How Geode protects your photos

Geode encrypts every photo and video on your iPhone or iPad before it's stored, and backs them up to your own iCloud, still encrypted. There's no Geode account and no Geode server. Neither Apple nor we can open your vault.

This page explains how, and what Geode can't protect against.

Your vault key

When you make your vault, your device makes a random 256-bit vault key. Everything in the vault is encrypted with keys that the vault key protects. The vault key itself is never stored as it is: only wrapped, or encrypted, in the four ways below.

How your files are encrypted

• Each photo, video, thumbnail, album and set of details (the date, the place, the file's name) is a separate encrypted file, with its own random key. The vault key wraps each file's key.
• Files are encrypted with XChaCha20-Poly1305, from the open-source libsodium library, in pieces of 64 kB. Each piece is checked as it's read, so a file that's changed or damaged fails to open rather than showing something wrong. Videos play without being decrypted to a file.
• Search runs on your device, over an index kept in memory while the vault is open. It's never stored.
• If “Keep original dates and places” is off when you add a photo, its place is removed from the file itself before it's encrypted.

Opening your vault

• Your vault passcode. Separate from your device passcode. A slow key derivation (Argon2id, using 256 MB of memory) turns it into a key that wraps the vault key, stored in this device's Keychain so it never leaves this device. After 5 wrong passcodes in a row, Geode makes you wait: 1 minute, then 5, then 15, then an hour each time.
• Face ID or Touch ID. A key in your device's Secure Enclave wraps another copy of the vault key. It opens only with Face ID or Touch ID, never with your device passcode, and adding a face or a fingerprint turns it off until you enter your vault passcode.
• Your Recovery Kit. 12 words from the standard BIP-39 list: 128 random bits. They wrap a copy of the vault key that's kept in iCloud. Geode shows them once, when you make your vault, and never stores them. Anyone with the 12 words can open your vault, so keep them off your device.

In iCloud

• Your backup is in the private database of your own iCloud, and counts against your iCloud storage. Each file goes up exactly as it's stored on your device: encrypted. Geode counts an item as backed up only after iCloud confirms it and reads back the same checksum.
• iCloud also keeps two wrapped copies of the vault key, for opening the vault on a new iPhone or an iPad. One needs your Recovery Kit. The other needs your vault passcode together with a random secret that syncs through iCloud Keychain, which is end-to-end encrypted. So someone with a copy of your backup can't open it by trying every six-digit passcode.
• What Apple can see: that you use Geode, and for each file in the backup a random ID (such as item-‹random letters and numbers›), its type (key, album, device, item, thumbnail, part, removal or in-use), its size, how many parts a large video was cut into, and when it was saved. From the sizes, roughly which items are videos and how big. When you remove a device, the removal holds a random token that isn't encrypted, so the removed device can recognize it with its vault locked. It says only that a device was removed. On Free, a sealed record says which device adds and syncs, so Apple can see when it changes. Apple can't see your photos and videos, their names, when or where they were taken, your album names, or which album an item is in.
• About every three weeks, while your device charges on Wi-Fi, Geode downloads the whole backup and checks it byte for byte. Files on your device are opened with the vault key, so the copies in iCloud are known to be exactly files that open.

On your device

• Vault files use the strongest file protection iOS has: they can't be read while your device is locked, even by Geode.
• The vault isn't in your device's own backups. Its backup is the encrypted one in iCloud.
• Geode locks as soon as you leave it, or 1 or 5 minutes later if you choose that in Settings. While it waits, the vault stays open only as long as iOS keeps Geode running. Before iOS puts Geode to sleep, everything decrypted is let go, and the vault key is kept only in memory, wrapped by a Secure Enclave key that works only while your device is unlocked. So nothing can open your vault while your device is locked. The app switcher shows the lock screen, never your photos.
• Photos are blurred while your screen is recorded or mirrored.
• Activity, the record of when your vault was opened and of failed attempts, is encrypted, kept on your device for 30 days, and only your vault key can read it.

What Geode never does

• No sign-up and no account. We run no server, so there's nothing of yours for us to lose.
• No ads, tracking or analytics. The only code in Geode that isn't ours is libsodium, for encryption.
• Geode talks only to Apple: iCloud for your backup and to remember when your free month started, iCloud Keychain for the secret above, Apple's push service, so iCloud can tell Geode when another device changed something, and the App Store for purchases.

On your other devices

Another iPhone or iPad opens your vault with your passcode and the secret iCloud Keychain brings it, or with your Recovery Kit. It then keeps its own copies of the vault key, which never leave it. Devices sync the same sealed files the backup holds, so applying a change needs no key. When two devices change the same album or item, Geode settles it the next time the vault is open. Originals download, still sealed, when you open them, or all of them if you turn on Keep originals in Settings.

What Geode can't protect against

• Someone with your unlocked device while Geode is open, or within the lock delay you chose. They can see what you can.
• Someone who knows your vault passcode, or makes you tell it, or watches you type it. A longer passcode is harder to guess, not harder to force out of you.
• Anyone with your 12 words.
• Losing both your passcode and your Recovery Kit. Nobody can open the vault then, including us.
• Copies outside the vault: photos still in your Photos library, screenshots you take, and files you export. An encrypted archive hides your photos and videos, but not file and album names, and its password is only as strong as you make it.
• A compromised device, such as one that's jailbroken or running malware.
• iCloud can't read a sealed file or make one, but it could hold back a change or hand back an older one, such as an album's earlier name.
• What Apple can see, listed above.

Questions or a security report: support@koing.dev.