Your photo or video is unencrypted only on the device that holds it. That device encrypts it before it is uploaded anywhere, then writes the encrypted bytes directly to object storage using a short-lived, single-use link - the upload does not pass through PhotoLog's own application servers on its way there, and storage receives and keeps only that encrypted file, never the original.

The claim, stated precisely

PhotoLog encrypts your photos and videos on the device doing the uploading, before the file goes anywhere. Your device then writes the already-encrypted bytes directly to object storage, using a short-lived, single-use link - the upload does not pass through PhotoLog’s own application servers on its way there.

This is deliberately a statement about where encryption happens and which path an upload takes - both are mechanism, and both are verifiable from the architecture that produces them. It is not a statement about what an operator could or couldn’t do with a modified copy of PhotoLog’s own application. That is a different question, and it is answered further down this page rather than folded into this one.

Where encryption happens

Encryption happens on your device, inside PhotoLog’s application, before your file is uploaded anywhere. The file is read locally, encrypted locally, and only the resulting encrypted bytes ever leave your device. Your device asks PhotoLog for a short-lived, single-use upload link and then writes those encrypted bytes straight to object storage using that link - the file’s bytes travel from your device to storage directly, not through PhotoLog’s own application servers along the way.

This is the one encryption story this page tells: on-device, before upload, straight to storage. If you read anywhere else that a storage partner or vendor performs the encryption on PhotoLog’s behalf, that is not how PhotoLog’s architecture works, and it is not accurate.

How your keys are organized

Rather than one key for your whole account, PhotoLog builds a small hierarchy of keys, each with a narrower job than the one above it:

Your account secret is a value you set that unlocks your account. It is used on your device to derive the keys below it, and its custody rule is specific: it is never transmitted to any server, and it is never used for anything other than that one derivation step.
Your studio - a workspace - has its own key, sealed to the identity of each of its members.
Each vault - a shared space inside a studio - has its own key, wrapped under that studio’s key.
Each photo or video has its own key: generated once, wrapped under its vault’s current key, and never reused for anything else. Losing that one derived key, on its own, exposes only that photo - it does not limit what someone holding the vault’s own key can already read, which is the whole point of sharing a vault.
The original file, and each version PhotoLog generates from it - a thumbnail, a preview - are each encrypted with their own key, derived from that photo’s key.

Every wrapped key and every encrypted photo in this hierarchy is versioned. Removing someone from a vault rotates its keys, so photos added afterwards are protected by keys they never had - on a device that has already seen the rotation.

That last clause is the honest limit, and it is worth stating plainly. A device seeing a vault for the first time - a new phone, a fresh install, a cleared browser profile - has no history to compare against, so it accepts the version PhotoLog’s servers hand it. That is the same first-use trust every device places in the first key it is ever shown, and versioning does not remove it.

What PhotoLog can still see

Photo and video contents are encrypted before they reach PhotoLog. The facts around them are not: PhotoLog’s servers see a file’s size and when it was uploaded, which studio and vault an item belongs to, who is a member of a studio, and when a share link is used. That is ordinary operational information - the kind any hosted storage service sees about what it stores and serves - not a claim about content.

Stating this plainly matters because “your photos are encrypted” is a claim about file contents, not a claim that PhotoLog holds nothing at all about your account, your studios, or your activity. Both are true, and they are different claims.

When you share a link or QR code to specific photos, the key that unlocks them travels only inside that link - in the part of the web address that browsers do not send to any server - never through PhotoLog’s own systems.

A share link works like a key: whoever holds it can use it, so send it only over channels you trust. Revoking it stops future use, but it does not undo what someone already saw or saved with it before you revoked it. If a link is compromised, the fix is a new one - a compromised link is replaced, not repaired.

If you lose your account secret

There are three ways back into your account:

A Recovery Code, generated once and shown to you when you create your account, which you record and keep somewhere safe outside PhotoLog.
Another device where you are already signed in.
Help from another member of a studio you belong to. They can restore your access to the vaults you share with them.

Member-assisted recovery restores your access to vaults you share with the members who help you; it does not restore your account, your account secret, or anything your helpers never held.

If you are the only member of a studio, and you lose both your Recovery Code and every device that is still signed in, that studio’s content cannot be recovered - not by you, and not by PhotoLog. PhotoLog holds no separate copy of those keys, no administrative override exists, and no support process can bring that content back. This is why PhotoLog asks every new account to record a Recovery Code before setup can finish, and why a studio with only one member is told, at creation, that this is its situation.

PhotoLog staff cannot recover your encrypted photos if your account secret and every recovery path are lost. Record your Recovery Code somewhere safe, and consider keeping a second device signed in or inviting someone you trust into your studio - either gives you a second way back in.

Older galleries, and what happens to them

PhotoLog also has galleries created before this system existed. Those older galleries are locked with a shared passphrase, not per-user encryption.

We are not replacing them, and we are not deleting them. A gallery made under the old model stays exactly as it is until you delete it yourself. What has changed is that the old model is closed to new work: there is no way to create a new passphrase-locked gallery. Everything created from here on uses the per-user encryption described above.

If you are still using an older gallery, the distinction that matters is the one at the top of this page: a shared passphrase is not per-user encryption, and nothing on this page about per-user keys describes those galleries.

How PhotoLog encrypts your photos