Security & privacy
What we do, what we don't, and why.
Messages are encrypted in storage. Family admins can read children's chats — that's how the safety features work. Here's exactly what that means, including the parts other apps leave out.
The model in two paragraphs
Shoal uses server-assisted envelope encryption with two layers of AES-256-GCM keys. Every family has a family key and every conversation has its own conversation key. Message text, reactions, photos, videos, voice notes and the names shown in a chat are encrypted on the sending device with the conversation key and decrypted on the recipients' devices. Our servers store and route that content only as ciphertext, and never decrypt it in normal operation.
Shoal holds the keys. Conversation keys are wrapped under each participating family's key, and family keys are stored on our servers encrypted under a root secret. When you sign in, our servers unwrap your family's key and send it to your device over TLS. That design is what lets family admins read their children's chats and lets us recover an account — and it means Shoal is not end-to-end encrypted.
What it doesn't mean is that Shoal staff can read your family's messages. No code path exists today — no admin tool, no support screen, no server routine — that decrypts content, so in our database your messages, names and pictures are only ever ciphertext. Building such a path would be possible, because we hold the keys; we haven't, and we'd rather say all of this plainly than imply otherwise.
What we hold, and how
Encrypted before it reaches us
- Message text and reactions.
- Photos, videos and voice notes, plus any transcripts made on a recipient's device.
- Display names, family names, device names and profile pictures.
Held without content encryption
- Your email address — used to sign you in (by email link or code, or via a linked Google or Apple account).
- Which account IDs are linked to which families and conversations, and the sender ID, recipient IDs and time of each message — the routing information we need to deliver messages and enforce who can see what.
- Technical session details, such as the app or browser version a device signed in with, and the tokens needed to send notifications.
- Whether an account is a child's, and each child's skin setting and active-hours schedule.
The only identifying detail in that list is your email address. The rest contains no names or message content, but because it's linked to your account, data protection law still counts it as personal data.
What Shoal staff can see
Only the unencrypted service data above. Shoal staff can't see your messages, photos, voice notes, names or profile pictures: no code path exists today that decrypts them, our servers handle keys only to deliver them to your family's own devices and to set up new conversations, and the root secret that protects family keys is not exposed in normal staff workflows. The admin tools we do have deal with key maintenance and internal IDs, never with content.
What the encryption protects against
- A database or storage leak. Someone who obtains a copy of our database or file storage, without our root secret, gets ciphertext they can't read.
- Network eavesdroppers. All traffic uses TLS, and content is encrypted again inside it.
- Other families. A family's key never leaves that family. In a conversation with a Connection, only that conversation's key is shared, and the cross-family wrapping happens on our servers so neither family's device ever holds the other's family key.
- Push services. Notifications are delivered through Apple, Google or Mozilla push services as encrypted payloads; your device decrypts the preview. Those services see only metadata.
- Email link prefetching. Sign-in links include an intent-confirmation step, so email scanners can't silently use the token.
What it does not protect against
- Shoal, as the operator, in principle. Our servers hold the root secret, so a way to decrypt any family key, conversation key and message could be built. None exists today, and content is decrypted only on your devices — but that is a protection in how we build and operate Shoal, not a mathematical guarantee.
- Legal compulsion. Because we hold the keys, we could be required by law to produce message contents, and would have to build the means to do so. We keep that possibility deliberately, alongside account recovery and parental oversight.
- A malicious insider, or an attacker with our root secret and database. Either could recover plaintext.
- Metadata. Which account IDs message each other, when, and how much is visible to our servers. Account IDs carry no names, but an adult's account ID is linked to their email address.
- Links you share. When a message contains a link, your device asks Shoal's separate link-preview service to fetch that page so it can show a preview card. That service receives the link itself, but not your account or the rest of the message, keeps no logs, and caches previews only briefly (about an hour for page details and a day for images). Previews are switched off for anyone with word or link rules set.
- An unlocked device. A signed-in device can read the conversations on it. Signing out, or using "Clear what's stored here" in Settings, removes the keys and cached messages from that device.
