GUIDE · PRIVACY
Vault encryption:
zero-knowledge,
one toggle.
Vault is the feature that makes ZEDFINITY genuinely private: every file is encrypted on your device before upload, and the keys never leave it. Here is how to enable it and what it means in practice.
Enabling Vault
Open Settings and find the Vault encryption row — the padlock icon. Switch it on. The padlock turns green and the description updates to confirm that new uploads are encrypted on this device before upload. That is the entire setup; there is nothing to configure and nothing to remember.
From the moment it is on, every upload — manual or automatic — is encrypted locally before it leaves your device. Files uploaded before you enabled Vault stay as they were; Vault protects new uploads from that point forward.
What actually happens to a file
When you upload a photo with Vault on:
- ZEDFINITY derives strong encryption keys on your device — the keys are never sent to Telegram, to ZEDFINITY, or anywhere else.
- The photo is encrypted locally using XChaCha20-Poly1305 authenticated encryption — an open, widely audited construction from the libsodium library.
- Only the encrypted bytes are uploaded to your cloud storage.
The stored data is unreadable ciphertext. When you open or download the photo, it is decrypted locally and appears exactly as it was. If anyone else — including Telegram or ZEDFINITY — looked at the stored bytes, they would see noise without your keys.
What Vault does and does not change
Vault protects the contents of your files. It does not hide that your account exists, which is true of every cloud service. Your files remain subject to Telegram's availability and terms of service, and ZEDFINITY remains an unofficial Telegram client that is not affiliated with Telegram FZ-LLC. What Vault guarantees is simple and absolute: the contents of your stored files are unreadable without your device.
Vault and your two-step password
ZEDFINITY derives vault keys from secrets tied to your device and your account's two-step verification password. That is why the sign-in screen tells you when two-step verification is "required to finish sign-in — your vault key is derived from it." Keep your Telegram two-step password safe: it is part of what makes your vault recoverable.
If you lose your device
A lost phone does not mean a lost vault. Sign in on a new device and use ZEDFINITY's recovery flow to restore access to your vault. This is why the recovery setup in the Security Center is worth completing — it is the difference between an inconvenience and a lockout.
Plain uploads, for completeness
Vault is optional. If you turn it off, new files upload as plain documents with readable names — still stored in your own cloud, still private from ZEDFINITY (which has no servers), but readable at the storage layer by whoever can access your Telegram account. The app is explicit about this trade-off in Settings: encrypted is "recommended", plain is "less private".
One toggle, real privacy. Open Settings and turn Vault on — then everything you store is for your eyes only. Questions? Ask the developer.