How secure sharing works.
A short explanation without the marketing fluff, including the places where it has limits.
Encrypted on your device. Decrypted on theirs. Nothing readable in between.
1. The key is in the link
When you make a list shareable, your device creates a secret key. That key does not go to our server. It goes into the invite link, after the #:
nimmit.app/j#list.secret-key
The web itself takes care of this. Browsers and the app never send anything after the # (the “fragment”) to a server. Only the people who get the link have the key.
2. The server only sees gibberish
Items and the list name are encrypted on your device (XChaCha20-Poly1305, the same state of the art that messengers use) and only then uploaded. The server holds nothing but ciphertext. The one readable thing there is the nickname you give yourself in a shared list, so pick one that doesn't give you away. No third party runs the server either. We operate it ourselves, and it is located in Germany.
In practice: we couldn't read your list even if we wanted to or were ordered to. There's nothing readable to hand over.
3. Anyone with the link can join
There are no friend requests and no accounts. The link is the invitation: tap, join, done. That makes sharing wonderfully simple, but it also means:
- Anyone who gets the link can read and edit the list.
- Treat the link like a spare key and only give it to people you trust.
The honest limits
Real end-to-end encryption comes at a price. We think it's a fair one, but you should know what it is:
- No key reset. If you lose your recovery phrase and all your devices, your identity and shared lists are gone. We can't bring them back. That's exactly what E2E is about.
- Metadata stays visible. The server sees that members of a list sync and when, but never what is on it.
- Removing members (key rotation) will come later. Until then: if you have the link, you're in.
Remember: your recovery phrase is the only backup of your identity. Write it down, keep it somewhere safe, and never show it to anyone.
And lists you don't share?
They simply stay on your device and never touch a server. Sharing is the exception, and you turn it on for each list yourself.