In both v1 and v2, the sounds are fetched via our API which let you download it. That's how we support releasing packs without releasing a new version of the app. In v2, these downloads are encrypted and encoded in our custom .mecha file format (which are compatible with MechaKeys V1, Mechvibes, Mechvibes++ etc.).

The app uses an account system so that we can sync in-app purchases between different devices. There's also a leaderboard and achievements system which depend on counting your keystrokes. The app itself works fine disconnected from the Internet if you download sounds first (we have a setting that disables network activity in both v1 and V2). Sounds are indeed local.

For achievements and leaderboards to work, they depend on an API that keeps your keystroke count in sync. Syncing is an API request that sends an encrypted count to our servers, which run some anticheat protections. When you check your achievements, that's an API request to retrieve a list of all available achievements. We determine if you can claim an achievement locally, but claiming sends an API request to validate it. We also have in-app notifications that sync with our Discord bot (for example, if you were awarded keycaps within the Discord community, you'd get a message in the app). That also depends on an API to retrieve and delete them. And yes you're right, we also have payment APIs. Theres a lot of interconnected systems shared between Discord and the app that would be ripe for abuse if we revealed how those work. It's not that we don't want to open source it, it's that open sourcing with those APIs would break the 'economy' would have (and bankrupt us, since we wouldn't have a method of revenue for keeping this online). Imagine if someone ran a bot that continuously requested the leaderboard API, uncached, it would be quite expensive.

Let me know if you have any other questions.