Where to store photos so nobody can see them

What “nobody can see them” really means

Everyone promises “your photos are protected”. Three questions test the promise:

• Where is the file encrypted? On your device, before sending — then the server receives only bytes. “On the server” — then the server has seen the original.
• Who holds the key? If the company does, it can open the file: on request, by mistake, after a breach. If only you do, it can't, even if it wanted to.
• Can you check? An honest service shows you what exactly sits on the server.

And two questions about life rather than cryptography: what does someone see who picks up your phone, and what happens to the photos if the phone is lost.

How the usual options compare

• Your phone's gallery. Anyone you hand the phone “to look at photos” sees everything. Lose the phone and the pictures go with it.
• Google Photos. Files sit on Google's servers, Google holds the keys. Pictures are analysed on the servers — faces, objects, places: that's how search works.
• iCloud. By default Apple holds the keys. End-to-end encryption for photos exists — “Advanced Data Protection” — but it's off by default.
• Encrypted clouds — Proton Drive, Ente, My Albums. The file is encrypted on the device, you hold the key. They differ in price, convenience and where the app lives: My Albums opens inside Telegram, nothing to install.

How it works in My Albums

• Encryption on the phone. Photos, videos, captions, dates, places and people tags are encrypted (AES-256-GCM) before they're sent. The server stores bytes and knows only how many files you have and how big they are.
• Only you hold the key. It's created on your device and kept in your Telegram account; it never reaches our server. Plus a 52-character recovery code in case you lose the phone.
• Faces and search — on the phone. Your phone recognises the pictures. “Lake” or “mom” will be found, but no faces and no words go to the server.
• You can check it. The “Verify it yourself” page shows what exactly sits on the server and how to confirm it without our help.

When someone picks up your phone: the secret album

Passport scans, medical papers, photos of the kids — things even a person you hand the phone to for a minute shouldn't see — go into a secret album. It opens only with its own password and locks again when you leave the app. The other albums stay as they were.

If the phone is lost or broken

Sign in to the same Telegram on a new phone — the key is picked up from the account, the photos are there. If access to Telegram is lost too, the recovery code gets you back in. The flip side: without the key and without the code nobody can open the photos, us included. That's why the code is saved right away — the app reminds you itself.

If something happens to you

You can name a trusted person. If you don't open the archive for 3, 6 or 12 months — you choose the term — they get access to the photos, for viewing and downloading only. Until then nobody can assemble the key: it's split in two halves, one locked for the trusted person, the other waiting on the server for the term to run out. Any sign-in of yours resets the countdown.

How to get started

1. Open @MyAlbumsBot, tap “Start”, then “Open photos”. The key is created by itself, right on the phone.
2. Upload your first photos: “Upload” → “Choose photos or videos”. After that a card with the recovery code appears — send it to your Telegram “Saved Messages” with one tap.
3. Documents and private things go into a secret album: “⋯” on an album → “Make secret”, set a password.
4. Want to show some photos to family — make a shared album: its key goes only to the members you approve.

You don't have to take our word for it: open any photo → “How it looks on the server”. You'll see what's stored — an encrypted file, not a picture.

FAQ