Security

Without sync

Your figures are stored only in your browser or installed app on your device, and never sent to us. Files you import are read on your device. The device itself (its passcode, its own encryption) is what protects them.

How sync locks your figures

When you turn on sync, the app makes a random key on your device and locks your figures with it (AES-256-GCM) before anything is sent. Only the locked copy reaches us. Each of your devices gets that key sealed to its own key pair, which never leaves the device. Your Recovery Kit holds another way in, and so does Face ID or fingerprint unlock if you turn it on. We never have the key, so we can't read your figures, reset your lock or recover a copy for you.

Every change to your list of devices is signed by one of your devices, your Recovery Kit or your Face ID unlock, and each device checks the whole signed history before it trusts the list. So even someone with access to our servers couldn't quietly add their own device.

Adding a device

After signing in with your email, three ways, each needing something only you have: a device that already syncs, your Recovery Kit, or Face ID or fingerprint (once you've turned it on, on a device signed in to the same Apple or Google account). With a code or QR, both screens show four words worked out from both devices' keys; you pick the matching set on the device you already use, so a swapped key shows up as a mismatch. Each device can add one new device a day, and your other devices show an alert the next time they sync.

If a phone is lost or stolen

Figures already on it stay there, protected by its passcode. To stop it getting anything new:

• On another device: Settings, Sync, Devices, then Remove next to it, and tick It was lost or stolen. The lock changes, so it can't read anything saved after that, and Face ID unlock is turned off until you set it up again.
• No other device? On a new one, tap Turn on sync, then I've lost all my devices, and use your Recovery Kit and access code. No email is needed. Every old device is shut out.
• Someone signed in with your email who isn't you? Devices shows it; tap Remove.

Your Recovery Kit

A page with a 26-character Recovery Key and a QR code. With your access code it brings your figures back even if every device is gone, and it can change the lock and shut out every other device. Keep it away from your phone: printed at home, or in a password manager. We can't reset it or make you a new one, and the app can't make a new one yet: if you lose it while you still have a device, export a backup and keep your devices safe. Never share it, and never type it anywhere but the Pocket Stacks app; we will never ask for it.

Slow changes you can stop

Deleting your synced copy and starting fresh both wait 7 days, and any of your devices can stop them. A deleted copy is then held for 30 days, and your Recovery Kit can bring it back.

What we can still see

To run sync we can see your sync email, when your devices sync, how many devices you have, the locked file's size (rounded up in 16 KB steps), when the lock changes, and resets and refunds. For each sign-in to sync we keep the first part of the browser's identifier, so Devices can show "iPhone, Safari". The names you give your devices are locked; while you add one, we see the type it reports. Brevo, which sends our emails, sees your email address and when we email you. See the Privacy policy for how long each is kept.

Report a problem

Found a security problem? Email support@pocketstacks.com.au with the details. Please give us a chance to fix it before telling anyone else. We'll reply and keep you posted.