Privacy & Security
BrightBlur treats its own server as untrusted. All sensitive face operations happen on your device. The server stores a safe, permanently redacted base image alongside encrypted face data it cannot read.
What happens on your device
Section titled “What happens on your device”- Face detection — AI models run in your browser via WebAssembly. No image data is sent to the server for detection.
- Face recognition — fingerprints (embeddings) are computed locally and encrypted before upload. Matching happens entirely on your device.
- Encryption — clear face slices, biometric fingerprints, captions, and comments are encrypted before they leave your device. The permanently mosaicked base is the safe public layer of the BBP file format.
- Decryption — when you view a photo, your browser fetches encrypted blobs, decrypts them locally, and composites the faces in real time.
What the server stores
Section titled “What the server stores”The server holds the plaintext-redacted base image plus encrypted face slices, biometric fingerprints, captions, comments, and keys. It can therefore see the redacted scene — bodies, clothing, setting, and how many faces were mosaicked — but it cannot recover clear faces, read captions or comments, or inspect biometric fingerprints. It can also read account and access metadata such as your email, group names, membership lists, timestamps, and sharing relationships. The Privacy Policy lists the full set of server-visible data.
BBP redacted-base update
Section titled “BBP redacted-base update”Photos published or migrated to the BrightBlur Protocol (BBP) store their permanently mosaicked base as the ordinary image layer of the file. Access through BrightBlur remains protected by the serving ACL, but the redacted scene is no longer protected by content encryption. If someone exports or leaks the BBP file, any holder can see that redacted scene; the encrypted face entities remain unreadable without their keys.
This is a deliberate portability trade-off: a standard image viewer can always show the safe privacy floor, while a BrightBlur-aware viewer can restore only the faces its user is authorised to open. Older BrightBlur photos encrypted the whole redacted base as well as the faces.
Hybrid post-quantum encryption
Section titled “Hybrid post-quantum encryption”BrightBlur uses two encryption schemes simultaneously:
- X25519 — a classical, battle-tested elliptic curve scheme.
- ML-KEM-768 — a post-quantum scheme standardised by NIST.
Both key exchanges happen independently and their shared secrets are combined. An attacker would need to break both to read your data. This means that even if a quantum computer capable of breaking X25519 is built in the future, data encrypted today remains safe.
Key storage
Section titled “Key storage”Your private keys are derived entirely on your device from a seed. The seed is wrapped by your passkey’s PRF output and stored on the server — but the server cannot unwrap it without the PRF secret, which only your device’s authenticator can produce. Your 12-word recovery phrase is an alternative way to regenerate the seed if you lose access to your passkey.
During an active session, your browser keeps the wrapped seed and the PRF key in IndexedDB; the unwrapped seed itself exists only in memory, never in storage. Both the wrapped seed and the PRF key are cleared from IndexedDB the moment you log out, and the server never sees your private keys at all.