Not a legal document — see the Privacy Policy and Terms of Service for that. This page explains the actual mechanics, in plain language, for anyone who wants to understand what “encrypted” really means here.
Your password derives an encryption key, entirely in your browser. That key encrypts everything about your collection — make, model, serial numbers, NFA control numbers, photos, notes — before any of it is sent anywhere. We store the encrypted result. We never have the key. We cannot read your collection, not because of a policy, but because we don’t possess the means to.
AES-256-GCM for encryption. The key is derived from your password using PBKDF2 with 100,000 rounds of SHA-256, salted per account. Both are standard, widely-reviewed primitives available natively in every modern browser’s Web Crypto API — nothing custom or unaudited. Each item is encrypted individually with a random initialization vector, so identical items don’t produce identical ciphertext.
Your email address (needed to log you in), when your account was created, when an item was last modified, and how many items you have — as an encrypted-blob count, not their contents. That is the complete list. Row Level Security at the database level also restricts every query to your own account, independent of the encryption — so the two protections don’t rely on each other.
Supabase (Postgres) hosts the database; your account and encrypted items live there. Photos are stored as part of the same encrypted blob, not separately. We don’t operate our own servers for this data.
Zero-knowledge encryption protects the contents of your collection from us and from anyone who gains access to the database. It does not protect against someone who obtains your actual password (write it down somewhere secure, don’t reuse it), and it does not make the app immune to bugs. If you notice something that looks like a security issue, there is currently no dedicated reporting channel — see Help for what does exist.
In the event of a security incident affecting account emails or metadata, we would notify affected users at the email on file, consistent with applicable law. Because collection contents are encrypted with keys we never hold, a database compromise would not expose readable item data even in a worst-case scenario — that is the actual point of this architecture, not a claim we’re making without backing it.