A wallet whose maker cannot spend from it.
Self-custody identity on the XRP Ledger, with an iOS app in the App Store and a backend that is structurally unable to sign for a user.
The backend was never allowed to hold a key.
A wallet that feels easy to use is usually custodial somewhere. Ours could not be. The design constraint was absolute: private keys, seeds and recovery material are generated on the device and never leave it, and no service I operate can decrypt or sign a user transaction, by design and not by policy.
That single rule decides almost every other decision in the product, and most of the engineering is the cost of keeping it true.
An encrypted envelope, a disposable signing key, and a ledger that proves it.
Identity is an XLS-20 NFT whose URI anchors an encrypted envelope by content hash. The master key is wrapped inside that envelope. Day-to-day signing uses a separate regular key that can be rotated and thrown away, so the master almost never has to come out.
The backend prepares an unsigned transaction, the device shows the user exactly what they are about to authorize and signs it locally, and the backend verifies the signed blob against the intent it prepared before broadcasting. If those two disagree, nothing goes to the ledger.
Recovery, without a key of mine anywhere.
Recovery is where a self-custody design is easiest to compromise. An earlier version of ours had a service holding a co-signing seed. That is a custody failure wearing a recovery costume, so it was cut.
What shipped instead: the user recovers from a written recovery code alone. The envelope is fetched from the ledger by content hash, the master key is unwrapped on the device, and a single master-signed transaction installs a fresh device key. It was proven end to end on live testnet. I hold nothing.
Approved by App Review. Live on the App Store.
Recovery was proven end to end on live testnet before any of it shipped, including the master-signed key rotation a real recovery depends on.
The app is in the App Store and the recovery path is the part I would want audited first, because it is the part that had to be cut and rebuilt.