How Amazingface protects private photos and videos
Amazingface stores the photos and videos you import as encrypted files inside a separate local Vault. It does not operate an Amazingface cloud photo library for your Vault, and AmazingDrop encrypts transfer content before upload.
This page explains what stays on your device, which service records leave it, how your password becomes key material, what the relay handles, how recovery works, and which limitations you should understand before trusting any photo vault.
Security at a glance
- Local Vault: Imported photos and videos are encrypted inside an app-managed Vault on your device.
- No Amazingface cloud photo library: Your private Vault is not uploaded to Amazingface as a browsable cloud album.
- Published key derivation: Amazingface uses Argon2id and publishes the current memory, iteration, parallelism, and output settings below.
- Private transfer: AmazingDrop encrypts transfer content on the sender’s device; the relay temporarily handles ciphertext for delivery.
- No ads or cross-app tracking: Amazingface does not use advertising or third-party analytics SDKs.
- User-controlled recovery: If you lose both your Vault password and recovery phrase, Amazingface cannot restore access.
What happens when you import a photo or video
Amazingface creates an encrypted copy inside its app-managed Vault. That copy is designed to open only after the Vault is unlocked; it is not written to the app container as an ordinary, unprotected photo or video file.
Importing a file does not prove that every other copy has disappeared. The original may still exist in Apple Photos, Recently Deleted, iCloud Photos, an iPhone or computer backup, a message attachment, an exported folder, or another service. Verify the encrypted Vault copy before removing an original, and review each backup path separately.
What stays on your device—and what reaches our services
| Data | Where it is handled | What Amazingface services receive |
|---|---|---|
| Imported Vault photos, videos, and thumbnails | Encrypted local Vault | No plaintext Vault media or plaintext thumbnails |
| Vault password, recovery phrase, and plaintext vault-decryption material | User-controlled devices and recovery material | Not received |
| AmazingDrop transfer content | Encrypted on the sender’s device, then temporarily relayed | Ciphertext, encrypted key envelopes, signatures, and delivery metadata—not plaintext content |
| Account identifiers and AmazingDrop handles | Amazingface services | The minimum account and routing identifiers needed for sign-in and delivery |
| Device public keys | Generated on the device and registered with Amazingface | Public keys needed for device verification and recipient encryption |
| Purchase, subscription, quota, referral, and report records | Amazingface services and necessary providers | Operational records needed to provide subscriptions, usage limits, rewards, abuse controls, and support |
These service records can be linked to an Amazingface account. Calling them “anonymous” would be misleading even when Amazingface does not know the person’s Apple ID email or real-world identity.
This boundary describes Amazingface’s own Vault and transfer model. Your device, iCloud settings, exported files, backups, and recipients create separate security boundaries that Amazingface does not control.
Read the Amazingface Privacy Policy for the current account data, providers, and retention rules.
Published encryption and key-derivation details
Amazingface currently discloses the following implementation:
- Vault media encryption: XChaCha20-Poly1305 authenticated encryption.
- Password-based key derivation: Argon2id.
- AmazingDrop recipient key exchange: the age format with the recipient device’s X25519 public key.
- Network transport: TLS 1.3, separate from AmazingDrop’s application-layer encryption.
| Vault creation platform | Memory (m) | Iterations (t) | Parallelism (p) | Derived output |
|---|---|---|---|---|
| macOS | 256 MiB (262,144 KiB) | 3 | 4 | 64 bytes |
| iOS | 64 MiB (65,536 KiB) | 3 | 4 | 64 bytes |
These are creation defaults, not labels applied at unlock time. Each Vault stores its own key-derivation parameters in its manifest. When a Vault moves between supported platforms, the unlocking device reads and uses the parameters saved with that Vault instead of silently replacing them with a weaker or different platform default. A Vault created on macOS with a 256 MiB memory cost therefore keeps that setting when opened on iPhone.
The iOS default uses less memory to reduce the risk of the operating system terminating the app under memory pressure during unlock. Its m=64 MiB, t=3, p=4 setting matches the second recommended Argon2id parameter choice in RFC 9106 for memory-constrained environments. The macOS default raises the memory cost to 256 MiB while keeping the same iteration and parallelism settings.
OWASP currently lists m=19 MiB, t=2, p=1 as a minimum Argon2id configuration for password storage. Amazingface’s settings use more memory and work than that minimum, but memory ratios are not security multipliers. Resistance to password guessing also depends on password strength, salt handling, measured runtime, parameter versioning, implementation quality, hardware, and the attacker’s cost model.
