HomeSecurity
An unlock you cannot fake from the couch.
Every unlock asks the key a question it has never been asked before, over Bluetooth, and only the real key can answer it — so a recording of yesterday's unlock is worth nothing. Here is exactly how that works, and exactly where it stops.
Four things this genuinely gives you
Replay-resistant
Every unlock uses a fresh random challenge. A recording of a previous exchange will not verify, so an app rebroadcasting something it overheard cannot stand in for your key.
The secret never moves
The shared secret is written once, at pairing, and is never transmitted again. Only a signature over that particular unlock's challenge ever goes over Bluetooth.
No network in the loop
Unlocking is a conversation between your phone and the key, and nothing else is involved. It works in a basement, on a plane, and on a day our servers are down.
No usage data collected
Which apps you block, and when, stays on your device. Blocking needs no account at all, so for most people there is no server-side record that they use Spark.
The exchange
When you ask to unlock, your phone generates a fresh 16-byte random number — a nonce — and sends it to the key over Bluetooth. The key signs that specific nonce, together with its own identifier, using a secret that only it and your phone share. Your phone recomputes the same signature and compares the two.
phone → key nonce = CSPRNG(16 bytes)
key → phone sig = HMAC-SHA256(secret, nonce ‖ tid)
phone verify(sig) → unlockBecause the nonce changes every single time, yesterday’s signature is worthless today. Producing a valid response requires the secret itself, and the secret is written to the key once during pairing and never transmitted again. There is nothing to overhear, because the only thing that crosses the air is an answer to a question that will never be asked twice.
What the key stores
One secret and one identifier. No app list, no schedule, no history — the key has no idea what it is unlocking, or that anything is locked at all. It is a small object that can prove it is itself, and nothing more than that. Losing it leaks nothing about you, because it never knew anything about you.
What never leaves your phone
Your modes, the apps inside them, your schedules and your session history. Blocking works with no account, so for most people there is no server-side record that they use Spark at all. Buying a key is a separate thing and does create a record — an order, a delivery address, a GST invoice — and the privacy policy sets out exactly what that is and how long we keep it.
Why it is built this way
Why not a simple broadcast?
A key that shouted a fixed identifier would be far easier to build and trivially defeated — free apps can rebroadcast any identifier they have observed. Against a remote stranger that might be tolerable. Against the person holding the phone, who has physical access, patience and a strong motive to cheat, it is no protection at all.
Why emergency unlocks are capped
A dead battery or a lost key must never mean a permanently unusable phone, so there is an escape hatch. It is deliberately limited rather than generous: enough to rescue you, few enough that it cannot quietly become the normal route back in. An unlimited escape hatch is just an unlock button with extra steps.
What this does not protect against
This is proximity proof, not tamper-proofing. Three specific things beat it, and we would rather you read them here than discover them yourself.
Someone who opens the hardware
The secret lives inside the key. A person willing to prise the case apart and read it out can extract that secret, clone the key, and then unlock from the sofa for ever. There is no meaningful defence against this at this price, and we are not going to pretend otherwise. We are not defending against a laboratory — we are defending against a moment of weakness, which is a far lower bar and the one that decides whether the product works.
You, with enough determination and your own phone
You own the phone, and no app on it outranks you. On Android, strict mode closes the uninstall-and-settings route for as long as a session is running. On iOS the operating system permits less, so deleting Spark ends the block — at the cost of your modes, schedules and history, which do not come back. Where an operating system makes true enforcement impossible we say so rather than implying a guarantee we cannot keep. Enforcement runs through Apple’s and Google’s own APIs, and the ceiling is theirs to set, not ours.
The parts of your life a phone app cannot reach
A second handset in the drawer. The same website open on a laptop. A factory reset. None of these are within reach of any app running on your phone, ours included, and a product that claimed otherwise would be lying. Spark makes the phone in your pocket a poor choice in a weak moment; it does not make you a different person, and nothing sold in a box does.
Not an attacker. The person this protects you from is you, forty minutes into a bad evening, reaching for the phone without having decided to. Against that, the key in the next room does not need to be unbreakable. It only needs to cost more than the impulse is willing to pay — and a walk is a cost your tired self cannot talk its way out of.
The five people actually ask
Can a Spark key be cloned?
By someone willing to open the case and read the secret out of the hardware, yes. That is a physical attack on a device you own, and no key at this price defends against it. What cannot be done is cloning it over the air, which is the case the design is actually built for.
Does unlocking need an internet connection?
No. The challenge and the response are exchanged directly between your phone and the key over Bluetooth. Unlocking works with mobile data off, on a plane, in a basement, and on a day our servers are down.
Can I get around the block by turning Bluetooth off?
No. Locking never depends on the radio, and switching Bluetooth off does not end a session — your apps stay locked until the key is back in range and answers a challenge. It is the first thing everybody tries and the first loophole we closed.
What happens if the key's battery dies or I lose it?
Emergency unlocks exist for exactly that. They are deliberately capped rather than unlimited: enough to rescue you from a flat battery or a key left in another city, few enough that they cannot quietly become your normal way in.
Can Spark see which apps I block?
No. Your modes, schedules and session history stay on the device. Blocking needs no account, so there is usually no record on our side that you use Spark at all — separately from that, buying a key creates an order with an address and a GST invoice, which the privacy policy covers.
The FAQ covers the rest — battery life, what happens if you uninstall, whether it works on your phone — and how the unlock actually works is the longer engineering write-up of the exchange above. If your question is about what we store rather than what the key does, that is the privacy policy. If it is about the hardware itself, the buy page lists what is in the box.