How Coffer keeps your family’s photos private

The sealed envelope

Think of sending a letter in a sealed envelope. The postal service carries it, stores it overnight, and delivers it, but it never opens it. Coffer works in a similar way. Your photos and notes are locked on your own phone or computer before they are sent to us. What reaches our servers is the locked copy. We hold the envelope, and we don’t have what’s needed to open it.

The technical name for this is encryption. It is the same kind of protection used by banks and messaging apps, and it happens automatically when you add a photo. You don’t need to do anything.

Who can open a Coffer

Two things open a Coffer: its address and its six-digit secret code. The secret code is never sent to us. The person’s own phone or computer uses it to unlock the photos for them to see. Here is how grandparents open a Coffer.

That has a practical consequence worth knowing. Because we don’t have what’s needed to unlock your photos, we can’t unlock them for you if everything is lost. This is why account holders can keep their Coffers in their account and open them on other devices with Face ID, a fingerprint or a backup code.

What we can’t see

• Your photos
• Your notes and captions
• Your secret code
• Who is in your pictures

What we do store

We believe you should know this too.

• That a Coffer exists, and when it was created
• When each photo or note was added, and roughly how large it is
• How much space each Coffer is using
• The locked copies of your photos and notes
• If you make an account: your email address, so we can send you a sign-in message
• If you pay: that your plan is active. Card details are handled by Stripe and we never see or keep them.
• A scrambled record of the internet connection used to create a Coffer, to stop misuse. We can’t turn it back into your address.

This is in our privacy policy, written in more detail.

Guessing the secret code

A six-digit code could in theory be guessed, so our servers count wrong tries. After ten wrong codes in an hour, only one try a minute is allowed, so guessing would take a very long time. Your family never gets locked out for long: at worst, they wait a minute and try again.

What privacy can’t do

Honest limits matter more than big promises.

• Anyone who has both the address and the secret code can open your Coffer, so share them only with people you trust.
• Someone who can see your family member’s screen can see the photos on it. Privacy tools can’t stop a screenshot.
• No system is perfect, and we don’t claim ours is. We’d rather say what we do and let you decide.

Why we built it this way

Your family’s photos are some of the most personal things you own. We didn’t want to ask you to trust a promise. We wanted a design where trust isn’t needed, because we simply can’t read them.