Maple Album privacy

How your memories stay private

Maple Album is end-to-end encrypted. That means your photos and videos are scrambled on your own device and can only be unlocked by the people you share an Album with. The keys never leave your family's devices in a form anyone else can read — so not even Maple Album's team can open your memories.

The short version: we store your photos and videos only as encrypted, unreadable data. We hold none of the keys that could turn them back into a photo or video, except for items someone reports for abuse (explained below).

The route a photo takes

Your phone

encrypts the photo

key created here

Maple servers

store only ciphertext

we can't open them

Grandma's phone

decrypts it locally

key unsealed here

What happens when you share a photo

1. Encrypted on your device

Before anything is uploaded, your device encrypts the photo or video locally, with a key made just for that one item. What leaves your phone is already scrambled — the original never travels over the internet in the open.
2. Your keys stay with you

Your device's keys come from a random account key kept in your iPhone's Keychain. It reaches your other Apple devices only through iCloud Keychain, which Apple end-to-end encrypts. We never receive it, and we keep no copy of your keys — which also means we can't unlock your Albums for you.
3. Shared without ever exposing it

When someone joins an Album, the owner's app seals the Album's key separately for each of the new person's devices and signs it. Maple Album only relays these sealed keys — it can't unseal them. Read more about secure key sharing .
4. We only store scrambled media

On our servers your photos and videos sit as encrypted blobs. Without the keys — which only your family's devices hold — that data can't be turned back into anything viewable, by us or by anyone who might gain access to the servers.

Knowing exactly who you share with

Encryption only helps if the keys belong to the right people. Maple Album makes sure the server can't quietly change who an Album is shared with.

A signed list of members

The Album owner's app signs the list of who is in the Album and which security key each person uses. Everyone else's app checks that signature and refuses an older or altered list, so nobody — including us — can secretly add a member or swap someone's key.

Security keys you can check

Every person has a security key, shown as four emoji. Compare them in person or on a call with Verify Emoji, under Encryption & Keys → Trusted People. If someone's key ever changes, the app asks you to review it before trusting it again.

A new key when someone leaves

When someone leaves or is removed from an Album, the owner's app switches to a brand-new Album key for everything posted afterwards, so they can't open new photos or videos. Anything they already saw may still be on their device; no app can take that back.

You approve new devices

A new iPhone or iPad on the same iCloud Keychain gets your keys automatically. Any other new device must be approved from one you already use, after you check that the emoji on both screens match.

Signed member lists and new keys after someone leaves arrived in Maple Album 1.7.0. They fully protect an Album once everyone in it has updated.

The principle behind Signal — built for albums

Secure messengers like Signal proved that end-to-end encryption can be private by default and simple to use: only the people in a conversation can read it, and the service in the middle can't.

Maple Album applies that same principle to a different job. Where a messenger secures a stream of messages, we secure shared family albums that last for years — so the design focuses on who belongs to each Album, and on locking out anyone who leaves.

Ready for the future

Album keys are protected with hybrid post-quantum encryption (X-Wing), which combines ML-KEM with a proven classical algorithm. Even a future quantum computer — the kind that could break much of today's encryption — is designed not to be able to unlock your memories.

Never used to train AI

Your photos and videos are end-to-end encrypted, so there is nothing in them for us to feed into an AI model, sell, or mine. We don't train AI on anything you put in Maple Album — captions and comments included — and we never will.

Screenshot & recording protection

Maple Album guards shared media against screenshots and screen recording, making album content harder to copy or leak. No app can prevent every capture on every device, so still share only with people you trust.

Tamper-evident by design

Every encrypted photo and video is authenticated, and so is every shared key. If stored data were altered, corrupted, or truncated, your device detects it and refuses to show a tampered result.

What we can and can't see

Being honest about the limits matters. Here's the line.

We can't see

The contents of your photos and videos, including video previews*
Photos you add to the people in an Album
Who or what appears in your media
The exact place a photo was taken
The camera or device used to capture it
Faces, places, or objects in your media — we run no scanning or recognition
Anything that would let us reconstruct your media

We can see

That an Album exists, its name and cover photo, and which accounts belong to it
The names, emoji, and birthdays you give the people in an Album
Your name, email address, and profile picture
Captions, comments, and likes
Who has seen each post, and when
The size and timing of uploads, whether an item is a photo or a video, its dimensions, and how long a video is
When a photo includes them: roughly where it was taken (to about 1 km), its altitude, and when it was taken
Each device's public keys and the signed member list of each Album

* The one exception: reporting abuse

The only time we can ever see a photo or video is when someone who already has access to it — a member of that Album — reports it for abuse. Reporting hands our team the keys to the specific items being reported, and nothing else: they can't unlock any other photo, video, or Album. Once the report has been reviewed, those keys are deleted, unless the law requires us to keep them as evidence, for example of child sexual abuse. This is what lets us act on genuinely harmful content without ever holding the keys to your family's memories.

Under the hood

For the technically curious, Maple Album's end-to-end encryption profile uses:

Content encryption: XChaCha20-Poly1305, streamed in 128 KiB authenticated chunks. The header is authenticated on every chunk, and the media type is encrypted with the content.
Key protection: X-Wing hybrid key encapsulation (ML-KEM-768 + X25519) for each member device; ML-KEM-768 alone for devices still on an older app version
Signatures: Ed25519 over each device's keys, every shared Album key (bound to its Album and recipient), and each Album's member list
Member lists: Versioned and hash-chained, signed by the Album owner; apps reject older or forked versions
Key derivation: HKDF-SHA-256, with a random salt and its own key for every photo and video
Device keys: Derived from a random 256-bit account key in the iOS Keychain, synced only through iCloud Keychain, and held in memory while the app runs
Proof of possession: A new device proves it holds its private key (HMAC-SHA-256 challenge) before its signing key is accepted
Security key emoji: Four emoji from the SHA-256 hash of a person's Ed25519 signing key
Size padding: Padmé padding on photos, so their stored size reveals less about them
One implementation: The same Rust encryption core runs in the app and on our servers

Private by default, for the whole family.

Keep the moments that matter somewhere only your family can reach them.

Get Maple Album