Security
What keeps what you keep.
noapps has no account, no sign in, no server of ours, no sync, no analytics, no ads and no tracking. What you create stays on your phone. We cannot read it, and we cannot restore it.
On your phone, nowhere else
noapps opens directly. There is no registration, no email address, no password and no session. Everything you create in the app is stored on your phone. We operate no server that holds your content, and noapps has no sync and no cloud of its own.
noapps goes online only when you ask it to: to see the price, to buy, to redeem a code, or to restore. Nothing of yours is ever sent. The privacy policy lists every connection the app can make, who starts it, and what is transmitted.
Keys only you know
Guarded layers open with a key only you know. A key can be a whole sentence. There is no list of layers and no reset, and we never see the key. More about layers.
The Vault keeps card numbers, passwords and door codes. What you type there, and the documents you attach, are sealed on the phone. The Vault opens with the phone's own lock, every time.
We hold no key and never see yours. That is why nobody, including us, can open what you sealed, or recover a lost key.
Letters, sealed for one phone
Two people connect in person, by scanning each other's code. Each letter is sealed on your phone so that only the recipient's phone can open it. It travels as a file, through any app you choose; that app carries the file under its own terms and cannot open it. We run no server for Letters and never see a letter. More about Letters.
A sealed backup
Your backup is a single file, sealed with a key of your own. It carries everything, including the Letters keys and connections, so a new phone gets everything back from it. noapps sends it nowhere; you decide where it goes. Without the key, nobody opens the file. More about the backup.
Only the system's own cryptography
noapps uses the cryptography that comes with the phone's operating system, with standard algorithms: AES-256-GCM to seal content, PBKDF2-HMAC-SHA256 to turn the key you type into an encryption key, HKDF-SHA256 to derive keys from keys, and ECDH and ECDSA on P-256 for Letters. It uses no algorithms of its own and nothing non-standard. How it works.
You can check this yourself
Turn on airplane mode and open the apps on your phone. Most of them show you nothing: a spinner, an empty list, a request to sign in. What you kept in them was never really on your phone.
What you keep in noapps looks the same with the network off, because it is on your phone and nowhere else.
What that means for you
Because your data never reaches us, we cannot read it, and we cannot restore it. If you lose your phone and have no backup file, nothing can be restored. If you forget your key, nobody can open the backup file or the guarded layer, not even us. Keep the file somewhere safe, and keep the key somewhere other than the file.