Security

Locked on your phone. Unreadable everywhere else.

Our promise, the design behind it, and how to tell us if you find a problem.

The promise Coming

Your memories are encrypted on your phone before they ever leave it. The keys stay on your family’s devices. Jelly’s servers hold only scrambled data we cannot read: not your photos, not your words, not your children’s names.

Today, nothing leaves your phone at all, so there’s nothing for us to read. The promise above is how backup and Family Circle are being built, and they won’t launch until it’s true.

How it works, in plain words

Every memory gets its own key. Photos, video, voice notes and text are locked with that key on your phone, using well-tested, open encryption (libsodium’s XChaCha20-Poly1305).
The key is then locked again for each person allowed to see it. If someone isn’t in a memory’s audience, a key is never made for them. That’s math, not a hidden button.
Your devices hold the keys. Private keys live in your phone’s secure storage (Keychain on iPhone, Keystore on Android).
A recovery code is your spare key. 24 words you keep somewhere safe. Because we can’t read your data, we can’t recover it without that code or another signed-in family phone.
Our servers see as little as possible. Random file names, padded file sizes and batched uploads, so even the shape of your data says little.
Faces never leave your phone. Face matching is opt-in, on-device, and erased with one tap.

What we do on our side

Two-factor sign-in on every account that touches production.
Row-level security on every database table, and secret keys only in server-side secret stores, never in the app.
Crash reports and analytics scrubbed of content and personal details before they leave your phone.
An independent security review of the encryption design before we market Family Circle widely.

Report a security problem

Email security@jellymemories.com. Please give us a reasonable chance to fix the issue before telling anyone else. We won’t take legal action against good-faith research that avoids harming families’ data, and we’ll credit you if you’d like. Our machine-readable contact is at /.well-known/security.txt.