Technical details
For people who like to know how things work. ZOOMRIYA is still being built, so parts of this page describe the plan; those parts say so.
What runs on the box
Everything runs on the box itself. There are no cloud AI services.
| Part | What it does |
|---|---|
| SvelteKit | The web apps you use in the browser and inside the phone app |
| FastAPI (Python) | The services behind each app |
| PostgreSQL | Albums, people, documents and messages; one database per app |
| Redis | Passing events between apps, such as "new photo ready" |
| Qdrant | Finding similar images and faces quickly |
| SigLIP | Image search in plain words, like "birds from our walks" |
| Face recognition models | Grouping photos by person |
| Gemma, via llama.cpp | The assistant you can ask to find or sort photos |
| Debian, systemd | The operating system and the services that keep it all running, with safe updates and rollback |
How your phone reaches the box
- At home, your phone and computer find the box on your Wi-Fi and talk to it directly.
- Away from home (planned for late 2027), the phone finds your box by the key it learned when you scanned the QR code, and connects straight to it with an end-to-end encrypted link.
- When a network blocks every direct path, traffic goes through ZOOMRIYA Connect, a relay that passes on encrypted bytes it cannot read. It carries only small traffic: previews, messages, locations. Big downloads and backups wait for a direct connection or home Wi-Fi.
- Every connection is checked against the key from pairing, so neither ZOOMRIYA Connect nor anyone else can pretend to be your box.
- You can turn ZOOMRIYA Connect off and use the box only at home, or use your own domain instead.
Direct, end-to-end encrypted
the usual path, at home and away
- 1 · At home: found on Wi-Fi
- 2 · Away: look up the box by key
- 3 · Connect directly, relay if blocked
What works where
| What | At home | Away from home |
|---|---|---|
| Location, chat, notifications | Yes | Yes, on any network |
| Browsing photos | Full quality | Fast previews; full size on tap |
| Photo backup | Automatic | On Wi-Fi when travelling; mobile data only if you allow it |
| Videos and big downloads | Full quality | Lighter versions, or wait until you're home |
Encryption
| What | How it's protected |
|---|---|
| Family Vault | Each file has its own key, locked behind your personal PIN. A recovery key is printed once, at setup. |
| Private one-to-one chats | End-to-end encrypted with a proven, published protocol library. Keys exist only on the two people's devices; the box stores ciphertext it cannot read. Phone app only at first. |
| Family group chats | Encrypted on the box's disk with a key the box holds. |
| Connections away from home | End-to-end encrypted between your device and your box, whichever route they take. |
| Notifications | Contain no content, only "something new". Your device then fetches the details from your box. |
We also recommend full-disk encryption on the box itself.
What's open to inspect
The parts that protect your privacy will be published, with builds anyone can check: the phone app, the encryption code, the connection between your phone and your box (including ZOOMRIYA Connect), and the box's network layer. The app features themselves stay closed. An independent security review is planned before the first box ships, and will be published in full.
What leaves your home
Your photos, documents, messages and locations stay on your box. The box will have a Network activity page listing every outside connection it makes and why, each with an off switch, plus a strict offline mode that turns them all off. The possible ones are:
- ZOOMRIYA Connect, if you use access away from home
- Content-free notifications through Apple or Google, if you turn them on
- Place names for photo locations (from OpenStreetMap), if you turn them on
- Software updates
You can check this yourself on an iPhone: iOS's App Privacy Report lists every place each app connects to. For ZOOMRIYA it should show only your box and ZOOMRIYA Connect.
The honest limits
- Family group chats: the person who owns the box (its admin) can access them, because the box holds that key. Private one-to-one chats don't have this limit.
- Private chats live on phones only at first. A new phone gets its keys from an existing one by QR code; lose every device and that chat history is gone. The box can't search them.
- Notifications, if you turn them on, tell Apple or Google that something arrived, never what or from whom.
- ZOOMRIYA Connect sees which device talks to which box, plus IP addresses and timing. It never sees content.
- Family Vault files can be read only while you have it unlocked with your PIN. If you lose both your PIN and the recovery key, your vault cannot be opened, by you or by us.
- Guest links record when they were opened, so the person who shared an album can see it was watched.
- Speed away from home depends on your home internet's upload speed, which is usually much slower than its download.