Short answerEverything in the Vault is scrambled on your iPhone with AES-256-GCM. Only your pattern or PIN, or your recovery phrase, can unlock the key. FirstHour never stores your pattern, and it never receives your pictures.
What happens when you lock a picture away
Think of your picture at the top of a hill, with a ring of protection at every level.
- The picture is scrambled. Each photo, video, file, note and small preview in the Vault is sealed with AES-256-GCM. Without the key, it's meaningless data.
- One random key does the sealing. Your iPhone makes a random key for your Vault, 256 bits long, which is far too long to guess. It's only ever stored in locked form.
- Your pattern unlocks that key. Your pattern or PIN is turned into a second key, slowly on purpose, and that's what opens the first one. The pattern itself is never saved.
- Your iPhone's security chip gets a say. Where it can be, the unlocking key also needs a secret from the Secure Enclave. So copying the Vault's files and its locked key to a computer doesn't let someone try patterns there.
- Wrong tries make you wait. You get 4 free tries. After the 5th wrong try you wait 1 minute, then 5, 15 and 60, and 60 after each wrong try from then on. Changing the iPhone's clock or restarting it doesn't skip a wait, and wrong tries never wipe your Vault. On the Forgot screen, wrong recovery phrases get waits too, after 5 free tries.
- The Vault closes behind you. It locks when you leave FirstHour, lock your iPhone or switch tabs, and it's left out of iCloud and computer backups.
What FirstHour doesn't have
- Your pictures. FirstHour checks them on your iPhone and doesn't send them anywhere.
- Your pattern, PIN or recovery phrase. Nobody can look them up or reset them for you. That's the point, and it's also the risk: keep your recovery phrase safe.
One part of FirstHour talks to FirstHour's server: Theft Lock, which isn't in the app today, and only if you turned it on. It sends your iPhone's model and asks whether it's been marked lost. If you also turn on Recovery location, it sends the places your iPhone noted, how accurate they are, the times and a rough battery level. It never sends pictures, the Vault, or anything FirstHour finds.
If you use iCloud Photos, your iPhone may also download a picture from your own iCloud so FirstHour can read it. That's a download from Apple, not an upload.
Worth knowing: FirstHour hasn't had an independent outside security audit yet. Strong encryption also can't help if someone watches you draw your pattern. Here are the main things it can't protect against.
Go deeper
AES-256-GCM explained simplyWhat it is, and why a changed file won't open.
How your pattern becomes a keyWhy being slow makes guessing harder.
What the Secure Enclave doesWhy guesses have to happen on your iPhone.
Pattern, PIN or Face IDWhich is stronger, and when.
Is it safe to draw a pattern in public?Watching eyes, and how to draw privately.
Checking pictures without uploadingWhat it reads, where, and what it misses.
What a recovery phrase isWhat it opens, and how to keep yours safe.
If you lose your pattern and your phraseThe honest limit, and how to avoid it.
What FirstHour can't protect againstThe honest list.
What FirstHour can and can't seeWhat stays yours, and the exceptions.
What "encrypted on your iPhone" meansAnd what that doesn't cover.
Why previews are encrypted tooA small copy can give away as much.
What a decoy vault doesAnd why it's no guarantee.