How your files are protected
This page says exactly what we do and what we cannot promise. If something here changes, this page changes first.
Files you add from your phone or computer
Each file is encrypted in your browser with its own key before it leaves your device. File names, folder names, previews and whether something is hidden are encrypted too. Our servers store only encrypted data and cannot open it.
Posts you save from a link
A browser cannot fetch Instagram or Facebook media directly, so our import server does it. For the few seconds a save takes, that server handles the media unencrypted, in memory. It encrypts the file with your key as it saves it and writes nothing unencrypted to disk. That is a weaker promise than for files you upload, and we would rather say so.
While a save is waiting or running, the link is stored encrypted with a key that lives on our server, not in the database. That protects the link in database copies and backups. It does not hide the link from whoever runs the server, because the server needs to read it to do the save. When the save finishes, that copy is deleted; only your own encrypted history keeps the link.
What we can still see
- Your email address and plan.
- How many files you have, how large they are (encrypted size), and when they were added or changed.
- While a link is being saved: the link, and which site it came from.
Your password
Your password never leaves your device. If you forget it, your recovery key (and your password hints, if you set them up) let you set a new one. If you lose your password and every recovery option you set up, nobody can open your files, including us. Password hint answers are protected by our server as well as by encryption, so a copy of our database alone is not enough to guess them. They are still only as strong as they are hard to guess, and someone who controls our server could try guessing them. The recovery key does not have that weakness.
Hidden items
Hiding keeps items out of your ordinary views, search and Recent until you enter your password. It does not remove originals from your phone’s photo library or other backups, and it cannot protect a device that someone else is already using while your files are unlocked. Lock with Ctrl+Shift+L, or let the idle lock do it.
Deleting
Move to Trash can be undone. Delete permanently erases the encrypted file and its preview from our server’s disk right away. That disk is not backed up, so no other copy is kept.
Deleting your account (Settings, Delete account) removes every file, folder and saved post, stops saves that are still running and signs out every device. What is left afterwards:
- Encrypted files and previews are erased from our server’s disk straight away. That disk is not backed up, so no other copy is kept.
- Our database provider keeps daily backups for 7 days. Until the last one expires, those backups still hold the account record: your email address and encrypted records that only your password or recovery key can open. Then it is gone.
- Server logs keep internal ids and error codes for a while. They never contain your email address, file names or links.