spark.exposed

Privacy

Breez cloud sync encrypts values but exposes deterministic record identifiers and omits exit state

Breez real-time sync encrypts record values but uses deterministic SHA-256 identifiers for four metadata record types. A party that already knows the underlying payment ID can test for its record, while exit state is excluded and requires a separate backup. 123

3 sourcesEvidence reviewed through August 24, 2026

What the evidence shows

Technical and product details

  1. Record scope

    The reviewed real-time sync stores PaymentMetadata, Contact, LightningAddress, and CrossChainSwap records. Exit trees and unilateral-exit state are not among its record types. 1

    Supporting material shown on this page

    Breez real-time sync record typesPinned source code · github.com · checked 2026-08-24
    Relevant lines from the pinned source · open raw file
    32enum RecordType {
33    PaymentMetadata,
34    Contact,
35    LightningAddress,
36    CrossChainSwap,
37}
  2. Identifier mechanism

    Each server-visible record ID is the unsalted SHA-256 of record-type:data-id. The payload is encrypted, but the identifier is deterministic rather than randomized. 2

    Supporting material shown on this page

    Breez deterministic record identifierPinned source code · github.com · checked 2026-08-24
    Relevant lines from the pinned source · open raw file
    76#[derive(Debug, Clone, PartialEq, Eq, Hash, Deserialize, Serialize)]
77pub struct RecordId {
78    pub r#type: String,
79    pub data_id: String,
80}

Interpretation

Why this matters for Spark's trust model

A party that already knows a payment ID and record type can calculate the same identifier and test for that record. Under combined service visibility, this can join selected payment metadata to timing and revision activity without decrypting the payload. Ordinary cloud sync is also not an operator-outage exit backup. 123

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • This does not expose plaintext metadata to the sync server. The join requires prior knowledge of the underlying data ID, and Breez 0.23 provides a separate exit-state export. 23

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Breez real-time sync record types

Pinned source code · github.com · Pinned or archival · checked 2026-08-24

Open original source
2

Breez deterministic record identifier

Pinned source code · github.com · Pinned or archival · checked 2026-08-24

Open original source
3

Breez 0.23 exit-state export

Pinned source code · github.com · Pinned or archival · checked 2026-08-24

Open original source

How sources, absence findings, and limitations were evaluated