In Confidential Sync, peers exchange salted hashes of their interests and compare them with the other's salt, so only shared interests are detected and nothing new is revealed.

Naming an interest can itself be a leak; this is the privacy promise from unit 1 made concrete.

In Confidential Sync, before syncing, two peers must find what they both care about. But naming an interest can give something away.

Say one of your shelves is called gemma stinks. Asking the other peer about it tells them what you think of Gemma.

So neither side names anything. Each scrambles its interests with its own salt, a random string mixed in before hashing. And sends only the scrambles.

Each side rescrambles what it already knows with the other's salt. A match means a shared interest. No match reveals nothing.

Only for matches do they exchange read tickets. Nothing new leaves either side.

Check yourself. What does a peer learn about an interest it does not share?