Private Capture

What Private Capture does and does not do

It does: lock your capture before it is stored, so the copy on the permanent network is unreadable without your vault. Keep the full proof of authenticity working, without revealing the contents. Let you open your captures without Permavault, using your Recovery Kit and openly documented tools.

It does not: hide the fact that a capture was made. Anyone can see that an encrypted item of about this size was stored on this date. We also keep a record that your account made it, because we have to bill you and show your history, and we can be required to produce that record.

It cannot: recover your captures if you lose every device that can unlock them and your Recovery Kit. There is no reset. That is the price of a vault we cannot open.

How do I keep a way back in?

Set up passkeys on devices you trust. Add a trusted second person if that suits your circumstances, and keep a saved or printed Recovery Kit somewhere safe. Test your kit before you need it. A person with your Recovery Phrase can open everything locked to that vault; only share it deliberately.

Keep your receipt emails and download your Vault Index from Settings, under Private Vault. The index lists your permanent file locations. The Recovery Kit opens files but does not contain a list of them. Keep a local copy of the standalone opening tool as well. Passkeys depend on the original app address; the Recovery Phrase and the open age format are the independent recovery path.

If every unlocker and every copy of your Recovery Kit is lost, nobody can recover the contents. Removing someone’s access cannot take back a secret or file they already copied.

I have a Recovery Kit that someone left me. What do I do?

Follow the steps at permavault.xyz/recovery-kit. If you can sign in to their account, open a locked file in History, press Unlock and choose "Use my Recovery Kit". If you cannot, save the offline opening tool and each locked file, found by the "Stored file ID" in their receipt emails or Vault Index.

What can other people see?

The public network shows that a private item exists, its approximate size, upload timing, transaction IDs and the Permavault private lane. The public anchor also links related stored items and the vault’s public recipient. It does not publish your readable contents, file name, original file type or plaintext hash.

Permavault keeps the link between your account and captures, along with payment records. During a private file upload we process the declared original type and size to check eligibility; the stored private metadata is encrypted. We hold wrapped key material, but cannot open a capture on our own.

What if I am asked to hand over a capture?

You can open and disclose one capture with its proof without handing over your Recovery Kit or the rest of your vault. Keep the locked originals and both manifests in the disclosure package. Private Capture offers no decoys, duress feature or promise of deniability.

Under legal process, Permavault can be required to produce the records it holds: account email, dates, stored sizes, transaction IDs, payment records, locked files and wrapped key material. Those records do not let us provide readable contents by opening a capture on our own. Private Capture does not prevent a legal demand made to you.

Will these files stay private indefinitely?

Private captures use widely reviewed encryption designed to resist today’s computers. Encryption ages. We record the method used with every capture and plan to adopt stronger methods as they mature. A capture is only as private as the encryption of its day.

The current open age format uses X25519. Anyone can retain the permanent locked bytes and try to break their protection later. Creating a new copy with a stronger method does not remove or protect the old copy retroactively.

Are the words in my kit connected to money?

No. The 12-word Recovery Phrase in your Recovery Kit is the spare key to your locked files. It is not money, there is nothing to buy, and it is not a password for anything else. Treat it like the combination to an office safe.

For the technically minded: it uses the same BIP-39 word list often called a cryptocurrency recovery phrase or seed phrase, with a documented Permavault-specific derivation. Never reuse a phrase from another service.

Which captures are private today?

Private Capture costs $9.99 for an uploaded file or a public web page, up to 100 MB. For a file you upload, your browser locks it before upload, so Permavault never receives a readable copy. For a web address, our capture server must read the page to record it, then locks every artifact to your vault before permanent storage and tries to remove its readable working files. A crash or a failed cleanup can leave them on the server until later cleanup, and cloud disks may retain traces despite deletion, so a private URL capture is not the right choice when the capture server must never see the page.

Article saves from the Permavault browser extension can be private too. The extension locks the save in your browser before upload, and we hold the locked copy free for 7 days. Making it permanent costs $1.99; an unpaid save is deleted when the 7 days end. The extension keeps its own readable copy on your computer.

For uploaded files, the proof records receipt of the locked file and a commitment to the browser’s sealed record. It does not establish who created the original file or whether its contents were true. A timestamp dates the committed value, not by itself the creation of a separate signature.

Can I open a large capture on my phone?

Opening a file needs room for both the locked and readable copies. Some large captures need a computer. If your phone refuses one, keep or download the locked file and open it on a computer using your Recovery Kit. The stored capture has not disappeared.

What happens when I delete my account?

Open Settings and choose Review account deletion. You need a recent sign-in and must confirm the deletion. Successful deletion removes your live account, sign-ins, stored vault unlockers, capture history and the temporary service copies associated with those records. Permanent copies and public anchors cannot be erased from Arweave. Anyone who kept your Recovery Kit and file locations can still open the locked files.

Before deleting, save your Recovery Kit and any receipts you need. The confirmation screen offers an optional Vault Index download. The index lists your permanent file locations and links your captures together; combined with your kit it is a complete route back to your files, so protect both.

Deletion pauses while requests, captures, payments or storage need to finish or be checked. Files we cannot safely associate with an account can require support cleanup. If cleanup fails partway through, some temporary files may already be removed; the account records remain so you can retry or contact support.

We retain limited payment and consent records where required. Stripe, receipt emails, backups and copies on other devices may still contain links to you or your captures. Deleting your account does not guarantee that those links disappear or that every copy of a secret is destroyed.