Your secrets stay yours.
Passwords, cards, IDs, codes and medications are locked on your iPhone before they're saved or backed up. Not OHPI, not the AI: only you can open them.
Four principles
Locked on your phone
Locked things are encrypted on your iPhone and open only with Face ID or your passcode.
The AI sees labels, not secrets
It knows you have a Netflix login. It never sees the password.
We can't read them
We never hold your key, so we couldn't open them if we tried.
Built on Apple's security
OHPI uses the encryption built into iPhone, not homemade code.
What happens when you send a message.
- 1
You type "Netflix login: [email protected], password sunflower22."
- 2
Before anything leaves your phone, OHPI spots the secret and splits the message.
- 3
The login is locked on your phone. Only the label "Netflix" goes on.
- 4
Later you ask "what's my Netflix login?" Your iPhone answers it: Face ID, and the login opens right there. The question is never sent.
Not sure if something is a secret? OHPI asks "Is this a password?" You can also add anything to a locked list yourself.
What we can and can't see.
Locked things
- What it covers
- Passwords, Cards, IDs and Codes; medications; insurance numbers and insurance card photos
- How it's protected
- Encrypted on your iPhone before they're saved or backed up. Only your devices hold the key.
- Can the AI see it?
- Never. At most a label, like "Netflix"
- Can OHPI see it?
- No. Our server stores them locked.
Everything else
- What it covers
- Groceries, to-dos, appointments, notes, Tracker and the rest
- How it's protected
- Encrypted on the way. On our server, only your account can read or change them.
- Can the AI see it?
- The parts it needs to file and answer, when the AI is on
- Can OHPI see it?
- Only to run the app. We never sell it.
What OHPI's AI sees.
- OHPI uses Claude, an AI made by Anthropic, to file what you add and answer your questions.
- Before anything is sent, your iPhone takes out passwords, card numbers, ID numbers and medications, and locks them on the phone.
- Claude never sees anything locked, your name, your email or your login.
- OHPI doesn't train any AI on your data. Anthropic doesn't train on what OHPI sends, and deletes it within 30 days.
- OHPI asks before anything goes to the AI. Say no, or turn it off anytime in Settings → Privacy & Security, and every list still works by hand.
Get back in without a headache.
Your everyday lists come back as soon as you log in on a new iPhone. Your locked things need their key, which OHPI never has. Three ways to bring it over:
- 1
iCloud Keychain.
If it's on, your key moves to your other Apple devices by itself. Open your locked lists with Face ID and you're in.
- 2
Approve from another device.
Your new iPhone shows a 6-digit code. Type it on an iPhone that already opens your locked things, then use Face ID there.
- 3
Recovery key.
You get it once, when you first set up locked lists. Keep it somewhere safe and offline. Using it gives you a new one.
Plain truth: If you lose every device and your recovery key, your locked things can't be recovered, not even by us. That's the price of nobody else holding the key. You can start over with an empty Vault; your everyday lists aren't affected.
The everyday stuff, done right.
Your OHPI password doesn't open locked things.
Someone who learned it could see your everyday lists, but not your passwords, cards, IDs, codes or medications.
Locked lists close on their own.
After 5 minutes open (choose 1 minute to 1 hour), or right away when you leave OHPI if you turn that on. A copied password clears after 60 seconds.
Strong passwords.
New passwords need at least 8 characters, with a lowercase and a capital letter, a number and a symbol. Changing it logs you out everywhere else.
Your data is yours.
Export a copy of your everyday lists from Settings → Your data. Delete account permanently deletes everything, locked or not.
What we can't promise.
No app is perfectly secure. Here's where OHPI's protection has limits, so you can decide what to keep in it.
- Catching passwords is a best guess. One typed with no clue ("netflix sunflower22") might be saved as an ordinary item. To be safe, add it in Passwords or say "password".
- Your iPhone's passcode can stand in for Face ID. Keep it to yourself.
- Labels stay readable, so your lists show without Face ID: names, websites, a card's last 4 digits and expiry dates.
- Everyday lists are readable by OHPI and its AI. Keep anything secret in a locked list.
- OHPI will have an outside security review before it launches publicly.
For the technical
- Locked data
- Sealed on the phone with AES-GCM under a random 256-bit Vault key (Apple CryptoKit), with each item's ID bound in, so a sealed value can't be moved to another item
- Key storage
- iOS Keychain, synced by iCloud Keychain (end-to-end encrypted by Apple); the app asks for Face ID before using it
- Recovery key
- 120 random bits, shown once; it seals a backup copy of the Vault key (HKDF-SHA256, AES-GCM) that OHPI can't open
- Device approval
- One-time Curve25519 keys, a 6-digit code to confirm the right phone, Face ID on the approving device; requests expire after 10 minutes
- Secret detection
- Rules on every message on the phone; Apple's on-device Foundation Models as a second opinion on borderline ones (iPhone 15 Pro and newer); otherwise OHPI asks
- Server
- Supabase (Oregon, US); row-level rules let each account reach only its own items and photos
- AI provider
- Anthropic's Claude API, called only from OHPI's server; the app never holds the AI key
- Found a problem?
- Tell us at [email protected].