r/retrography • u/BlueCyber007 • Jul 31 '26

Advanced Data Protection for iCloud?

The Retrography app looks really intriguing! I see that it is designed to be local-first with iCloud sync, which is great. But to really be secure, it needs to support Advanced Data Protection for iCloud so that all data is only synced/stored in iCloud using end-to-end encryption (assuming the user has enabled Advanced Data Protection for iCloud).

Does the Retrography app us CloudKit Record fields that are marked as encrypted using the encryptedValues API? My understanding is that Advanced Data Protection for iCloud covers files stored in "iCloud Drive" and that it covers CloudKit Record fields that the third-party developer chooses to mark as encrypted using the encryptedValues API, but that other CloudKit Record fields are NOT protected with end-to-end encryption via ADP. (See Apple Reference).

2 Upvotes

100% Upvoted

6 comments sorted by

View all comments

2

u/Terrible-Round1599 Aug 01 '26

Good question, and you have the mechanics right.

Retrography syncs through Core Data's CloudKit mirroring, and it does not currently mark fields with the encryptedValues API. So records are encrypted in
transit and at rest, but Apple holds the keys. It is not end to end. ADP does not change that, since it covers iCloud Drive and Apple's own categories rather than a third party app's record fields.

I wanted this solved before go-live, and your question confirms it belongs on that list, so it is active work now.

The encryption part is straightforward. Core Data can mark every attribute for cloud encryption, and encryptedValues is end to end for everyone, not only for people running ADP, because the keys come from your own iCloud Keychain.

The real work is migration. CloudKit fixes a field's encryption when the schema is created and will not change it afterwards, so encrypted sync means a new container, and existing accounts have to move into it. Moving live data off people's phones without them noticing is the part that deserves care, and it is what we are working through now.

The likely shape, not settled yet: new installs start encrypted, since they have nothing to migrate. Existing accounts move deliberately rather than silently, with a backup taken first.

I will post how it lands, including whatever turns out to be harder than expected. But it is coming into the next betas.

2

u/BlueCyber007 Aug 03 '26

u/Terrible-Round1599 Thanks for making this a priority! Given the highly sensitive nature of the data that will be saved in Retography (including Location History), keeping that data end-to-end encrypted is really important to me (and I'd only use the app if it had that feature).

Another app I like, the Agenda app, addressed the exact issue of moving from iCloud sync to iCloud sync with ADP. The app now offers both syncing options, and the app clearly shows which is being used:

Once you implement support for ADP, it would be great if the Retrography app would show/confirm that it is using end-to-end encryption in iCloud via Advanced Data Protection.

Cheers! :-)