← All documentation

How your photos are protected

Fixative is built so that your photos stay yours and only yours. That strength comes with a responsibility it hands to you, and it’s better to understand it now than to discover it later. This page explains where your photos live, what protects them, and — honestly — what Fixative can and cannot do for you if something goes wrong.

Everything stays on your device

Your photos, their thumbnails, and the details about them are encrypted and stored on your own device. There is no cloud copy, no account to sign into, and no Fixative server that holds your photos or your keys. Nobody can hand your photos to anyone else, because nobody else ever has them.

When you add another device, the two talk to each other directly over your local network to share photos and changes. Even then, your content never passes through a company in the middle. This is why syncing only happens while both devices are open and on the same network, rather than quietly in the background from anywhere.

Your passphrase is the key to your full-quality originals, and Fixative never stores it anywhere it could later read it back. That is what keeps your originals private — and it’s also the root of the trade-offs below.

What Fixative can and cannot recover

It helps to separate the two things you unlock with, because they behave very differently when lost.

Your PIN is recoverable. If you forget it, you can reset it in place using your passphrase or your recovery shares, and no photos are lost in the process. See How to regain access if you forget your PIN.

Your passphrase is not recoverable. Because Fixative never keeps a copy it could read, there is no “forgot passphrase” button and no one — including Fixative — can reset it for you. Your recovery shares are the one way back: using them lets you set a brand-new passphrase and regain access. They never reveal your old passphrase; they replace it. This is why setting up and safely storing your recovery shares matters so much — see How to set up your recovery key. It’s also why the two-unlock design exists in the first place: Why Fixative has two ways to unlock.

The honest limit

The same design that means no company can be forced to unlock your photos also means no company can save you if you lose every way in.

Your photos become permanently unrecoverable if you lose all of these at once: every device you’ve set up, your passphrase, and your recovery shares. There is no master key held in reserve. A backup of the encrypted files alone won’t help — without a device that’s still set up or your recovery shares, the files can’t be opened. Fixative also erases the vault from a device after too many wrong PIN guesses; that’s recoverable from your shares or another device, but only if you have them.

This is a genuine trade-off, not an oversight. A cloud-account app could email you a reset link — but only because it holds keys to your photos, which is exactly what Fixative refuses to do. Fixative chooses the stronger privacy and asks you to keep the safeguards. Your recovery shares are those safeguards.

What this means for you

Treat your recovery shares as the thing that makes everything else recoverable, and store them carefully and separately. If you’ve been putting that off, it’s the most valuable few minutes you can spend in the app: