Security
Built so that even we can’t look.
Sealcloak keeps no servers and no accounts, and the app has no permission to use the internet. Your files are encrypted on your phone with keys only your pattern or phrase can unlock.
No account
No email, phone number or sign-in. Ever.
No internet
The internet permission is removed from the app entirely.
No cloud
Files stay on your phone, in encrypted form only.
No back door
We can’t reset your pattern or open your vault.
Under the hood
How your files are locked.
For people who want the details.
| File encryption | AES-256-GCM. Every file is encrypted before it’s written to storage, and its tag catches any tampering. |
|---|---|
| Vault key | Each vault has its own random 256-bit master key. |
| Pattern & phrase | Turned into keys with Argon2id (32 MiB of memory), so guessing is slow even on fast hardware. |
| Hardware | Pattern data is also wrapped by a key in the Android Keystore, so it can’t be copied off the phone and attacked. |
| Wrong patterns | Growing wait times after wrong tries. Optional erase after too many. |
| Backups | Backup files stay encrypted. Each vault’s phrase restores only that vault. |
Honest limits
What Sealcloak can’t do.
Good security means being clear about this too.
Forget both, lose all
If you forget your pattern and lose your recovery phrase, nobody can open the vault. Not even us.
Uninstalling erases
Removing the app deletes its vaults. Keep a backup file somewhere safe.
An unlocked phone is open
While a vault is open, anyone holding the phone can see it. It locks again as soon as you leave the app.