Evidence locker
saved checks and a PDF report.

01Saving a check

From a verdict, Save to the locker shows the check summary with two switches: keep the original message and keep the original file. The original stays encrypted on the phone.

• Keeping the text is on by default.
• Keeping the file is on by default for files up to 8 MB, and off above 8 MB, with the note "Large files take longer to encrypt, so keeping this one is off. Turn it on to keep it."
• Files over 64 MiB cannot be kept; the check itself can still be saved.

02What is never sent

The locker lives only on the phone, in the app's support folder (locker/). Nothing in it is uploaded to your server or anyone else: the locker code makes no network calls. The folder is excluded from iCloud and Android backups, so a backup carries none of it. A PDF leaves the phone only when the person exports it and picks where to send it in the share sheet.

03Encryption

• The index (the list of saved checks), each saved check and each kept file are encrypted with AES-256-GCM. The index is encrypted too, because the times, check types, answers and file names are sensitive.
• Files are split into 1 MiB chunks; every chunk has its own random 96-bit nonce and is bound to its place, its file, its position and an end-of-file flag, so chunks cannot be reordered, cut or moved between files.
• The app uses the platform's own AES-GCM on iOS and Android, and falls back to a pure Dart implementation on a background isolate elsewhere.
• Anything that does not decrypt cleanly (a wrong key, a changed or cut file) is refused: nothing half-decrypted is shown and nothing is overwritten.

File sizes, and whether a file was kept, can be guessed from the encrypted file sizes. The contents cannot be read.

04Key handling

• The 32-byte key is made on the first save and kept in the platform's secure storage (Apple's secure key storage on iOS, the Android Keystore). It is bound to this device's key store.
• Restoring onto another phone brings no key, so the locker starts empty there.
• If the Android Keystore is reset, the old files cannot be read any more; the app then offers Delete everything in the locker. If the key only cannot be read for a moment, the app says so and offers Try again, without a wipe button.
• The app lock (PIN or biometrics) guards opening the locker and every saved item. The lock is a gate in the app; the locker key is not derived from the PIN.

05Deleting

• Delete removes the item's encrypted files and its index entry. The key stays, so a forensic copy of the phone's storage taken earlier could still be decrypted with it.
• Delete everything removes every file and replaces the key. Nothing written before can then be opened.

06The PDF report

The PDF is made on the phone, only when the person taps Export. It contains:

• a header, and on every page the line "Automated risk signals, not proof" with the page number;
• what was checked, when it was checked and saved (local time with UTC offset) and the check reference;
• the summary, the three axes with their answers, every finding with its level, source, read time and link, and the "not checked" list;
• the attributions the providers require;
• the original content only when the person switches "Include the original content" on (off by default): text in full, JPEG and PNG images as pictures, and every kept file with its name, size and SHA-256.

Photos go into the PDF without their EXIF (location included), XMP, IPTC, MPF or appended data, and the PDF says so; the kept original in the locker stays byte-exact. Fonts are embedded, so Slovak and Czech characters print correctly; a character the fonts cannot draw (for example an emoji) is written as its code and the PDF says so.

The temporary PDF, and the copy Android's share sheet makes, are deleted when the share sheet returns, and both folders are swept at every app start. If the receiving app reads the file after the sheet closes, it may find it gone; export again.