Everything you bring in is encrypted on your iPhone before it ever leaves it. The key is generated on your device and stored in the iOS Keychain — it never leaves, and we never have a copy.
Your encryption key is generated and kept on your iPhone.
The server stores encrypted blobs and your email — nothing else.
Not even Our Life can decrypt your records — by design.
Every record you bring in is sealed on your device. The only thing stored in plain text is the email address on your account.
Attackers would get encrypted blobs they can't open. Your records stay locked.
We can only hand over encrypted blobs we can't read and your account email. We can't decrypt your records for anyone — including ourselves.
For Ask, only the small text snippets needed to answer are decrypted on your device and sent over an encrypted connection to a third-party AI model (Anthropic's Claude). They're used to compose one answer, then discarded — not retained or used for training.
Your recovery code is the only way back. We can give you a new account, but not new data — the records stay encrypted with the key only the old device held.
Optionally require Face ID every time you open the app, and when it returns from the background.
A short word-based code shown once at setup. It's the only way to restore your encrypted records on a new phone — we can't recover it for you.
Keys are pinned on first contact, like Signal. If a contact's key changes, you compare a safety number and confirm "it's really them" before viewing.
It's generated on your iPhone and stored in the iOS Keychain. It never leaves the device, and Our Life never receives a copy. That's why only you can read your records.
No. The server only ever holds encrypted blobs and your email. Without your on-device key, the contents are unreadable to us — and to anyone who obtained the data.
Your records are stored zero-knowledge — the server only ever holds encrypted blobs. When you ask a question, the app decrypts on your device and sends only the small text snippets needed to answer, over an encrypted connection, to a third-party AI model (Anthropic's Claude). Those snippets are used to compose a single answer and are not retained or used for training. The app asks for your explicit permission before any snippet is sent.
Stopping a share removes the recipient's access and deletes the shared copy from the server. Recipients can also remove a share from their own side at any time.
Deletion is permanent — it erases your account and all data. Signing back in starts a fresh, empty account. This can't be undone, so keep an export if you want a copy.
Private from the first tap — and every tap after.
Download on the App Store