Algorithm names are only the beginning
Saying “Argon2id” or “XChaCha20-Poly1305” is more useful when the surrounding model is also disclosed. Parameters determine the cost of each password guess. Manifest versioning determines whether a Vault keeps the protection chosen when it was created. Recovery design determines who can regain access. Code quality and key handling determine whether the intended design survives implementation.
Publishing these facts is not an independent audit. Amazingface is closed source today, and no public third-party security audit of the app has been completed. Those limitations are stated here so you can weigh the evidence rather than rely on an algorithm name alone.
Your password and recovery phrase define the access boundary
Amazingface does not offer a provider-side password reset that can unlock your Vault. Your recovery phrase is the recovery path you control. If both the Vault password and recovery phrase are lost, Amazingface cannot reconstruct the Vault key or restore access.
Store the recovery phrase somewhere separate from the device. Before relying on the Vault for irreplaceable files, test the recovery flow with non-sensitive sample content so you know exactly what will be required.
AmazingDrop is encrypted transfer—not a cloud photo library
AmazingDrop encrypts transfer content on the sender’s device before upload. The relay temporarily holds encrypted transfer data for delivery. Current maximum retention depends on the sender’s plan: 24 hours for Free, 48 hours for Plus, and 72 hours for Pro. Transfer data is removed after successful delivery or expiry, whichever happens first.
The relay also processes the account, device-key, quota, routing, referral, report, and delivery records needed to operate the service. It does not receive plaintext transfer media, plaintext thumbnails, or content-decryption keys.
The recipient controls what happens after delivery. A received file can be exported, copied, backed up, or shown by the recipient. End-to-end encryption protects the transfer path; it cannot control a file after an authorized recipient opens it.
Current limitations and trade-offs
Security FAQ
- Does Amazingface upload my private Vault to its servers?
- No. Amazingface does not operate a cloud photo library for private Vault media. AmazingDrop is a separate encrypted-transfer service whose relay temporarily handles ciphertext for delivery.
- Does Amazingface collect any data?
- Yes. Amazingface keeps the account identifiers, device public keys, purchase and subscription status, quota usage, referral, report, routing, and encrypted-delivery records needed to operate sign-in, subscriptions, abuse controls, and AmazingDrop. It does not receive plaintext Vault media, Vault passwords, recovery phrases, or plaintext vault-decryption material.
- Can Amazingface reset my Vault password?
- Amazingface cannot reset the password in a way that independently unlocks your Vault. Use your recovery phrase if you lose the password. If both are lost, Amazingface cannot recover access.
- Why does macOS use more Argon2id memory than iOS?
- Desktop systems generally have a larger memory budget. Amazingface uses a 256 MiB creation default on macOS and a 64 MiB default on iOS to balance password-guessing cost with reliable unlock behavior under iOS memory pressure. Both defaults use three iterations, four lanes, and a 64-byte derived output.
- Does an iPhone weaken a Vault created on Mac?
- No silent downgrade is intended. The Argon2id parameters are stored with the Vault, and the unlocking device uses those saved parameters. A Vault created on Mac with a 256 MiB memory cost keeps that cost when opened on iPhone.
- Does 256 MiB make a Vault four times safer than 64 MiB?
- No. The memory cost is one important input to an attacker’s cost, but it is not a linear security score. Password strength, runtime, salt handling, hardware, implementation quality, and the complete key hierarchy also matter.
- Is XChaCha20-Poly1305 automatically safer than AES-256-GCM?
- No meaningful product ranking follows from those names alone. Both can provide strong authenticated encryption when correctly implemented. Key derivation, nonce handling, key storage, recovery, and implementation review also matter.
- Is a local encrypted Vault a backup?
- No. A Vault stored on one device is still one copy. Keep a separate, tested recovery path for files you cannot afford to lose.
- What happens if I delete Amazingface?
- Deleting the app may also delete its local encrypted Vault. Export or create a recoverable copy of anything you want to keep before removing the app.
- Does Amazingface use advertising, analytics, or cross-app tracking?
- The current version does not use ad SDKs, advertising identifiers, or third-party analytics SDKs, and it does not use App data for cross-app tracking. See the Privacy Policy for the service records it does keep.
Amazingface is available now for iPhone and Mac. A native Windows app is planned.