How we protect your files

Last updated: November 12, 2026

PixCrypt is built on one simple principle: only you can open your files. ArfTech can't see them, whoever runs the servers can't see them, and someone who finds your phone unlocked can't see them without the app's code. Here is, plainly, how it works and where the limits are.

1. Encryption on your phone

• AES-256-GCM for every photo, video, document, thumbnail, note, saved password and intruder photo. GCM also detects tampering: a modified file is never opened.

• The file key is random (256 bits) and protected by a second key kept in the Android Keystore, inside the phone's secure hardware when available: it can't be copied off the device.

• The app's database is encrypted too (SQLCipher, AES-256), with its own key kept in the Android Keystore: file and album names, dates and even which items belong to the fake vault are unreadable to anyone who copies the phone's storage.

• Files are decrypted in memory only while you view them. The exception is “Open with another app”: that needs a temporary copy, which PixCrypt deletes as soon as possible (we tell you when this happens).

• Hidden files disappear from the gallery and other apps; if you choose, the originals are deleted.

• If you turn it on, the location (GPS) and device details are removed from photos and videos when you share or restore them.

2. Getting into the app

• PIN, pattern and password are never stored: the phone keeps only a salted Argon2id fingerprint, deliberately slow and memory-hungry so that guessing codes takes a very long time even with specialised hardware.

• Optional fingerprint or face unlock, automatic lock when you leave the app (immediately or after a delay you choose) and, if you turn it on, blocked screenshots and recent-apps preview.

• Defences for real-life situations: a decoy vault with a second code, an intruder photo after wrong attempts, a disguised app icon and name, folders with their own password.

• An emergency code that, if you're forced to open the app, permanently erases the real vault and opens it as if nothing happened.

• Quick escape: shake the phone or turn it face down to lock it instantly, go back to the home screen, or switch to a fake app that really works (weather, calculator…). PixCrypt can also disappear from the recent-apps list.

• Modified copies of the app are detected (signature check and Google Play Integrity): a tampered app gets no access to your account.

3. Zero-knowledge account

• Your account password never leaves the phone. We only send the server a derived code (PBKDF2-SHA256, 310,000 iterations), which the server in turn stores with bcrypt.

• To restore your files on a new phone, the server keeps a copy of the file key encrypted with your password (Argon2id with 32 MiB of memory, random salt, AES-256-GCM). Without the password that copy is useless, to us as well.

• There are no files, file names or previews on the server: only your email, technical device details, your plan and the counts described in the privacy policy.

4. Recovery key

Precisely because we can't read your key, if you forget your password and reset it by email your old backups could no longer be opened. That's why you can create a recovery key: a random code to keep safe (on paper, in a password manager). With that code, and only with it, a new phone can reopen your backups. We only keep a copy of the file key encrypted with that code, which we don't know.

5. Backups

• To a .pixcrypt file: a single archive protected by a password you choose (Argon2id + AES-256-GCM). Contents, names and folders are encrypted; even internal names are anonymous codes.

• Google Drive (optional; Dropbox too, where offered): files are uploaded already encrypted and with anonymous names to a folder reserved for the app. The cloud provider only sees unreadable blocks of data. The app doesn't access the other files in your account.

• Recovery folder (optional): a copy of your encrypted files stays in the phone's Documents folder and survives uninstalling the app. The key next to them is protected by your account password (Argon2id) and the list of names and albums is encrypted too: without the password the folder is useless.

6. Phone-to-phone transfer

The new phone shows a QR code with its address on your Wi-Fi network and a one-time key. The old phone scans it and sends the files, already encrypted, straight to the other phone: no internet, no servers. The file key travels protected by the QR key, so someone on the same network who hasn't seen the QR code can neither read anything nor pretend to be one of the two phones.

7. What we can't do

• We can't recover your files if you lose both your password and your recovery key: there is no back door.

• We can't view, analyse or hand over the contents of your vault, because we don't have them.

8. Limits, honestly

• Anyone who knows the app's code, or forces you to unlock it, sees the files: that's what the decoy vault is for.

• A compromised phone (malware with screen access, a modified system) can spy on what's visible while the app is open. Keep Android up to date and only install apps from trusted sources.

• A weak password is easier to guess: use a long password for your account and your backups.

9. Report a security issue

If you find a vulnerability, write to info@pixcrypt.app with the subject “Security”. We reply within a few days, keep you posted on the fix and, if you wish, thank you publicly. Please don't disclose the issue until it's fixed, and don't access other users' data.