Frequently Asked Questions

Sino is a private vault for your phone and PC. It encrypts your photos, videos and documents on your own device, then backs them up to cloud accounts you already have, like Google Drive or MEGA. The cloud stores your files, but it cannot open them. Only you can, with your password, your fingerprint or face, or your 24-word recovery phrase.

No. Your files are encrypted on your device before they are uploaded, and the keys that open them are never given to anyone. Sino runs no servers and keeps no copy of your keys, and your cloud provider only ever receives scrambled data. Not us, not your cloud provider and not your internet provider can see your files, their names or your folders.

Google Drive, MEGA and any S3-compatible storage (Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO and others). You can connect several at once and choose which clouds each folder goes to. You use your own accounts, so there is no extra storage subscription from Sino. On Google Drive, Sino asks for one narrow permission: either Drive's hidden app folder or, in Visible mode, only the SinoVault folder it creates.

Yes. Sino for Windows 10 and 11 has the same vault, backup and recovery as Android, and both work with the same vault. Your unlocked vault can also appear as a Windows drive (the first free letter from S:), so you can open your files in any Windows app. Its keys are protected by your PC's TPM 2.0 security chip, or by Windows itself when there is no TPM, and it can unlock with Windows Hello.

A place to keep files only inside Sino. Add or move files in and they are stored encrypted in Sino's private storage, out of reach of your gallery, file manager and other apps. You can make folders and subfolders. Each folder is either kept on this device only or backed up to the clouds you pick. Files kept on this device only are lost if the device is lost (or, on Android, if Sino is uninstalled), so back up anything you cannot lose.

A backup folder is a folder you already have, like your Camera: your files stay where they are, and Sino keeps an encrypted copy in your clouds. The Local Vault is for files you want hidden: they move into Sino and live only there, encrypted. Both open in Sino's viewer, and both can be restored on a new device when they are backed up.

Install Sino on a new device and restore with your 24-word recovery phrase (or a recovery passkey). Sino downloads the encrypted recovery backup from your clouds, opens it with your phrase, and brings back your library. Then, from the new device, revoke the lost one: the next time it connects, it erases Sino from itself, even if it is locked. Also change your master and cloud passwords, since revoking cannot take back files that device already decrypted.

Only from a device that still has your vault and that you can unlock, or with a recovery passkey you set up. Sino keeps no copy of your keys and has no back door, so if you lose your recovery phrase, your passkey and every unlocked device, nobody can open your vault, including us. Write your 24 words down and keep them somewhere safe and offline.

No, and that is on purpose: a company that can reset your password can also get into your vault. If you forget your master password, restore your vault with your 24-word recovery phrase and set a new password.

Before anything is uploaded, every file and folder name is replaced with a scrambled code that only your devices can work out (a salted HMAC-SHA256 hash, called Obscura Tree). The real names, sizes and keys are kept in encrypted file lists. On your device, Sino's database is encrypted as a whole, and its most sensitive fields are encrypted again.

Mostly, yes. Without a connection you can unlock Sino, search your library, open Local Vault files and files still on your device, and add files to the Local Vault. Backups wait and upload on their own when you are back online. Files that are only in your clouds need a connection to open.

You decide. Turn on Wi-Fi only to keep backups off mobile data, and Charging only to run large uploads only while charging. Interrupted uploads resume where they stopped instead of starting over. One check always runs regardless of these settings: whether this device has been revoked, so a lost phone still erases itself.

Yes. While Sino is unlocked, your vault appears in the Android Files app, or as a drive on Windows. Apps open files from it decrypted on the fly, in memory. In Local Vault folders, apps can also save new and edited files, which Sino encrypts before storing. When Sino locks, the drive closes.

PhantomVault is a decoy. Set a second password, and entering it opens a separate, fully working vault instead of your real one. The decoy has its own keys, its own database and its own cloud folders, and every install of Sino looks the same whether or not it has one. Keep a believable decoy, so it does not look empty. The decoy is tied to that one device and cannot be recovered elsewhere.

