A simpler way to prove it

Aeyo is meant to be simple. Not only the screens — the whole thing, including the part you never see.

That distinction took me a while to say out loud. It is easy to talk about a simple interface: fewer buttons, less red, nothing shouting. Harder to notice that an app is also a small institution in the world, and that this has a shape too. Almost all of them choose complicated. An account you didn’t need. A tracker you weren’t told about. Fourteen pages of policy written so that reading them carefully is more work than agreeing.

I didn’t want to run that kind of thing — partly on principle, partly because I am one person and complexity is expensive to operate. You end up maintaining the machinery of trust instead of the product.

So Aeyo has no account: nothing about who you are, so no login to build, no password to reset, nothing to lose in a breach. It has no tracking — no analytics, no crash reporter phoning home, no third-party libraries watching you use it. And the privacy policy is written to be read: short, plain, specific about what leaves your phone.

But each of those is still something I am telling you.

A readable policy is better than an unreadable one. It is still a claim. You can read every word and learn exactly one thing: what I say Aeyo does. If you wanted to check, you couldn’t. And “trust me, I’m one of the good ones” is what every company says, right up until it isn’t true.

There is one part of Aeyo where this matters most.

Almost everything happens on your phone. It learns your rhythms locally; the predictions stay there. If you never share a cart, your lists sync through your own iCloud and I have no server in the path at all.

The exception is sharing. Two people editing the same list in real time need somewhere for their changes to meet, and Apple’s built-in sharing wasn’t a good fit for live, low-latency updates — it is built for a different shape of problem. So I run one small server, only for that. It is the single place where anything of yours passes through a machine I control.

Which makes it the one part you have the least reason to believe me about.

So I published it, under an open licence: github.com/Dongli99/aeyo-cart-relay

Not as a project — no contributions, issue tracker off — because running an open-source community is exactly the operational complexity I am trying not to take on. It is there to be read. You can see what it stores, what it deletes and when, that there is no password of yours because there isn’t one, no location field anywhere in it, no analytics, and no outbound calls to anyone.

You will also find the thing I would have been tempted to leave out. Inside a shared cart, one member can technically act as another; the server checks that you belong to the cart, not that you are who you say you are. For a household list shared between people who already trust each other with the groceries, that is a line I decided was acceptable — and I would rather write it down than have you find it.

That is what I actually want to argue for. Not transparency as a virtue — as a simplification.

No account: nothing to breach. No tracking: nothing to leak. A readable policy: nothing obscured. The source: nothing left to take on faith. Each step makes the previous promise cheaper to check, and the last one is different in kind, because it stops being a promise. It is a thing you can look at.

Two honest limits, since an essay about proof that overstated its proof would be a bit rich.

Publishing source is not proving what is running. I can show you the code the server is built from; I cannot prove the machine at the other end runs exactly that, and neither can anyone else who tells you their public repository settles it. What it removes is the ability to quietly do something different for long — the claims and the code are in public now, side by side.

And it is only that one server. The rest of Aeyo isn’t published, and it isn’t where the anonymous community signals go — those run through Apple’s iCloud, not my machine. If you came looking for that part of the privacy policy, you won’t find it there.

Here is what the server does. Here is the code that does it. You don’t have to believe me — that was the point.