Secure cloud storage for personal and private photos
What a vault for private personal albums must get right: encryption, encrypted metadata, discreet access, controlled sharing and dependable recovery.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.
A specific, common requirement A large share of people keep private personal albums — images shared within a relationship, personal medical photos, pictures they simply consider nobody else's business. The requirement is not exotic and it deserves a professional answer rather than an awkward one.
The answer is the same as for any high-value confidential data: the provider must be structurally unable to read it.
What the vault must do **Encrypt before upload.** Client-side sealing with a key derived from your passphrase using Argon2id, payloads under XChaCha20-Poly1305, per-item keys wrapped with X25519.
Encrypt the labels too. Album names and file names describe content. They must be sealed like the content.
Generate previews locally. Thumbnails must never require a server-side decryption step.
Lock discreetly. A short auto-lock timeout, an app-level PIN separate from the account password, lockout after repeated failures, and immediate wipe of decrypted material from memory on lock.
Control sharing tightly. If an album is shared at all, it should be through a link with a passphrase, a view cap and a short hard expiry — never a permanent public URL.
Recover predictably. An offline recovery kit that you generate and store yourself, because provider-side recovery and zero-knowledge cannot coexist.
What to avoid - Gallery apps that "hide" photos behind a PIN while leaving the files unencrypted on disk or synced to a readable cloud. - Sending private media through messaging platforms that keep readable server-side copies indefinitely. - Permanent share links. Anything without an expiry becomes a forgotten liability. - Storing the recovery kit inside the vault it recovers.
Sharing with one person, safely If an album is meant for exactly one other person, prefer per-recipient key wrapping over a link: their device holds a copy of the album key sealed to their public key, and removing their access rotates the key so future content is sealed under one they never held. That is a cryptographic revocation, not a permission flag.
Deletion that means deletion Ask what happens when you delete. A defensible design keeps a short, visible trash window, then removes the ciphertext and its wrapped keys. Once the keys are gone, remaining bytes are unrecoverable noise — which is a stronger guarantee than a promise to delete.
Why the tone of a product matters A vault for personal media should feel like a bank, not like a novelty app. No playful branding around the sensitive part, no cloud-side "smart" features quietly analysing the library, no ambiguous marketing. Plain statements about what is encrypted, what is visible, and what happens if you lose your passphrase.
That is the standard DRIVUNO is built to: ciphertext on the server, keys on your device, links that expire within 24 hours, and no path for us to open an album.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.