HN user
We are a Coffee Circle customer at our startup and your only real differentiation from CC are the letterbox-friendly packages. I assume this means 350g or less? Nevertheless, good idea, but it will be expensive for you ;)
What should it do with it? It can't send it anywhere: Block network access for that process if you don't trust it.
Key won't be accessible on disk anyway, only in RAM during crypto and will be destroyed immediately afterwards.
Communication between open and closed source processes runs via IPC. Since all the IPC functions are declared in the open source part, you can exactly check what data is exchanged between the processes -> You can see that keys are not transmitted.
You can still tell what exactly happens. Two separate processes might be used: one for crypto + network which is open source, the one manages synchronisation (which is the secret sauce of all cloud-sync services, if it works really good).
Updated the FAQ: https://boldshare.com/?lang=en#faq
Boldshare matches your feature list exactly. Client code will be open source. Beta in November: https://boldshare.com/
good idea, but coming from a privacy startup this is obviously a no-go..
and distributing a web-app would equal to just open source it.. I know, it's a dilemna