We can’t read
your records.
That’s the design.
Everything in your pouch is locked on your device, before it travels anywhere. The key never leaves you. This page explains how — in plain language first, with the technical version underneath for anyone who wants it.
“We built this for our own families. The rule we set on day one: if we wouldn’t trust it with our own mortgage and will, it doesn’t ship.”
You keep the key.
We keep the sealed box.
When you write something in your pouch, it’s locked inside your browser — on your laptop, on your phone — before a single word reaches us. What arrives at our servers is a sealed box we cannot open. Not won’t. Can’t.There is no master key at PicoPouch. No administrator who can peek. No support agent who can “just check.” If the police, a hacker, or our own curiosity came for your records, all any of us would find is the sealed box. That’s not a policy that could change — it’s how the product is built.
The technical version
The journey of one record,
from your hands to ours.
Say you add the mortgage. Here is everything that happens to it — note where the sealing occurs: before it travels.
You write it
The rate, the broker's name, the note for Anna — typed on your device, readable only there.
Your browser seals it
Before saving, your device locks the record with a key made from your passphrase. This is the moment it becomes unreadable to everyone but you.
It travels sealed
Only the sealed box crosses the internet — over an encrypted connection, sealed box inside a sealed pipe.
We shelve it, sealed
It's stored in UK-only cloud regions, still sealed. When you open your pouch again, your device — and only your device — unlocks it.
The technical version
If you lose your keys,
we cannot let you in.
That’s the honest cost of a product we can’t read. Forget your passphrase and lose your recovery key, and your pouch stays sealed — to you, to us, to everyone. Forever. We’d rather tell you this in large type now than in a support email later.
So we give you a second key when you start: the recovery key. Shown once. Treat it like the spare key to your house — write it down, put it somewhere a fire won’t find it, and tell no one who isn’t in your handover plan.
- — Write it on paper. Paper can’t be hacked.
- — Keep it apart from your passphrase.
- — Losing both means losing the pouch. Truly.
The handover envelope is sealed
even from us — even from them.
Naming a trusted person doesn't show them anything. Each person you name gets their own key, locked to their own envelope — and it works only when the conditions you set are met. Until that day, they see nothing, and neither do we. You can change your mind, your person, or your conditions any Sunday.
The technical version
What we hold,
and what we can't see.
What we hold
- ·Your email address — to sign you in and reach you
- ·Sealed boxes — your encrypted records, unreadable to us
- ·Billing details — handled by our payment provider, if you pay
- ·Shelf names and counts — enough structure to draw your shelves
What we can't see
- ×The contents of any record — rates, accounts, notes, all sealed
- ×Your documents — the will, the deed, the letters
- ×Your passphrase — never stored, never sent to us
- ×What's in a handover envelope — sealed for its person alone
And two things we simply don’t do: we don’t sell data — there’s nothing readable to sell — and we don’t put trackers in your pouch.
The small print,
in large type.
Security claims are cheap. Here's where we actually stand, including the parts still ahead of us.
Our security model is published in full
Every mechanism on this page is documented openly — the key hierarchy, the algorithms, the storage model. We'd rather be checked than trusted blindly. Read the security model →
An independent audit is planned, not done
We will commission an external security audit and publish the report when it exists — and not claim it a day before. If a badge on a website says "audited," ask to see the report. Ours will be here.
Sign-in today is email and passphrase
Passkeys and two-factor sign-in are on the roadmap. Note the encryption of your records doesn't depend on sign-in — even someone in your account can't read your pouch without your passphrase.
The weakest link is a weak passphrase
All of the machinery above protects a pouch exactly as well as the passphrase that locks it. Make it long, make it odd, make it yours. We enforce a minimum; we'd encourage a sentence.
Asked often,
answered plainly.
Q.01I set this up on my phone — can I use it on my computer?
Yes. Your records live in your pouch, not on any one device — they travel as sealed boxes, and your passphrase is the key that opens them anywhere. Sign in on your computer, enter your passphrase, and everything is there, exactly as you left it.
The seal never weakens in transit: your computer downloads the sealed boxes and unlocks them locally, the same way your phone did. Nothing is ever unlocked on our side.
Q.02What if I forget my passphrase?
Use your recovery key — the code we showed you once, when you started. It opens the pouch and lets you set a new passphrase. Using it retires the old key and issues you a fresh one to put away.
If you’ve lost both the passphrase and the recovery key, the pouch stays sealed — to you, to us, to everyone. We say this in large type in chapter iii because it’s the honest cost of a product we can’t read.
Q.03Can't you just reset it, like other websites do?
No — and that’s the feature. Websites that can reset your password can also read your data; the reset button is proof a master key exists. There is no such key here. Your sign-in password we can reset (it only proves who you are); the passphrase that seals your records, we cannot.
Q.04If my phone is stolen, is my pouch open?
No. The pouch locks itself — a thief would need your passphrase to read anything, and the passphrase isn’t stored on the device. Sign the lost device out from any other device, and it can no longer even fetch the sealed boxes.
Q.05Can my trusted person see anything right now?
Nothing. Naming someone gives them no access today — it prepares a sealed envelope only they can open, and only when the conditions you set are met. Until then they see nothing, we see nothing, and you can change your mind, your person, or your conditions any Sunday.
Q.06Is this a password manager?
No — keep the one you have. A password manager holds hundreds of logins for you, today. PicoPouch holds the few dozen records a household runs on — the mortgage, the will, the GP, the notes between them — kept for the day someone else needs to find them. The Wi-Fi password made the headline because it’s the exception, not the rule.
Q.07What happens to my pouch if PicoPouch closes?
Our commitment: you would get clear notice and a long window to export everything, unlocked on your own device as always. The sealed boxes are yours — we’re the shelf, not the owner. We built this for our own families’ worst day; leaving yours stranded would defeat the whole point.
Trust is a design decision.
We made it on day one.
Start with one record. Seal it on your own device. See how it feels to have the heaviest things quietly handled.