SeakretYour files. Your keys. Your privacy.
How Seakret keeps an encrypted Android photo vault private, explained in plain words.
Encrypted before it is stored
Everything you add to Seakret is encrypted on your phone before it is written to the app’s private storage. That covers the photos, videos and files themselves, their thumbnails, and the information about them: file names, albums, notes and which items are favourites. The encryption is AES-256-GCM, provided through Google’s Tink library.
Where the keys come from
The key that protects your vault is protected in three ways at once. It is tied to a key derived from your pattern or passphrase, using Argon2id, a method that is slowed down on purpose so guessing is expensive. It is also tied to a key kept in the Android Keystore of your phone, in dedicated secure hardware where your phone has it. If you turn on fingerprint or face unlock, Android does the matching and Seakret only learns “yes” or “no”, never your biometric data.
Separate vaults
Every pattern or passphrase opens its own independent vault. Seakret has no list of vaults to choose from, so what opens depends on what you draw or type.
Wrong guesses cost time
After wrong attempts at the lock screen, the waiting time before the next try grows. You can also block screenshots of Seakret in Settings.
What Seakret does not receive
Seakret has no account, no servers for your vault, no advertising, no analytics and no crash reporting. The developer does not receive your files, your pattern, your passphrase, your recovery phrase or any information about how you use the app. Seakret does not ask for access to your gallery or storage: you choose items with Android’s photo picker and file picker, or capture them with your camera app.
Backups to your own Google Drive
If you choose to back up, Seakret uploads one encrypted archive of your vault to a hidden folder in your own Google Drive. It asks Google for a single narrow permission, access to its own app-data folder, and it cannot see your other Drive files. The contents are encrypted on your phone first, so Google stores a file it cannot read. Google can still see that the backup exists, its size, when it was created and a label that groups backups of the same vault. We do not receive your backups and cannot see or delete them. The privacy policy lists exactly what leaves your phone and why.
The recovery phrase
When you create a vault, Seakret shows you 24 words. They are the way back in if you forget your pattern, and together with a backup they restore your vault on a new phone. We cannot recover the phrase for you. If you lose both your phone and your phrase, nobody can open your vault, including us.
Duress Mode (Seakret Pro)
You can choose a second pattern. When it is drawn on the lock screen, one vault opens as normal and Seakret removes this phone’s access to your other vaults. Backups you have already made are not touched, so you can restore with your recovery phrase.
Good habits
- Choose a long passphrase for a vault you want to protect the most. A pattern is convenient, and a passphrase is stronger.
- Keep your recovery phrase written down somewhere safe and private. It is your way back in, and nobody else can create it again for you.
- Keep your phone updated and install apps only from sources you trust, because no vault app can protect a phone that already has malware on it.