Every Album has its own key. Your photos and videos are locked with it before they leave
your phone, so whoever holds the key can see the Album — and nobody else can. Secure Key
Share is how that key gets to the right people, and only to them, without Maple Album ever
being able to read it.
The short version:
the Album owner's phone makes a sealed copy of the Album key for each device of each
member. A sealed copy can be opened only by the device it was made for. Our servers hold
the sealed copies and pass them along, but can't open any of them.
One Album key, sealed for each device
Owner's phone
holds the Album key
seals a copy per device
Maple servers
relay only
Grandma's iPhone
sealed copy #1 — opens only here
Grandpa's iPad
sealed copy #2 — opens only here
Aunt Lily's iPhone
sealed copy #3 — opens only here
When the Album owner shares a key
Only the owner's phone can hand an Album's key to other people. Two things ask for it: a
new person joining, and a member signing in on a phone that doesn't have the key yet. Both
wait on the owner's Approvals screen, with the
person's four-emoji security key next to their name.
Someone joins your Album — tap Accept
A relative opens your invite and asks to join. Nothing is shared yet: they can see the
Album's name and cover, but not a single photo. Their request appears under Approvals.
When you tap Accept, your phone gives them the key and adds them to the Album's signed
member list. From then on they see the whole Album, including everything posted before
they joined.
A member gets a new phone — tap Share Key
When Grandma signs in on a new phone that doesn't carry her keys over (see
your own devices
below), she is still a member but her new phone can't open your Album. It shows up
under Approvals as a member waiting for a key; Share Key seals the Album key for that
phone. Deny leaves her new phone locked out.
What your phone does when you tap Accept or Share Key
1
Checks their security key.
Each device carries a signed statement that ties its keys to the person's account.
Your phone verifies that signature before it trusts the device. The first time it
meets a person's key, it remembers it; if that person's key ever changes later,
the app stops and asks you to review it.
2
Signs the member list.
For a new member, your phone writes an updated list of who is in the Album and
which security key each person uses, and signs it. Every member's app checks that
signature, so the list can't be altered by anyone else — including us.
3
Seals a copy of each key for each device.
Your phone opens its own copy of every key the Album has had, seals each one
for the person's device, and signs the sealed copy. A sealed copy is addressed to
one device, one Album and one key, so it can't be redirected to anyone else.
4
Uploads the sealed copies.
Our servers check the signatures and store the sealed copies. The person's phone
downloads its copy, checks that it was signed by you, and opens it. The Album key
itself was never on our servers.
Approvals: a join request to Accept, and a member's new phone to Share Key with.
Your own new iPhone or iPad
Your security key lives in your iPhone's Keychain and reaches your other Apple devices only
through iCloud Keychain, which Apple end-to-end encrypts. We never receive it. That gives
two possibilities when you sign in somewhere new:
Same iCloud Keychain
The new device already has your security key, so it has the same sealed copies as your
old one. Your Albums open right away. There is nothing to approve, and your family
sees no change.
No iCloud Keychain — you approve it
The new device makes a security key of its own and can't open anything yet. It appears
under Share with My Other Devices
on
Encryption & Keys of a device you already use. Tap Approve, and the app asks
Do the emoji match?
— compare the four emoji with the new device's own Encryption & Keys screen. Only if
they match, tap They Match, Share Keys, and
your old device seals your Album keys for the new one.
Share with My Other Devices: one of your devices is waiting for your keys. Hide it, or Approve.
Approving it: the four emoji must match the ones shown on that device.
Why the check matters: a device that gets your Album keys can open every Album you can.
Comparing the emoji is how you make sure the request really comes from your own device,
not from a stranger who signed in with your account somewhere else.
Your four-emoji security key
Every account has a security key: a long number your phone uses to sign what it sends
and to prove sealed copies are meant for it. Numbers are hard to compare, so the app shows
a fingerprint of it as four emoji. It is the
same four emoji on every device that shares your iCloud Keychain, and anyone you share with
sees your emoji next to your name.
Your phone
🎒 🍜 🌴 🎧
Their phone
🎒 🍜 🌴 🎧
Same four emoji: the key is theirs
Your phone
🎒 🍜 🌴 🎧
Their phone
🚀 🌵 🎸 🐌
Different emoji: don't share, ask them first
Comparing emoji
In person or on a call, ask the other person to open Settings → Encryption &
Keys and read out their four emoji. Yours for them are under Encryption & Keys →
Trusted People; tap the person and use Verify
Emoji
to record that you checked. The app can verify that a key is properly
signed, but only you can confirm that it belongs to the person you think it does.
"Grandma's security key changed"
Your phone remembers each person's key. If it ever sees a different one — usually
because they set up a new phone without iCloud Keychain — it shows both sets of
emoji and asks you to review before trusting the new key. Until you do, nothing is
shared with it and nothing it signed is used. If Grandma confirms her new emoji,
tap Trust New Key; if she didn't get a
new phone, choose Not Now and ask her.
Stop Trusting
From a person's page in Trusted People you can stop trusting their key. They are
removed from the Albums you own, each of those Albums gets a new key, and their key
has to pass an emoji review before it is trusted again.
Encryption & Keys: your own four emoji, at the top.
Trusted People: everyone whose key your phone trusts, and whether you confirmed it.
A changed key is never trusted silently: you see both sets of emoji first.
When someone leaves or is removed
A key, once shared, can't be taken back from a phone. So instead of trying, the Album
moves on to a new key. The owner's phone signs a member list without the person, and the
next photo or video the owner posts is locked with a brand-new key that is sealed only for
the members who remain. Our servers also delete the sealed copies the person had.
Key 1 — before
Photos posted before the change stay locked with the old key. Members keep it, so
the Album's history still opens for them.
You
Grandma
Grandpa
Aunt Lily
Aunt Lily leaves
Key 2 — after
Everything posted afterwards uses the new key. It is sealed only for the members
who remain, so the person who left can't open any of it.
You
Grandma
Grandpa
Aunt Lily
You can see each Album's keys, and when the Album last moved to a new one, under
Encryption & Keys → Album keys. Anything the person already saw may still be on their
device; no app can take that back.
Why this is safe
What would happen if things went wrong.
If our servers were broken into
The intruder would find sealed copies of Album keys and scrambled photos. Opening a
sealed copy needs the private key of the device it was made for, which never leaves
that device. The sealing uses post-quantum encryption, so even a future quantum
computer is designed not to be able to open it.
If someone tried to redirect a sealed copy
Each sealed copy is bound to one device, one Album and one key, and signed by the
phone that made it. Re-addressing it to another device, or passing it off as another
Album's key, breaks the seal and the receiving app refuses it.
If someone tried to sneak into an Album
Only the owner's phone can sign the member list, and only the owner's phone gives keys
to new members. A member added behind the owner's back would not be on the signed
list, so no app would seal anything for them — and the owner's app would flag them.
If someone pretended to be Grandma
They would have a different security key, so their emoji would not be Grandma's. This
is the one check the app can't do for you: compare the emoji with her when she joins,
and whenever the app tells you her key changed.
Good to know
iCloud Keychain is the only backup of your security
key.
We don't have a copy, so we can't restore it. Without it, a new phone gets a new key:
your own devices or the Album owners have to share keys with it again, and your family
sees your key change.
What our servers can see:
which accounts are in an Album, each device's public keys, the signed member lists, and
which device holds which sealed copy. Never the Album key, your security key, or your
photos.
Signed member lists and new keys after someone leaves
arrived in Maple Album 1.7.0.
They fully protect an Album once everyone in it has updated.
Secure Key Share is one part of how Maple Album protects your memories.
