Security

Built so we never need to read your secrets

FlickFly keeps the vault on your devices and encrypts what you flick before it leaves. Here is how that works end to end.

• 1
  Your vault stays on the phone

  Credentials, notes, links, documents, business cards, and authenticators live in on-device secure storage. Unlock with biometrics or your PIN — FlickFly does not host a readable cloud vault.

• 2
  Pairing creates a private channel

  When you pair phone ↔ browser (or phone ↔ phone), the devices agree on keys for that relationship. Only those paired peers can decrypt what you send.

• 3
  Flicks are end-to-end encrypted

  A secret is sealed on the sender before transfer. Our signaling relay may route or wake a device — it only ever sees ciphertext, not passwords or note text.

• 4
  This browser shows only what you flick

  The receive page is not your vault. It displays a short-lived copy you chose to send, then clears it so the screen does not keep secrets around.

• 5
  Optional backups are encrypted first

  If you back up to iCloud or Google Drive, FlickFly encrypts the vault on the device before upload. New backups are protected with your recovery code; your PIN confirms it is you. FlickFly never holds a readable copy.

• 6
  We cannot recover your PIN

  Save your recovery code when you set a PIN. It is the only way to reset a forgotten PIN — FlickFly staff cannot unlock your vault for you.

What we never see vs what signaling may see

We never need password text, note bodies, document bytes, or other secret values on FlickFly servers. The signaling service may see pairing and routing metadata (session IDs, device names you choose, device identifiers, public keys, connection IDs, and wake signals) so devices can find each other. Details are in the Privacy Policy and FAQ.

Crypto in brief

Pairing establishes a private channel between your devices. Each flick is sealed on the sender with modern, industry-standard encryption before it touches our relay. The relay forwards ciphertext over TLS — it is not designed to decrypt your payload.

Threat model (plain language)

Keeping the vault on your phone removes a mass cloud-vault breach target. Your own devices — phone and personal or work laptop — are where you unlock and receive. On a shared computer, Forget the browser (or unpair from the app) when you are done. Keep your recovery code offline so you can restore after a lost phone. Prefer in-person QR pairing. More in the FAQ.

Prefer the story with motion? See how it works · FAQ · Privacy Policy · Back to home