axi0 Photo Sync: privacy

axi0 Photo Sync is the Android app that backs the pictures and videos on your phone up into your Key’s Photos. This is the whole of what it does with your data.

What the app keeps on the phone

• Your axi0 Key, in an encrypted file whose key sits in the phone’s hardware-backed keystore. It never leaves the phone: backups and device transfers exclude it. “Forget Key” removes it, together with everything else below, in one tap.
• The list of what was backed up: for each picture, its MediaStore id, a hash of its content and the file id it got. No picture is copied; the originals stay where they are.
• Your settings (Wi-Fi only, charging only, videos, the video size limit, camera roll only) and the status screen’s numbers (counts, times, the drive’s usage).

What leaves the phone, and where to

The app talks to one place: the Drive layer at https://search.axi0.io/drive/api/v1/, the same storage the web Photos page and Flux0S use for your Key. Everything that goes there is sealed on the phone first:

• each picture or video, in pieces of at most 8 MiB, encrypted with AES-256-GCM under a key derived from your Key for that file alone;
• a small thumbnail (WebP, 320 px on the long side), encrypted the same way;
• the index (names, sizes, dates, the place a picture was taken when its file says so, content hashes), encrypted with the Key’s index key.

The storage layer sees sizes, times and opaque ids, never a name, a date, a place or a byte of a picture. It knows your drive by a 256-bit pseudonym derived from the Key; it cannot link it to anything else you do with the Key. Another origin learns that something was stored, never what.

Where the sealed pieces rest depends on the drive: a free drive keeps its pieces with TeraBox, in one account we hold, as ciphertext it cannot open; the index and the thumbnails of every drive, and all of a paid drive, stay in our storage layer’s own bucket. In that account each Key has one folder, named by a one-way id made from the drive’s pseudonym (not your Key), with a folder for each app that stored something there (Drive, Photos, Recorder); TeraBox sees those folder names, the sizes and the times, never a file’s name or content. We keep no second copy of a free drive’s pieces: keep your own copy of what matters. The Photos page shows which kind yours is, under its space meter.

The app sends nothing else: no analytics, no crash reports, no advertising identifiers, no requests to any other host. Links you tap (this page) open in your browser.

Permissions

• Photos and videos (read): to see what is in the camera roll. The app never changes or deletes a picture.
• Camera: only while you scan the QR of your Key; nothing from the camera is kept or sent.
• Network: the Drive layer above, on Wi-Fi by default.

Deleting

• “Forget Key” in the app removes the Key, the settings, the status and the list of what was backed up. What is already in your Photos stays there, readable with the Key on any device.
• To delete what was backed up, open Photos on the web with the Key and delete there; “Delete this drive” removes everything the Key stored. Deleted means gone: there is no copy and no recycle bin.
• Lose the Key and nothing can be opened, by you or by us. There is no recovery.

Who runs this

axi0 (axi0.io). The storage layer runs on Cloudflare Workers and R2 under our account, with TeraBox holding the sealed pieces of free drives; both providers’ terms are quoted in the storage layer’s README. Questions: the contact page at axi0.io.