Work Services About Pricing Start a project Call 801 380 6854

Case study: Homing, a web app built and run by Thornwood Digital

Homing: built so even we can’t move your money without you.

Homing helps people move their own funds from their Kraken account to their own hardware wallet in one tap. We designed it, built it and run it, and it never holds anyone’s funds.

Funds Homing ever holds

Nonethey go straight to your wallet

Sign-in

PasskeysFace ID, fingerprint or passcode

Installs from

Browserno app store needed

From gethoming.app and its plain-language security overview (updated October 12, 2026)

One tap needs a key that can withdraw funds.

Many people keep their coins on a hardware wallet they hold. Getting them there from Kraken is the tedious part: open the withdrawal page, pick the network and the saved address, check the fee, confirm, check back, then repeat for the next coin.

Turning that into one tap means the app needs a Kraken key that can withdraw funds. That is a powerful thing to hand to anyone, so the whole design starts from one rule: even someone who broke into Homing completely shouldn’t be able to take a user’s money.

A web app that installs like an app, and a server that can’t read the key.

  • Installs from the browser: Homing is a progressive web app (a website you add to your home screen that then opens like an app), so there is no app store between the person and the update
  • Passkey sign-in: no passwords to steal or reuse. People sign in with Face ID, a fingerprint or their passcode, and every send asks for a fresh approval at that moment
  • The key is encrypted in the browser with AES-256-GCM before it is saved, unlocked by the passkey, a passphrase or a printed recovery key. None of those reach our servers, so what we store is a locked box we can’t open
  • Requests are signed on the device: the signature covers the amount and the destination, so the server can pass a request on or drop it, but never change it
  • A narrow key: Homing refuses any Kraken key that can trade or add addresses, and only sends to addresses the person saved at Kraken and also confirmed in Homing
  • Price alerts: a push notification when a coin reaches a price the person picks, encrypted end to end
  • An admin console for invites, the waitlist and problem reports, built so admins never see keys, balances, addresses or amounts
  • Runs on Cloudflare: one Worker serves the site, the app and the API, with a D1 database, and every release has to pass a full set of automated tests, the security rules included, before it can go live
gethoming.app
Homing homepage section headed Designed so we can’t move your money without you, tracing a key from your device through Homing and Kraken to your wallet
Homing’s homepage lays out the safety design in four steps

Security a customer can read in one sitting.

Nobody should have to take an app that touches their money on faith. Homing’s promises are short (no trading, nothing moves without you, two address checks, no ads or trackers) and each one is enforced by how the software is built, not by a policy. Its security page explains every layer in plain words. That is how we approach any software that touches money or private data: decide first what the server must never be able to do, then build it so it can’t.

gethoming.app/security Visit ↗
Homing’s security page, How Homing keeps your crypto safe, a web app built by Thornwood Digital

The security overview, live right now

Have an idea that needs its own app?

See custom software and web apps or the other software we’ve built.

Start a project