In August 2022, my friend's father in San Francisco took a couple of photos of his toddler's groin for a video call with the pediatrician. His kid had an infection, the doctor wanted to see it, so he did what any parent with a smartphone does now - he snapped the picture and sent it along. Those photos backed up to Google Photos automatically, the way photos do.
Two days later, Google flagged the images as child sexual abuse material. His account - email, contacts, photos, in some cases his phone number through Google Fi - was disabled. Police opened an investigation. It took months, a cleared investigation, and a New York Times story by Kashmir Hill before anyone really reckoned with what had happened: an automated system looked at a private photo on his phone, decided it knew better, and blew up a man's digital life over it. He got his account back. A lot of people who read that story never fully trusted "the cloud" the same way again. I was one of them.
Here's the thing that story quietly reveals: your cloud provider can see your photos. Not "might see them if subpoenaed." Not "in theory, with a warrant." They can see them right now, today, because they hold the key. Scanning for CSAM is the defensible use case everyone points to. But the same architecture that lets Google scan your kid's medical photo is the architecture that means a data breach exposes plaintext, an employee with the wrong access can look, a government request gets a "yes" instead of a "we literally cannot," and an algorithm gets to make a life-altering call about a photo it was never asked to judge.
We just… accepted that. "Encrypted" became a word on a settings page that meant almost nothing, because encrypted in transit and encrypted at rest both still mean someone else holds the key that unlocks it. It's the digital equivalent of a landlord who swears he'll only use his spare key "for emergencies."
So I built the version where that spare key doesn't exist
Memories on Cloud is a photo and video backup app for Android. On the surface, it does the boring, expected thing: it backs up your camera roll automatically so you can wipe your phone's storage without a knot in your stomach. That part isn't the interesting bit - every app in this category does that part.
Here's the part that's actually different: the encryption happens on your phone, with a key only you have, before a single byte leaves your device. Our servers receive ciphertext. Not "encrypted data we can decrypt if we really need to" - ciphertext, full stop. There is no master key sitting in a database somewhere that unlocks your account if we get compelled, breached, or curious. We built it so that the honest answer to "can you see my photos" is no. Not "we promise not to." No, structurally, we cannot.
If you lose your passphrase and your recovery document, by the way, we can't get your photos back either. That's not a bug we haven't fixed. That's the whole point, and it's the trade-off zero-knowledge architecture actually demands - real privacy doesn't come with a customer-support backdoor, because a backdoor for you is a backdoor for everyone.
A few other things, because I think the details matter more than the pitch:
Auto-backup runs quietly over Wi-Fi by default (mobile data is opt-in, for people who don't want to babysit their data plan), so this is meant to disappear into the background, not become another app demanding your attention.
Unlocking the app is a fingerprint or your screen lock - the strong encryption story doesn't have to mean retyping a 20-character passphrase every time you want to see your own vacation photos.
Multi-device is a first-class thing, not an afterthought - you can see exactly how much storage each of your devices is using, and sign a lost or stolen device out remotely.
It's free to start. Storage plans exist for people with large libraries, but the encryption itself - the part that actually matters - was never going to be something we paywalled. Privacy shouldn't be a premium tier.
Why this took actual architecture, not a marketing decision
I want to be straight about something: "zero-knowledge" gets used loosely in marketing copy across this industry, so I don't expect anyone to take my word for it. What it means concretely, in this app, is that the AES-256 encryption key is derived from your passphrase on-device and never transmitted anywhere. The server's entire job is to store and serve back opaque encrypted blobs - it has no code path that produces plaintext, because it never has the key to do so.
That constraint shapes almost everything else. Password reset can't be "click here and we'll email you a link" the normal way, because there's no normal way to reset something we never held. Customer support can't say "let me just pull up your account and take a look," because there's nothing to look at. Every one of those moments is a little more friction than the industry standard - and every one of them is the actual price of the thing we're claiming to offer. I'd rather ship that honest trade-off than ship the version that quietly keeps a spare key "just in case."
Watch it in under a minute
I put together a short walkthrough that shows the actual flow - backup, encryption, and how the subscription side works - rather than just describing it in prose:
▶ Watch the 10-second walkthrough on YouTube
Try it
Memories on Cloud is live on the Play Store. It's free to start, the encryption is never a paywalled feature, and if you've ever had that flicker of doubt about who else can see the photos sitting in your "cloud" - this was built for exactly that feeling.
📲 Get Memories on Cloud on Google Play
If you've read this far: I'd genuinely rather hear the skeptical questions than the polite ones. If something about the "we can't see your photos" claim sounds like it can't possibly be true, ask me directly in the comments - I'll answer with specifics, not marketing language. That's kind of the whole premise of building something this way in the first place.
Zero-knowledge encryption is our entire pitch. Break it, and 50% of this company's revenue is yours.
Top comments (0)