behave as if this matters. Watch people crop wrists out of photos, blur serial numbers, and post "one of my grails" instead of "here is my safe." The instinct is correct. Software should match it instead of fighting it.

What this costs

End-to-end encryption has a real trade-off and I would rather state it than have you discover it. If you lose access to your Apple ID, with no other Apple devices and no Apple recovery contact, your vault becomes permanently unreadable. There is no back door for me to open, because there is no back door. That is the whole point, and it cuts both ways.

Two things soften this in practice. iCloud Keychain syncs the key across your own Apple devices, so a lost phone is not a lost vault. And the export tools exist partly for this reason: you can generate PDF and CSV copies of your records whenever you want, and keep them wherever you keep important papers.

What is not encrypted, and why

I want to be precise, because "end-to-end encrypted" gets used loosely. The vault is encrypted. Community content is not, because it cannot be: posts, comments, your profile, and the photos you choose to share are meant to be seen by other people, and the server has to read them to show them. Saved searches are also readable by the server, because matching them against the catalog happens server-side. The line is simple. Things you keep are sealed. Things you publish are public. The app never moves something across that line without you choosing it.

Identify photos deserve their own sentence: they are processed to produce the match suggestions and they are not retained.

The bet

The bet behind Reveliers is that trust is the product. Not a feature on a pricing page, the actual product. A collection record is only useful if it is complete, and it is only complete if you are comfortable writing everything down. Nobody writes everything down in a notebook the landlord can read.

So the notebook is sealed. That is the design, and it is the part of the app I am proudest of.