How it works

The operating system is local and verified. Only your identity roams — encrypted, restored on login, wiped on power-off.

  1. Boot a local, verified OS. The phone runs an ordinary, content-addressed, OTA-updated OS based on LineageOS — stored on the device, verified at boot. It is not netbooted.
  2. Blind-login your profile. A name + passphrase derive your keys. A wrong credential or unknown profile is indistinguishable from a typo — there is no profile list to leak.
  3. Your state re-materializes. App list, app data, accounts, settings and files are restored from the encrypted store into a fresh, ephemeral space. App code is re-downloaded per device.
  4. Run, replicating encrypted deltas. While you use it, changes are continuously encrypted and synced to the store — client-side, with keys that never leave the phone.
  5. Power off → blank slate. The ephemeral data is sealed to the store, then wiped. The device holds nothing of yours at rest; log in on any nowhere device to get it all back.

Two editions, one roaming store

Diaspore (Fairphone · based on LineageOS) is available now; Endospore (Pixel · based on GrapheneOS) is the hardened edition coming later. Both share the same accountless, zero-knowledge store and prepaid credits.

Join the waitlist