Where your documents actually are
Every document, every photo and every reminder setting in RenewKeep is stored on your phone, encrypted, and nowhere else. The app has no code that uploads a document. This page explains how that works, what it protects you from, what it does not, and the one real cost.
What "encrypted on our servers" usually means
Most apps in this category — and, until September 2026, an earlier version of this one — encrypt your documents before writing them to their own database. That sounds like the end of the story. It is not, because the company holds the key. Field-level encryption protects against a stolen database dump; it does nothing against the operator, a subpoena to the operator, or a bug in the operator's admin tools. A photograph of your passport on someone else's disk is still a photograph of your passport on someone else's disk, however carefully it is wrapped.
We rebuilt the storage so that there is no server-side copy to protect. Not "encrypted so well we cannot read it" — absent.
How it works, concretely
- The database. Document fields live in a SQLCipher database in the app's private storage — SQLite with full-database AES encryption. It is unreadable without the key.
- Photos. Each image is encrypted with AES-256-GCM and written as its own file. GCM is an authenticated mode: a file that has been tampered with fails to open rather than opening wrong.
- The key. 32 random bytes generated on the device at first run and held in the iOS Keychain or Android Keystore. It is never sent anywhere and is not derived from anything we know — not your email, not your password.
- No upload path. The storage code contains no network call. This is checked when this website is built, by reading the app source.
What this protects you from
A breach of our systems cannot expose your documents, because they are not in our systems. Nobody at RenewKeep can read them, so nobody can be pressured, tricked or ordered into handing them over. And the app keeps working with no connection at all — on a flight, abroad without data, or in a basement — because it never needed one for the documents in the first place.
What it does not protect you from
Someone who unlocks your phone. The vault opens when the phone does, so your device passcode and biometric lock are the real front door — use them. It also does not protect you from losing the phone, which brings us to the cost.
The cost: we cannot recover your documents
This is the sentence every privacy-first product should say out loud and most do not. Because the key exists only on your phone, if you lose the phone and have no backup, your documents are gone. We cannot restore them. That is not a limitation we could remove with more engineering; it is the same fact as "we cannot read them", stated from the other side.
The safety net is the app's encrypted backup file: a single export, encrypted with a passphrase you choose, that you keep wherever you like — a cloud drive, a computer, an email to yourself. Restore it on a new phone with the passphrase and everything comes back. Make one after you add anything you would mind losing.
What does go over the network
Honesty means listing this too. If you create an account, your email and a password hash are stored on our server so you can sign in. If you subscribe to Premium, the purchase runs through Apple or Google and a record of your plan is kept so the app knows what you paid for. If you choose to track subscriptions, those entries — "Netflix, $15.99, monthly" — are stored on our server too, because they drive the money totals and are not confidential in the way a passport is. Documents and their photographs are never in that list.