Nduzem

Send a file to someone without handing a copy to anyone else. Nduzem encrypts your file on your phone, before it goes anywhere. The key that opens it is created on your device and shared only with the person you're sending to. Our servers hold nothing but scrambled bytes and a key we cannot open. Not "we promise not to look", we built it so there is nothing to look at. HOW IT WORKS 1. Pick a file. It's encrypted on your device. 2. Choose who gets it: a person, or a private link. 3. They open it. Our copy is deleted. You don't manage keys or read a manual. It works like any other file transfer app. The difference is what happens on our side. WHAT WE CAN AND CANNOT SEE We can see: who sent to whom, how big the file was, and when. We need that to run the service and stop abuse. We cannot see: the file's contents, its name, or its type. Those are encrypted before they reach us, with a key we never receive. If you ask us to, we'll also hold a sealed backup of your keys so you can get back in from a new device. It's locked by a recovery key we never receive and cannot work out. If someone compels us to hand over your file, they get ciphertext. If our servers are breached, the attacker gets ciphertext. That's the point. FEATURES • Files up to 10 GB per transfer • Send to a contact, or create a private link for someone without the app • Optional password on links, and a limit on how many times they can be opened • Burn after receipt: we delete our copy once it's collected • 7-day expiry as a backstop, whether or not it's collected • Send several files at once • Verify a contact by comparing a short safety number, so you know their keys are really theirs • Save a recovery key, so a lost or replaced device doesn't cost you your files • Replace your encryption key if you think it's been exposed • Delete your account, and everything in it, from inside the app • Two-factor authentication with any authenticator app • Also works in your browser at app.nduzem.com • 2 GB free every cycle, then credits or a subscription LIMITATIONS Most apps don't put this in a store listing. We'd rather you know before you rely on us. "Burn after reading" means WE delete our copy. It does not delete the copy on the recipient's device. Once someone has your file, they have it, that's true of every file you've ever sent, and no app can change it. We cannot scan for harmful content, because we cannot read anything. That's a direct consequence of the design. We respond to reports based on behaviour and metadata, never by inspecting files. If that trade-off isn't right for you, this isn't the right app. Our encryption is strong against today's computers. A future quantum computer is a real long-term concern for this kind of cryptography, and we've built the format so we can add a quantum-resistant option without breaking your old transfers. Your keys live on your device, not on our servers. Save a recovery key and a lost device costs you nothing. Skip it, lose the device, and the files people sent you before are gone. We can't undo that, and an app that could would be an app that could read your files. A recovery key is worth what your files are worth: anyone holding it and your password can read what you've been sent. Keep it where you'd keep a spare house key. FOR THE TECHNICALLY CURIOUS Files are encrypted with XChaCha20-Poly1305. Each transfer's key is sealed to the recipient's X25519 public key, and senders sign with Ed25519. Your recovery key wraps your identity keys with a key derived from it, so the backup we store is opaque to us. Everything cryptographic happens on your device using libsodium. The full protocol and threat model are in our security whitepaper at nduzem.com, including the parts that don't flatter us. We deliberately don't claim more than we can prove. We're not calling ourselves audited until an independent third party has actually audited us and published the result. Questions: [email protected]