Skip to main content
Genie9

Nygma Security & Zero-Knowledge Statement

Last updated: October 26, 2026

This statement explains what Nygma encrypts on your device, what Genie9 LTD (“Genie9”, “we”, “us”) can and cannot see, the limits you should know about, and how we handle requests from authorities. In Nygma, “zero-knowledge” means the contents of your drives and chats are encrypted on your device with keys we do not have, so we cannot read them. It does not mean we know nothing about you: section 3 lists what we can see.

It describes how Nygma works today. It is information, not a promise or a warranty; your use of Nygma is governed by the Terms of Service, including its limits on our liability. We may change our security measures at any time.

1. What is encrypted on your device

1.1 Your drives

  • Before anything leaves your device, Nygma encrypts the contents of your files, the names of your files and folders, thumbnails and previews, and file details such as the file type.
  • Each drive has its own drive password, which never leaves your device. Your device turns it into the drive’s master key with PBKDF2-SHA256.
  • Drives use AES-256-GCM on all plans, or ChaCha20-Poly1305 on the Professional plan and above. In the current format each part of each file has its own key (derived with HKDF-SHA256) and its own random nonce, and is bound to that file.
  • The keys that encrypt a drive’s files are stored on our servers only wrapped (encrypted) with the drive’s master key. To check your drive password, our server keeps only a verifier derived one way from the master key; it cannot unlock your drive.
  • Share links: your device encrypts the items for the link. The link password never reaches us.

1.2 Nygma Chat

  • Messages, photos, videos, files, voice messages, locations, reactions, edits and deletions are encrypted on your phone and can be decrypted only on the phone of the person you chat with.
  • The two phones agree keys with X25519 combined with ML-KEM-768, then keep changing them as messages are exchanged (a double ratchet). Messages are encrypted with ChaCha20-Poly1305 and padded to a fixed size.
  • Chats open with a Chats PIN; you can also require a drive password. A copy of your chat list is kept, encrypted, in a hidden drive in your account, opened only with your 24-word chat recovery phrase.
  • Notifications carry no content, sender or chat name.

1.3 In transit and on our servers

Connections use TLS (HTTPS), and the mobile apps pin our servers’ certificate authorities. Our servers are hosted by Amazon Web Services in the United States (us-east-1): encrypted files in Amazon S3 under random identifiers, our database in Amazon RDS, emails through Amazon SES.

2. Protecting your account and devices

  • Sign-in uses a one-time code sent to your email, or Sign in with Google or Apple. Repeated wrong codes are limited. On the web you can turn on two-factor authentication with an authenticator app.
  • Signing out ends your session on every device. Deleting your account needs a code sent to your email.
  • PIN: an optional 6-digit code for quick unlocking on a device; in the mobile apps it also needs your device’s biometrics. Our server checks a proof of the PIN and blocks PIN unlocking after repeated wrong tries. Drive passwords are also limited after repeated wrong tries.
  • App Lock: the mobile apps can require your device’s biometrics or passcode to open Nygma, and lock drives after a time you choose.
  • Screenshots: you can block screenshots and screen recording in the mobile apps’ Settings (off by default). Recovery words and revealed passwords are always protected.
  • Duress mode (paid plans): a duress password opens a decoy drive you prepare and locks every other open drive.
  • Trash: items you delete go to Trash, which is emptied automatically after 30 days.

3. What we can see

These are readable on our servers:

  • Your account: email address and name, how you sign in, whether two-factor authentication is on, your plan, subscription and billing records, the devices registered for notifications, and your choices such as “Offers & news”.
  • Drive names — do not put anything sensitive in a drive name.
  • Sizes, counts and times of files and folders, how items are arranged in folders (not their names), and whether an item is in Trash or a favourite.
  • Drive settings, for example whether a drive has a PIN or recovery phrase, and which drive is your Duress mode decoy.
  • Activity records, such as when a drive is unlocked (including with a duress password) and when files are added, moved or deleted, with IP address and device details; and server logs.
  • Share links: that a link exists, when it expires and how often it was opened.
  • Chat delivery information: random mailbox identifiers, arrival times, the fixed message size, push tokens and a daily count of chats and invitations created. Our database does not link your account to your chat mailboxes.
  • Anything you send us yourself, such as support emails, feedback, problem reports or abuse reports.

