Only you hold the key.
Your documents are locked on your phone before they are uploaded. Our servers only hold scrambled files they cannot open.
- Encrypted on your device
- Unreadable to us
- Keys stay with you
Locked before it leaves your hands
Encryption happens on your device. Here is how your documents stay readable to you and no one else.
You choose a passphrase
Only you know it. It stays on your device and is never sent to us.
It unlocks your master key
The master key lives on your device. We only keep a locked copy we cannot open.
Every file gets its own lock
Each document is sealed separately, so no two files share a key.
Only your device can open them
File keys are locked with your master key before upload.
Technical details
Your passphrase is stretched with Argon2id to derive a key that unlocks your master key. Each file is encrypted with its own AES-256-GCM key, and that file key is wrapped by your master key before upload. Passphrase, master key, private key, file keys and documents never leave your device unencrypted.
Share without sharing keys
When you share, your device prepares a key just for the recipient. Our server only passes along locked data it cannot read.
Your device
Locks the key for the recipient
Our server
Passes it along, cannot read it
Recipient
Opens it with their own key
- Family access
- Enter a family member’s email and a number of days. They can view your documents until the time is up.
- Single document
- Share one file, like a certificate or a bill. The rest of your library stays private.
Technical details
On your device, the file key is re-wrapped to the recipient’s public key using X25519. The server relays the AES-256-GCM ciphertext and the wrapped key, and never sees either unlocked.
Take back access any time
Shared documents ask for their key each time they are opened, so revoking takes effect straight away.
Checked on every view
Each time someone opens a shared document, their device asks for the key again.
Revoke and it stops
Once you revoke, the next attempt cannot open the document, even mid-session.
Nothing to re-upload
Your files are not re-encrypted. Removing access is enough.
Technical details
The server hands out the wrapped file key per view rather than giving it to the recipient once. Deleting the grant removes the wrapped key, so the AES-256-GCM ciphertext they may have cached can no longer be decrypted.
Works offline, stays private
Everything is built to run on your device first, so speed never changes who can read your files.
Your documents work offline
Your own files are kept on your device in locked form, so you can open them with no signal.
Shared documents stay controlled
Files shared with you are kept locked too, but their key is checked online, so revoking still works.
Unlock with fingerprint or face
Decryption still happens on your device, and your passphrase never leaves it.
Technical details
Your own documents cache the encrypted blob and its wrapped key. Shared documents cache the encrypted blob only; the wrapped key is fetched live. Biometric unlock releases the on-device key so decryption stays local.
What we can and cannot see
Zero-knowledge covers your documents and keys. Running the service still needs some account details, listed here.
We can never see
- Your documents and photos
- What is inside them
- Your passphrase
- Your keys
We store to run the service
- Your email, and your phone number if you add one
- Which document types you hold and their expiry dates, so reminders work
- Who you share with, and until when
- A log of access events
- Encrypted files and locked keys that we cannot open
If you forget your passphrase, we cannot recover or reset it. Nobody, including us, can recover your documents without it.
Technical details
Servers hold AES-256-GCM ciphertext, wrapped file keys, your master key in wrapped form, and your public key for sharing. They never hold your passphrase, unwrapped master key, private key or unwrapped file keys.