You sign in to Sherpsy once and stay signed in. Behind that convenience is a small secret the phone keeps on your behalf — the token that proves to our servers that this phone is yours. Two things about where that secret lives changed this week, and neither of them asks anything of you.
Into the keystore
Until now the token sat in the app's ordinary storage, the same kind of file that holds your draft grocery list. That is inside the app's sandbox, and on a healthy phone nothing else can read it. But phones have a better place for secrets: the platform keystore — the Keychain on iPhone, the Keystore on Android — which is hardware-backed on modern devices and is what the banking app on the same phone uses.
The September build stores the session there. If you already had the app installed, the first launch after updating moves the token into the keystore and deletes the plain copy. You stay signed in throughout. A fresh sign-in writes only to the keystore from the start. We proved both paths on a real upgrade before shipping — an installed August build, updated in place, still signed in, with the old copy gone.
A channel you have to be invited to
The other change is on the server. When a list or a chore changes, every device in the household learns about it within a second over a live channel named for the household. Your data on that channel was always fenced by the same row-level rules as everything else. But the channel itself could be joined by anyone who guessed its name, and they would sit there receiving nothing. Now joining requires a signed-in member of that household — the door is locked, not just the cupboards behind it.
The right place for a secret is the place the phone built for secrets.
Neither change is visible. Nothing in the app looks different, and that is how it should be: security work that asks the household to do something has usually already failed.