Changelog — Cynth

July 2026Site

Security page, changelog, and privacy-respecting analytics

/security is live — the full security model and threat model: per-device Ed25519 identity, mutual TLS over QUIC, what our servers can and cannot see, and what Cynth does not protect you from.
This changelog page.
Early-access waitlist hardened: bot verification on signup, one welcome email per address, ever.
Site analytics moved server-side — no client script, no cookies, no IP or user-agent stored.

July 2026Product

The project's working name, Xlip, is retired. Everything now ships as Cynth — the apps, the protocol endpoints, the infrastructure.
Production endpoints moved to c.cynth.app (API and signaling) and d.cynth.app (relay). All five clients rebuilt against the new endpoints.
cynth.app launched with the early-access waitlist.

July 2026Clients

Native clients for Windows, macOS, iOS, Android, and Linux, all built on the same Rust transfer core through a shared C ABI — the same direct transfer between any two of your devices.
iOS Share Extension: send from any app's share sheet.
End-to-end acceptance suite runs real transfers against the production stack, including a forced-relay path to prove the fallback stays blind.

July 2026Core

QUIC with mutual TLS on per-device Ed25519 keys — both ends prove their identity before a byte moves.
Resumable transfers — a dropped 400 GB send picks up where it stopped, not from zero.
Direct-first connection paths — LAN discovery via mDNS, then WAN hole-punching, then an encrypted DERP-style relay as last resort. The relay forwards ciphertext; it cannot decrypt what it carries.
Production servers deployed: API, signaling, and relay, with nightly backups of account metadata (never file data — there is none stored).