Secure sharing

Sharing sends a point-in-time copy of a whole vault. It is not a live shared folder: items you add afterwards are not included, and each share is re-keyed from scratch, so sharing the same vault twice produces two entirely separate sets of keys.

How the recipient opens it

You get a phrase, shown once, and pass it to the person you're sharing with by whatever channel you'd trust with the contents. They enter it in the app. They don't need a vault of their own and don't need to pay for anything.

The key is in two halves

One half is derived from the phrase and never leaves your device or the recipient's. The other half is held by a small gate service we run. Neither half decrypts anything on its own, and both are needed for every open.

That split is what makes expiry and revocation real. A share with an expiry date that only the app checks is a promise. Here, the gate has to hand over its half every time — and it can refuse, because the contents are useless without it.

Expiry is mandatory

Every share carries one, from an hour up to a maximum of 30 days. There is no permanent share. You can also revoke early from Shared vaults in the vault's settings, which stops the next open rather than merely hiding a link.

What the gate records

A random share identifier, its server-held key half, the expiry you chose, and whether it has been revoked. It never receives your files, your phrase, your pattern, your name, or a device identifier, and it cannot decrypt anything with what it holds. The privacy policy lists everything it stores.

What it does not do

Share with a specific person you trust — this isn't built for broadcasting to people you don't know, and you are responsible for who you give a phrase to. Once someone has opened a share they may keep what they saw; expiry and revocation stop further opening, but nothing retrieves what has already been viewed. That's true of anything you show anyone, and we'd rather say it than imply otherwise.

Available on iPhone, iPad and Android.