Scribble something or type a line, pick a few friends, send. Only they can open it. The server just carries it along and can't read it.
This is the Flutter app. The backend lives in quickpick-core.
Each phone generates an RSA key pair on sign-up. The private half never leaves the device's secure storage. When you send a pick, the app encrypts it with a fresh AES-256-GCM key and then wraps that key once per recipient with their public key (RSA-OAEP). The server stores the ciphertext and the wrapped keys. It has nothing to unwrap them with.
The code is all in lib/crypto/crypto.dart, about 150 lines. Worth a look if you don't believe me.
flutter pub get
flutter runOut of the box the app talks to the live server. To use your own core instance, change the endpoint in lib/config/environment_options.dart.
Sign-up works via SMS code, so you need a real phone number (or a test number configured in core).
English and German, in assets/locales. A new language is a JSON file plus a flag in the language picker (lib/product/profile/profile_language_selection.dart). PRs welcome.