Built for Ephemeral Sharing, Engineered for Zero Data Leakage
In an era where every photo and video uploaded to the internet persists indefinitely on third-party servers, Locky provides a temporary, zero-log shelter. We believe private moments shouldn't leave permanent digital footprints.
24-Hour Self-Destruct
Every media object has an enforced 24-hour expiration time-to-live. Once the timer reaches zero, background cron cycles and Just-in-Time APIs permanently delete the object from encrypted storage.
4-Digit PIN Gate
Files are locked behind user-chosen or auto-generated 4-digit PINs. Passcodes are salted and hashed using scrypt derivation before touching storage metadata. Plaintext PINs are never stored.
Zero Database
Locky maintains zero SQL or NoSQL user databases. There are no user profiles, account passwords, tracking analytics, or persistent log indices. Media metadata lives solely on temporary object headers.
Cryptographic & Storage Architecture
A breakdown of the lifecycle of every file uploaded through Locky.
1Client-Side EXIF & Location Scrubbing
Before any image leaves the browser, binary parsers strip all Exchangeable Image File Format (EXIF) metadata, including GPS latitude and longitude, camera serial numbers, device model details, and timestamps. This ensures sensitive location data is discarded at the source.
2Cryptographic Key Derivation (scrypt)
Passcodes are processed using the scrypt password-based key derivation function with parameters N=16384, r=8, p=1 and a cryptographically secure 16-byte random salt. Even in the unlikely event of storage inspection, brute-force enumeration is computationally prohibitive.
3Direct Presigned Cloudflare R2 Uploads
Locky uses short-lived AWS S3-compatible presigned URLs with strict content-length and content-type constraints. Media streams directly from the client's browser into private, non-public Cloudflare R2 buckets, eliminating intermediary proxy caching.
4Cloudflare Turnstile Bot Defense & Rate Limiting
Both the upload endpoint and the passcode unlocking gateway require valid Cloudflare Turnstile cryptographic challenge proofs. Automated crawlers, scrapers, and denial-of-service bots are prevented from brute-forcing PINs or systematically draining cloud bandwidth.
5Dual-Tier Self-Destruct & Immediate Abuse Purge
Expired objects are handled by two complementary mechanisms: automated Vercel Cron jobs running periodic background purges, and Just-in-Time (JIT) checks that delete expired media the moment an expired URL is requested. In addition, any user can click "Report Abuse" to trigger an instant, permanent wipe of violating media.
Why Choose Ephemeral Sharing Over Traditional Cloud Drives?
Traditional cloud storage services like Google Drive, Dropbox, or OneDrive are optimized for permanent archiving. When sharing temporary photos, documents, or video clips, permanent links often stay active indefinitely, forgotten in chat histories and email threads. Locky is designed specifically for temporary communication: send the link, share the PIN, and after 24 hours, the data is gone forever.
Experience Zero-Leakage Sharing
Share high-resolution photos and videos protected by a 4-digit PIN.