There is no 100% security
No system is completely secure, and anyone who tells you otherwise is selling something. Private.Ki is built so that the operator cannot read your mail. It cannot make your device, your password or the people you write to secure.
What the encryption protects
The content of your mail, your chats, your attachments and your notes — in transit, and at rest on our servers. The key that opens them is created on your device and wrapped with a passphrase that never reaches us in readable form. A copy of our database, a stolen disk or a court order gives whoever holds it ciphertext, and nothing else.
What it cannot protect
- A device that is already compromised. Malware, a keylogger, or someone holding your unlocked phone reads the message on the screen, after it has been decrypted. Encryption happens on your device; whatever controls your device is inside the circle.
- A weak or re‑used password. Your passphrase is the one thing that opens your key. If it is guessable, or written where others can find it, the mathematics underneath it does not matter.
- What the person you write to does next. They can photograph the screen, copy the text out, or simply show someone. A self‑destruct timer and Unsend remove a message from their app; they do not remove what has already been read.
- Mail to someone with no public key. It leaves our system as ordinary email, and from that point it is as private as ordinary email: readable by their provider, and by the servers in between.
- The envelope. For an email to be delivered at all, the servers carrying it must see who it is addressed to and when it was sent. The content is sealed. The address on the outside cannot be.
None of this is a defect we intend to close. It is the shape of the problem. End‑to‑end encryption is a guarantee about one specific thing — that the operator of the service does not hold the key — and it is worth having for exactly that reason, not because it makes everything else safe.
Cryptography is mathematics applied by people
The mathematics is sound. The implementations are written by people, and people make mistakes. Standards that are correct today age, and some of them eventually break. That is why we use published, peer‑reviewed cryptography and standard parts rather than anything invented here: those parts have been attacked by more people than we could ever employ, and a weakness in one of them is found in the open rather than in private.
What we can promise is narrower than “secure”, and more useful. We say which parts of the system are encrypted and which are not. We say what we hold and what we cannot hold. And we fix what is reported to us.
Found something? Security disclosure →
Why this page exists
The claims elsewhere on this site are worded carefully. “We cannot read your mail” is a statement about where the key lives — not a promise that nothing can ever go wrong, anywhere, for anyone. Where a claim is strong enough that a careful reader would want the small print, a star sits beside it and points here.