A sync protocol whose only server is somebody else's mail server.
What is Tandem?Tandem is a protocol for keeping collections of records in sync across many devices and many people, end-to-end encrypted, in real time. It needs no server of its own. Its only infrastructure is a mailbox: one account on any JMAP or IMAP server.
It is for people who trust each other. It does not work in an adversarial environment.
Every piece of data is an encrypted, signed message in one folder of a mail account. The mail server sees opaque ciphertext, sizes and timing. Nothing else.
Who can read a collection is decided by who holds its key. Who may change what is decided by signatures checked on every device. The mail server decides nothing.
Records merge without coordination, so devices work offline and in any order, and every device ends up with the same state.
You are one secret, held by all your devices and printable as a backup. A collection has one owner, who shares it by link or QR code and takes it back by changing the key.
Tandem was written for Liszto, a to-do app. It doesn't know that.
A household, friends, a small team. People who trust each other.
Tandem does not work in an adversarial environment. Everyone who shares the mailbox holds its credential, and anyone who holds it can delete everything in it. A member who can write to a collection can vandalise it until the owner removes them. A stolen device is you until you start over.
The encryption keeps the mail provider, and people on the mailbox who aren't members, from reading or forging your data. It does not protect you from the people you let in.
Two words: no servers.
Three more: not ours, anyway. Any standards-compliant mail account works. There is no relay, no push service and no key server to run, and a mailbox you pay for is more predictable than infrastructure that shrinks and grows on other people's terms.
Keeping things that aren't mail in a mail account is not a new idea. Kolab did it. Apple Notes did it. See the prior art.
Quite a lot.
All of this is on purpose. The draft tried being cleverer first, six times; see the decisions.
Nobody you should trust yet. This is a draft for review, not a security sign-off.
It has been reviewed, round after round, by its author and by language models. The reviews kept finding defects, nearly all of them in rules for choosing between competing histories and for following a user's key changes. So those rules were taken out. An executable model of the collection rules is kept next to the draft.
A tandem is a bicycle for two. It is also how a two-seat jet seats its crew: one behind the other. And the domain was available.