Security
Last updated 14 August 2026
Always is encrypted in transit and stored on access-controlled servers. It is not end-to-end encrypted today. That means your messages, drawings and photos sit on our servers in a form we could technically read — we don't, other than in the narrow cases listed below, but we are not going to pretend otherwise on a page called "Security". End-to-end encryption is the next big thing we are building, and this page will change the day it ships.
What protects your data today
Encrypted in transit
Every connection between the app and our servers uses TLS — HTTPS for the API, WSS for the real-time features like Thumb Kiss and the shared canvas. Nothing travels in the clear, on your Wi-Fi or anywhere between.
No passwords, anywhere
Always uses Sign in with Apple only. We never see, store or transmit a password, which removes the single most common way accounts get broken into. Apple's identity token is verified against Apple's public keys on our servers before an account is created. Sessions use short-lived access tokens with rotating refresh tokens, so a stolen token has a short life.
Access-controlled storage
Your content lives in a managed PostgreSQL database on Google Cloud (region us-central1). The database is not reachable from the public internet. Every API request is authorised individually, so content is only ever returned to the two people in a couple. Disks and backups are encrypted at rest by the cloud provider.
A very small attack surface
Always has no ad SDKs, no third-party trackers, no analytics vendor with access to your content, and no partner integrations. Fewer moving parts, fewer ways in.
Analytics that don't know who you are
Product analytics are keyed to a random identifier generated on your device, and some events also carry your couple id — which makes this data pseudonymous rather than fully anonymous. We do not collect Apple's advertising identifier (IDFA), so the app never has to ask you for tracking permission. Analytics never include the contents of a message.
Human access
Always is run by one person. Production access is used to keep the service alive and to fix bugs — not to browse your conversation. We look at stored content only when investigating an abuse report, when you ask us to debug something specific, or where the law compels us.
What we have not built yet
Being honest about this is the point of the page.
- End-to-end encryption. Content is protected in transit and at rest, but the keys are ours, not yours. A valid legal demand, or a serious enough breach of our infrastructure, could expose stored content.
- Independent security audit. No third-party penetration test or SOC 2 report exists. We are not going to imply one does.
- Self-service data export. You can delete everything from inside the app today; a downloadable archive is still a manual request to support@alwaysapp.cc.
On the roadmap
- End-to-end encryption for messages, drawings and photos, with keys generated and held on your devices — so that "we cannot read this" becomes a fact about the architecture rather than a promise about our behaviour.
- An in-app analytics opt-out.
- One-tap data export.
- An external security review once E2E ships.
What you control
- Nobody can contact you in Always without the six-character invite code you chose to share.
- Report & unpair in Settings ends a pairing instantly and sends us the report; we review reports by hand, as promptly as we can.
- Delete account in Settings removes your account, profile and stored content, and revokes the Apple sign-in link. Backups age out within 30 days.
- Use a device passcode and Face ID. The strongest protection on your conversation is still the lock on your phone.
Reporting a vulnerability
If you find a security problem, email support@alwaysapp.cc with enough detail to reproduce it. We aim to acknowledge within five business days and to keep you posted until it is fixed. Please give us a reasonable window before disclosing publicly, and don't access, modify or delete other people's data while testing. We can't offer a bug bounty yet, but we will credit you if you want the credit.