How Cloud Backup works

01 We assume the server is compromised

Assume it is breached, seized, subpoenaed, or misconfigured by us. Your files stay unreadable in all four cases, because the server never holds anything that can decrypt them.

02 Your recovery code is the whole key

There is no account, no email, no password. Your phone generates a recovery code and derives every key from it locally.

The code is never transmitted — not on backup, not on restore, not when pairing a browser. We hold no copy and cannot produce one.

03 What happens when you back up a file

1. A fresh key is generated for that file alone. No single key unlocks the whole backup.
2. The file is encrypted on your phone, in pieces. Each piece is bound to its position in that file, so pieces cannot be swapped, reordered or moved between files.
3. The pieces upload straight to the storage provider. No server of ours ever sees anything readable.
4. That key is locked with one derived from your recovery code and stored beside the file — useless without the code.
5. The index — names, types, dates, previews — is encrypted as one block. We hold it and hand it back; we cannot open it.

Restore reverses this on your device. No key exists anywhere but your phone.

04 What we can and cannot see

Encryption hides content, not its existence.

That is the whole record: no name, no type. Sizes and timings are real signals, and encryption does not remove them.

05 Paying without being identified

Paying for storage normally creates a record tying a person to an account. This does not.

Credit is issued as an anonymous token via a blind signature: the payment system signs it without seeing what it signs. A payment can be verified as genuine but cannot be linked to the account that spends it. We could not produce that link if asked, because it is never created.

Card details go to the payment provider's own page and never reach us. Lightning involves no card processor.

06 Opening your backup in a browser

Scan a code with the app to open your backup on a computer. What travels is the storage keys, encrypted to that one browser session — not a login token, which could decrypt nothing.

Your recovery code never travels. A paired browser reaches your backed-up files and nothing else; it cannot re-derive the code, and the keys are erased when you sign out or close the tab.

Both screens show the same six digits before the keys are handed over. If they differ, choose They don't match.

07 What this does not protect against

• A compromised phone. Encryption happens on your device, so a compromised device has the files in the clear. Nothing server-side fixes that.
• A lost recovery code. Unrecoverable, by anyone.
• Metadata. The left-hand column above is not hidden and cannot be without a far more expensive design.
• Files you never backed up. This covers cloud backup only. The Safe Folder stays on your device and is excluded from it.

08 Check it yourself

Encryption, key derivation and the pairing handshake all run in the apps, not on the server. Every claim here can be checked from the client alone.

Report security problems privately: see the SECURITY.md file in the app repository, or email [email protected].