The operating system is local and verified. Only your identity roams — encrypted, restored on login, wiped on power-off.
Boot a local, verified OS.The phone runs an ordinary, content-addressed, OTA-updated OS based on LineageOS — stored on the device, verified at boot. It is not netbooted.
Blind-login your profile.A name + passphrase derive your keys. A wrong credential or unknown profile is indistinguishable from a typo — there is no profile list to leak.
Your state re-materializes.App list, app data, accounts, settings and files are restored from the encrypted store into a fresh, ephemeral space. App code is re-downloaded per device.
Run, replicating encrypted deltas.While you use it, changes are continuously encrypted and synced to the store — client-side, with keys that never leave the phone.
Power off → blank slate.The ephemeral data is sealed to the store, then wiped. The device holds nothing of yours at rest; log in on any nowhere device to get it all back.
Two editions, one roaming store
Diaspore (Fairphone · based on LineageOS) is available now; Endospore (Pixel · based on GrapheneOS) is the hardened edition coming later. Both share the same accountless, zero-knowledge store and prepaid credits.