4. What we cannot see

  • the contents, names, thumbnails or details of your files;
  • your drive passwords, PINs, recovery phrases or share-link passwords; or
  • your chat messages, attachments, shared locations, or the names you and your contacts show each other.

We cannot search or scan the contents of your drives or chats, and we cannot reset a drive password or recover your files. If you lose both your drive password and its recovery phrase, your data is gone for good.

5. Limits you should know about

  • Your devices. Encryption cannot protect data on a device that has malware, has been compromised, or is used by someone else while a drive or chat is open. Offline copies on your phone are only as safe as your phone.
  • Weak passwords. Like any password check, a drive or share-link password can be attacked by guessing if it is weak. ChaCha20 drives created before Nygma 1.0 are cheaper to guess against. Use long, unique passwords.
  • PINs. A PIN has six digits. When you set one, the drive’s keys are also stored on our servers wrapped with a key made from the PIN, and sealed with a key held on our servers. Someone who had both our database and that server key could try every PIN. For the strongest protection, do not set a PIN on a drive.
  • Duress mode. It is designed for the moment someone forces you to open Nygma on your device. Our servers know which drive is the decoy and record when the duress password is used.
  • Files uploaded before Nygma 1.0 use our first format, which protects their names and image previews less well. To move a file to the current format, download it, upload it again, then delete the old copy and empty it from Trash.
  • The people you chat or share with can copy, screenshot or photograph what you send, even with disappearing messages or “Protect this chat”.
  • No system is perfectly secure. We do not guarantee that Nygma is free of vulnerabilities or will never be breached.

6. Requests from authorities

6.1 How we handle them

  • Genie9 is based in the United Kingdom. We respond to valid legal process under UK law. Requests from other countries should normally come through the UK authorities, for example under a mutual legal assistance treaty; we decide case by case whether we must or may respond.
  • We may refuse, challenge or ask to narrow a request that is invalid, too broad or unclear. When we respond, we provide only what the request lawfully requires.
  • If we believe in good faith that disclosure without delay is necessary to prevent death or serious harm, we may disclose the limited information we hold where the law allows.
  • We may tell users about requests for their information unless the law or a court prohibits it or doing so would put someone at risk. We do not promise to tell users in every case, or to publish statistics.
  • Requests must be in writing to legal@genie9.com and identify the account by its email address.

6.2 What we can and cannot produce

We can produce only what we hold — the information in section 3, within its retention period, and encrypted files and chat data exactly as stored, which we cannot decrypt. We cannot produce the contents or names of files, passwords, PINs, recovery phrases or keys, chat messages, or a list of who someone chats with. Our hosting provider could be asked for data directly; it holds the same information, with files and chats still encrypted.

7. Reporting a problem

  • Security vulnerabilities: email support@genie9.com with “Security” in the subject and the steps to reproduce. Do not access other people’s data, disrupt the Service, or publish details before we have had a reasonable chance to fix it. We do not offer rewards or promise a response time.
  • Abuse, illegal content and child safety: Report a problem in the app, or abuse@genie9.com. We acknowledge abuse reports within 48 hours.
  • If a personal data breach affects you, we will tell you and the regulator where the law requires.

Contact us

Support: support@genie9.com

Privacy: privacy@genie9.com

Data Protection Officer: dpo@genie9.com

Legal and copyright: legal@genie9.com

Abuse and child safety: abuse@genie9.com

Genie9 LTD · company number 08669198 · 3 Shortlands, London W6 8DA, United Kingdom

← All Nygma legal documents