How it works

Shoal uses two layers of AES-256-GCM keys. Every family has a family key, and every conversation has its own conversation key.

Message text, reactions, photos, videos, voice notes and the names shown in a chat are encrypted on the sending device with the conversation key, and decrypted on the recipients’ devices. Our servers store and route that content only as ciphertext, and never decrypt it in normal operation.

The conversation key is wrapped under the family key of each family in the conversation, and family keys are stored on our servers, encrypted under a root secret. When you sign in, our servers unwrap your family’s key and send it to your device over TLS.

What this means in practice

  • A leaked database is just ciphertext. Someone who copies our database or file storage, without our root secret, can’t read your family’s messages, names or pictures.
  • Network eavesdroppers see nothing useful. Traffic uses TLS, and the content inside it is encrypted again.
  • Families stay separate. A family’s key never leaves that family. When your child chats with a Connection in another family, only that one conversation’s key is shared.
  • Lose a phone, sign it out. Signing a device out from Settings stops it receiving new messages. Messages already on it can’t be recalled, so use a screen lock.

Is Shoal end-to-end encrypted?

No, and we’d rather say so plainly. End-to-end encryption — the Signal model — means only the people in a conversation hold the keys, and even the operator can’t read messages. Shoal deliberately isn’t built that way. Because our servers hold the root secret, a way to decrypt any message could be built — and so we could be legally required to build one.

So we don’t call Shoal end-to-end encrypted or “zero-knowledge”. Neither would be true.

Can Shoal staff read our messages?

No. Shoal staff can’t see your messages, photos, voice notes, names or pictures. In our database they exist only as ciphertext, and no code path exists today — no admin tool, no support screen, no server routine — that decrypts them. Our servers handle keys only to deliver them to your family’s own devices and to set up new conversations, and the root secret isn’t exposed in normal staff workflows.

Staff can see the unencrypted service data needed to run Shoal, such as your email address, account IDs and how they link to families and conversations, children’s skin and active-hours settings, message and read times, and device details. The privacy policy lists it in full.

Why we chose this model

An end-to-end design can’t offer what Shoal exists to provide: parents who can see their children’s conversations, and a way back into your family’s history if you lose every device. Holding the keys makes both possible. It’s a trade-off, and we think parents should be able to see it clearly — the security page and privacy policy set out exactly what it protects against and what it doesn’t.