Admin oversight, explained honestly
Shoal exists partly to give family admins (usually parents, but any adult you trust) oversight of their children's conversations. An end-to-end design, where only the people in a chat hold the keys, can't offer that — so Shoal doesn't use one.
Family admins hold their family's key, so they can open any conversation their family is part of. The app shows them a read-only view of every conversation a child in the family takes part in, including conversations with a Connection — which the other family's admins can read too. It's a visible feature of the product, not a hidden pathway, and the app spells it out when you add a child.
Specific cryptography
- Content encryption: AES-256-GCM, with a fresh 96-bit IV per message or file.
- Keys: one family key per family and one conversation key per conversation, both AES-256-GCM. Conversation keys are wrapped under each participating family's key; family keys are wrapped under a server-side root secret using HKDF-derived keys.
- Integrity: the AES-GCM authentication tag.
- Transport: TLS to Cloudflare's edge, with content encrypted again inside it.
- On the device: keys are kept in the Shoal app's secure storage on iPhone and Android, or in browser storage on the web app, and removed when you sign out.
Data retention
Messages are retained until they're deleted. Deleting a message removes it from our database, except in a conversation that includes a child, where the original is kept for that family's admins. Deleting your account removes your user record, signs out your devices and deletes every message you've sent; copies already saved on other people's devices may stay there. If you leave a family, you can choose to delete every message you sent there. Full detail, and how to delete your account, is in the privacy policy.
Compliance
Shoal is built to be compatible with UK GDPR, EU GDPR, the UK Children's Code (Age-appropriate Design Code), and equivalent regimes elsewhere. Our database is in Cloudflare's EU jurisdiction. Data subject requests can be made to privacy@shoal.chat.
Frequently asked questions
Is Shoal end-to-end encrypted?
No, and we don't describe it that way. Messages, photos, voice notes and names are encrypted on the sending device with AES-256-GCM and decrypted on the recipients' devices, and our servers store and route them only as ciphertext. But Shoal holds the keys: each family's key is stored on our servers, encrypted under a root secret. That is what makes parental oversight and account recovery possible, and it means Shoal could decrypt content. We don't in normal operation.
Can family admins read my child's messages?
Yes. Family admins can read children's chats — that's how the safety features work. See admin oversight. The app gives admins a read-only view of every conversation a child in their family takes part in, including conversations with a Connection in another family, which that family's admins can also read.
How does voice note transcription work? Do you process the audio on your servers?
No. Voice note audio is encrypted on the sending device with the same conversation key as text. If a recipient turns on transcription, their device runs a speech-recognition model locally (the app downloads it once); the audio is decrypted on the device, transcribed there, and the transcript is encrypted before it is stored. Our servers don't receive decrypted audio or transcript text, and we don't send audio to any cloud speech service. See the voice notes feature page for more.
What happens if I lose my device?
Sign it out from Settings on any other device where you're signed in, or contact us. Signing a device out stops it receiving new messages. Messages already on that device can't be recalled, so use a screen lock.
Where is Shoal's data stored?
Shoal runs on Cloudflare. Our database is in Cloudflare's EU jurisdiction; photos, videos and voice notes are stored as encrypted files in Cloudflare R2. Your email address, and the account IDs that link accounts to families and conversations, are the main things held unencrypted.
Can Shoal staff read my messages?
No. In our database your messages, names and pictures exist only in encrypted form, and no code path exists today — no admin tool, no support screen, no server routine — that decrypts them. Our servers handle encryption keys only to deliver them to your family's own devices, where content is decrypted. Staff can see the unencrypted service data needed to run Shoal, such as email addresses, account IDs and how they link to families and conversations, children's skin and active-hours settings, message times and device details. Because Shoal holds the keys, a way to decrypt content could be built; we haven't, and we'd say so here before anything changed.
Can law enforcement access my messages?
Potentially, yes. Because Shoal holds the keys, we could be legally required to produce message contents. No tool to do that exists today, so we would have to build one, and we would only do so where the law obliges us to.
Reporting a vulnerability
If you've found a security issue in Shoal, please email security@shoal.chat. We respond within 72 hours and will acknowledge the report on our security page once it's resolved.