The idea
Most services protect your files with a promise: "we will not look". Arc Drive protects them with a lock that we do not have the key to. The lock is closed on your phone, before anything is uploaded. What reaches the cloud is scrambled data that only your own key can open.
What happens to a photo
- Your phone reads the photo and encrypts it, a piece at a time, so even a large video never needs to fit in memory.
- It uploads the locked file straight to your private storage space. Photos never pass through our own servers.
- The file gets a meaningless name. The name is a keyed fingerprint of the file, so it reveals nothing about the photo, its date or its place. The same photo is stored once.
- A small locked catalog records which photo is which, so a new phone can show your library within minutes.
Your keys
| Key | Where it lives |
|---|---|
| Your identity key, which locks and unlocks everything | On your phone, sealed by the phone's secure hardware (the Android Keystore). It is never uploaded. |
| Your 24 recovery words | On your paper. They can rebuild the identity key on a new phone. We never see them. |
| A copy of the identity key, locked with your 24 words | In your storage space, so that a new phone can restore. Without the words it is unreadable. |
The trade-off: because only you hold the key, we cannot reset it. Lose your words and your phone together, and the backup cannot be opened by anyone.
Standard tools, nothing invented
- Encryption: the open age file format, with X25519 keys. We did not design our own cryptography.
- Recovery words: a standard 24-word phrase (BIP-39), which gives 256 bits of randomness.
- File names: a BLAKE3 keyed hash of each file.
- Phone key protection: AES-256-GCM, with the key held in Android's hardware-backed Keystore.
You are not locked in to our app
Every file in your storage space is a standard age file. With your key, a free standard tool can open them without Arc Drive. We tested this with the standalone age tool on uploaded originals, thumbnails and the catalog. The format is documented, and a version change always keeps older backups readable.
age --decrypt --identity your-key.txt --output photo.jpg originals/<file-id>What our server knows
One small account server handles sign-in, creates your storage space and issues your phone a key limited to that space. It holds your email address, hashed sign-in codes, storage totals and account status. It never sees photos, recovery words or encryption keys. The key it gives your phone cannot delete anything permanently: removed photos wait about 7 days, then the storage provider deletes them. The full list is in the privacy policy.
What we have not done yet
We prefer to say this plainly:
- No independent security audit yet. We plan one before we ask the public to rely on Arc Drive.
- The code is not public yet. We want it to be reviewable by others.
- Not built to resist future quantum computers. The encryption uses today's standard keys. We are watching the standard and will move when the tools are ready.
- File sizes are visible to the storage provider. Encrypted files are close to the size of the originals. Hiding sizes would cost extra storage, and we have not done it.
- A replaced recovery phrase does not erase older copies at once. If a set of words leaks, tell us.
Report a security problem
If you find a flaw, please write to security@turingarc.com. Give us a reasonable time to fix it before you share it, and do not access other people's data. We will reply and credit you if you wish.