I'm curious to how this is done in a secure way when using a mobile wallet on android or iOS. We have our private spend keys on these devices, but when scanning the blockchain to update your balance, how does it not send these keys to the remote server?
Monero has two private keys, the private spend key and the private view key.
The private spend key is needed for determining whether an output that you own has been spent, creating a key image for when it will be spent, and for signing the transaction.
The private view key is needed for determining whether any outputs on the blockchain were sent to your public address. In cases where your wallet's blockchain-scanning is delegated to a remote node, the remote node will use your private view key to do the blockchain scanning.
Once the remote node has scanned and provided your wallet with a list of outputs, the remainder of the work happens locally on the device, so the private spend key never leaves the device.