What is encrypted, and where
The complete table — every piece of your data, what it is encrypted with, and which side (your device or our server) can ever read it.
Private.Ki uses two kinds of encryption. PGP (OpenPGP, the same standard other encrypted-mail tools speak) protects anything that travels between two people: it is encrypted to the recipient's public key, and only their private key opens it. AES-256-GCM protects things only you need to read again — drafts, opened mail, imported keys, your saved signatures — using a master key that only your device has. Both happen on your device. Our server stores the results and never holds a key that opens them.
This page lists every item, what it is encrypted with, and where it is decrypted. Items marked not encrypted are things our server has to see to do its job.
Your keys and secrets
| Item | Encrypted with | Decrypted where |
|---|---|---|
| Your private key (an Ed25519 OpenPGP key, created on your device at sign-up) | Wrapped with Argon2 + AEAD under your passphrase. In Password only mode the wrapping secret is derived on your device from your password with Argon2id and a per-account salt. | Only on your device, in memory. The wrapped copy is stored on our server so a new device can fetch it — but it is useless without the passphrase or password. |
| Your master key (32 random bytes → one AES-256-GCM key and one HMAC-SHA-256 key) | PGP-encrypted to your own public key | On your device, right after the private key is unlocked |
| Your passphrase | Never stored on our server, never sent to it | It exists only while you type it |
| Your password | Never sent to the server; sign-in uses OPAQUE | Our server holds an OPAQUE record, which is not a password hash and cannot be reversed into your password |
| Your public key | Not encrypted — it is public by design | Anyone may hold it; it only lets people encrypt to you and verify your signatures |
| Imported public keys of other people, and their metadata (address, fingerprint, expiry) | AES (master key). The address is looked up through an HMAC-derived identifier, not stored in clear | Your device |
| Item | Encrypted with | Decrypted where |
|---|---|---|
| Body and attachments, Private.Ki → Private.Ki | PGP to the recipient's public key (a second copy to your own key), signed with your private key | Recipient's device; your Sent copy on your device |
| Subject, To/Cc/Bcc, message IDs, Private.Ki → Private.Ki | PGP to the recipient's key, inside the same encrypted header block as the body | Recipient's device. Our server never sees an internal subject line |
| Body and attachments to an external address, Encrypt on | PGP to the external contact's imported public key (PGP/MIME) | Recipient's mail software |
| Body and attachments to an external address, Encrypt off | Not encrypted in transit beyond TLS between mail servers — the recipient has no key we could use. Your own Sent copy is still stored PGP/AES-encrypted | Recipient's mail software reads it as ordinary email |
| Subject and addresses of any mail that leaves Private.Ki | Not encrypted — SMTP needs them in clear to deliver | Our outgoing mail server, then the recipient's |
| Incoming external mail, plain | PGP-encrypted to your public key by our mail server the moment it arrives; nothing is written to storage unencrypted | Your device |
| Incoming external mail, already PGP-encrypted by the sender | Sender's PGP layer, plus a second PGP layer to your key added on arrival — see Double-layer encryption | Your device, both layers |
| Sender address of received mail | PGP to your public key | Your device |
| Opened mail (any folder) | Once you have opened a message, your device re-encrypts the stored copy with AES under your master key. It is still unreadable to us | Your device |
| Drafts | AES (master key), including the subject and recipients | Your device |
| Saved email signatures (your sign-off text) | AES (master key) | Your device |
| Recipient autocomplete history | AES (master key), addresses looked up by HMAC | Your device |
Chat
| Item | Encrypted with | Decrypted where |
|---|---|---|
| Chat messages (1:1 and groups) | PGP to each member's public key, always signed. Chat uses the same sending pipeline as internal email and cannot be sent unencrypted or unsigned | Each member's device |
| Voice messages | Sent as an attachment inside the PGP-encrypted message | Recipient's device |
| Reactions | PGP to the other participant's key and signed, like a message. The message they belong to is referenced by an HMAC-derived identifier | Each participant's device |
| Unsend/destroy markers, self-destruct deadlines | Not encrypted — the server has to know that a message was withdrawn or is due to expire, and when. Which message, only through an HMAC-derived identifier | The server acts on them; it never sees the message content |
| Chat drafts | AES (master key) | Your device |
Not encrypted — what our server must see
- Your username, your display name, and which account each stored message belongs to
- Whether an item is a draft, sent or received message, and whether it is a chat or email
- Timestamps (received, sent, deleted, archived), read/starred flags, and message size
- Envelope data of mail that crosses to or from other providers: sender and recipient addresses, subject, Message-ID, date
- Thread and conversation grouping — but through HMAC-derived identifiers your device computes with your master key, so the server can group your own messages without learning the addresses behind them
- Your TOTP secret if two-factor is on (encrypted at rest under a server-held key, because the server has to check the codes) and your recovery address as an Argon2 hash only
Cannot see
- The body or attachments of any email or chat, ever
- The subject line of email between Private.Ki users
- Your passphrase, your password or your unlocked private key
- Which external public keys you have imported, or for whom
Can see
- The subject and addresses of email that leaves to, or arrives from, another provider — for as long as it takes to deliver or encrypt it
- Who owns each message, when it arrived, and whether it has been read
Every encrypt and decrypt step runs on your device — in the browser on the web, and inside a sandboxed crypto component in the iPhone and Android apps. The server receives ciphertext and stores ciphertext. The footer of the unlock screen says it in six words: End-to-end encrypted · keys never leave this device.
Common questions
Why is external mail treated differently?
Because the other side is not Private.Ki. Mail to Gmail or Outlook travels over SMTP, which requires the addresses and subject in clear, and can only be encrypted if you have imported the recipient's public key. Mail arriving from outside reaches our mail server as the sender's provider delivered it; we encrypt it to your key on arrival and keep no other copy.
If mail is re-encrypted with AES after I open it, is it less safe?
No. The AES key is part of your master key, which is itself PGP-encrypted to your private key. Nothing on the server can open either. The change is about speed on your device, not about who can read it.
What about backups and disks?
Everything in the tables above is stored in the encrypted form shown. That is independent of, and in addition to, whatever disk-level protection the servers have.