How Backup Buddies works
Two people trade storage, not money. Each one's files are encrypted before they ever leave the device, so your buddy stores your data without being able to read it — and so do we.
Data flow
Everything below the dashed line is content Backup Buddies' own servers never touch. The only things that ever reach our server are account details, buddy pairings, and invite codes — never file contents, never encryption keys.
direct peer-to-peer (normal path)
relay fallback (NAT traversal only)
metadata to our server (no file data)
Step by step
- You pair up. One of you generates an invite code tied to a pledged storage amount; the other redeems it. This creates a buddy pairing record in our database — just the two account IDs and the pledged size, nothing about your files.
- Your device gets a keypair. Each device generates its own Iroh node identity and encryption keys locally when it's set up. Private keys never leave the device and are never sent to our server.
- Files are encrypted before they leave your machine. Each file is encrypted client-side, then content-addressed with a BLAKE3 hash. The hash becomes the file's identifier — your buddy's device (and anything in between) only ever sees opaque ciphertext and a hash, never plaintext.
- Devices connect directly, peer-to-peer. Using the Iroh networking layer, your device and your buddy's device negotiate a direct QUIC connection — the same kind of NAT hole-punching BitTorrent and similar P2P tools use — and the encrypted blob transfers straight between you.
- If a direct connection isn't possible, a relay assists. Some network setups (strict corporate firewalls, certain carrier NATs) block direct hole-punching. When that happens, encrypted bytes are relayed through our self-hosted relay server — but the relay only ever moves already-encrypted ciphertext. It has no decryption key and cannot read, inspect, or reconstruct your files.
- Your buddy's device stores the ciphertext. It counts against their pledged storage and sits there, encrypted, until you need to restore it. They cannot decrypt it — they don't have your key.
What we can see vs. what we can't
We can see
- Your account email
- Who you're paired with
- How much storage you've pledged
- Invite codes and their status
- Aggregate relay bandwidth used (for billing, if you're on a metered plan)
We can never see
- Your files' contents
- Your encryption keys
- File names or folder structure (encrypted along with the content)
- Anything your buddy's device stores on their disk
The technical stack
For anyone who wants the specifics:
- Transport: Iroh, a QUIC-based peer-to-peer networking library with built-in NAT hole-punching and relay fallback.
- Content addressing: iroh-blobs, with BLAKE3 hashing — files are identified and verified by content hash, not filename.
- Encryption: performed entirely client-side before any data is hashed or transferred; your buddy and our relay only ever handle ciphertext.
- Relay: a self-hosted iroh-relay instance we operate, used only when a direct connection can't be established — it's a blind forwarder, not a storage point.
- Server: a small Node/Express API and Postgres database, holding only accounts, device identities (public node IDs, not keys), buddy pairings, and invite codes.