They wipe Sino from this device in an emergency: Sino locks, destroys the keys in the device's security chip (so anything left can never be decrypted), deletes its databases and files, and closes. On Android, the Panic Widget does this with one tap and no confirmation. Your cloud backups are not touched, so you can restore with your recovery phrase later. Deleting your cloud data is a separate action, Wipe Cloud, in the Cloud Hub.

Someone could record encrypted data today and hope to break it years from now with a quantum computer. Sino protects against this: your files use AES-256, which stays strong even against quantum computers, and the keys that let your devices open your vault are protected with the new NIST post-quantum standards (ML-KEM-768, FIPS 203, and ML-DSA-65 signatures, FIPS 204).

Yes, with Legacy Handover. Pair trusted people as beneficiaries (by QR code, NFC or link, confirmed with a code you compare). If you do not unlock Sino for a time you choose (30 to 180 days on Android; 1 to 12 months on Windows), or whenever you hand over manually, they can claim your vault. The handover is sealed in advance so that only their device can open it. Sino can also make a printable Legacy Kit with instructions for them.

It can. With Privacy Metadata Scrubbing on, Sino removes location and device details from photos and videos before encrypting them. A file it cannot clean safely is held back and never uploaded with its details, until you decide what to do with it.

Yes. The free, open-source Sino Open SDK can decrypt a downloaded copy of your SinoVault folder with your 24-word phrase alone, offline, and check every file. So your files never depend on our app staying available.

The Sino apps are proprietary, paid software. The Sino Open SDK, which reads, checks and recovers Sino vaults, is open source under the MIT license, so anyone can verify how your data is stored and recover it independently. Sino's cloud format is published in its specification.

Yes. You can register a recovery passkey (fingerprint, face or PIN, through Android's Credential Manager or Windows Hello). On a new device, the passkey unlocks an encrypted copy of your recovery phrase stored in your clouds, so you do not have to type the words. Keep the written phrase as well, in case you lose the passkey.

Yes. Sino can find archived vault backups in your clouds (SinoVault_Backup_*), check your recovery phrase against one before using it, and switch to it as your active vault. Switching replaces the library on this device, so make sure your current vault is backed up first.

Sino is designed to support them: your data is encrypted on your device before it reaches any cloud, we collect no personal data, and once every copy of a vault's keys is destroyed its data can no longer be read (cryptographic erase). Whether your organisation's use is compliant also depends on your own policies and agreements. See the Compliance & Standards Portal for details.

Please report it privately: through GitHub's private vulnerability reporting on the Sino Open SDK, or by email to support@sinosecure.app, encrypted with our PGP key (Key ID 741269C3, fingerprint 7B52 729E E9A9 1445 D9BE 1F46 AEEE B140 7412 69C3). Please do not disclose it publicly until a fix is available. See how to report a security problem.

An Android phone or tablet with Android 10 or later, or a 64-bit PC with Windows 10 (version 1809 or later) or Windows 11, plus an account with Google Drive, MEGA or S3-compatible storage. Everything else, like a TPM security chip, Windows Hello or the Dokany driver for the S: drive, is optional. See the full system requirements, then set up Sino in five minutes.

For personal use, Sino for Windows is free and Sino for Android is a one-time purchase on Google Play, with no subscription. The purchase works on every Android device signed in to the same Google account. Businesses and other organisations, including sole traders and freelancers using Sino for work, need a business subscription, priced in tiers by the size of the organisation; it covers each licensed person on Windows and Android. Prices are shown at purchase. Either way, your cloud storage is your own account, so Sino adds no storage fees. See section 13 of the Terms of Service for details.

Your files are never locked in. First get them back as ordinary files: restore your backed-up folders to your device in normal (not Secure) mode, and export your Local Vault files. If you also want Sino's encrypted data gone from your clouds, use Wipe Cloud in the Cloud Hub. Then uninstall Sino, which deletes everything it kept on that device, including Local Vault files that were never backed up. Even without the app, the open-source Sino Open SDK can decrypt your cloud backups with your 24 words.