Encrypted on your device, sent over Tor, paid for in Monero. We never know who you are. We never see what you store.
Three steps.
Restic encrypts every file on your device before it touches the network. The keys never leave you. We hold ciphertext, nothing more — we couldn’t read it if you begged us to.
All traffic to and from us routes through Tor. We never learn your IP. You never need to learn ours.
Monero only. Top up a balance; it burns down by the second; refill when you need to. No subscription, no commit. Your client certificate (mTLS, X.509) is your account — lose it and there is no recovery.
What we never see.
No analytics, no third-party scripts on this page. Clients are open source with reproducible builds — you can audit the encryption yourself. Your cert is your account; there is no password reset, no recovery, no backdoor.
Install
Static, reproducible builds. Verify against SHA256SUMS before running.
Or use the inspectable bootstrap script: curl -fsSL https://privatearchive.xyz/install.sh | bash
Recommended — Homebrew:
brew install https://privatearchive.xyz/brew/privatebackup.rbBootstrap script. Short, inspectable, pinned by SHA256:
curl -fsSL https://privatearchive.xyz/install.sh | bashDirect .dmg + manual quarantine strip. One terminal command after dragging the app to /Applications:
xattr -dr com.apple.quarantine "/Applications/Private Archive.app"Direct .dmg, no terminal. If you double-click an unsigned app on macOS Sequoia, the OS will refuse to launch it. Override at System Settings → Privacy & Security → Open Anyway. We list this last because the manual xattr command above does the same thing in one second without needing your admin password — and because clicking through "Open Anyway" doesn't actually verify anything, it just dismisses a warning.
Debian / Ubuntu / Mint:
curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackupFedora / RHEL / Rocky / Alma:
sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackupArch / Manjaro:
curl -fsSL https://privatearchive.xyz/pacman/release-key.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key 479223EA8405287A11FBB12E02A77A1EEDD0F111
printf '\n[privatearchive]\nServer = https://privatearchive.xyz/pacman\n' | sudo tee -a /etc/pacman.conf
sudo pacman -Sy privatebackup4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111curl -fsSL https://privatearchive.xyz/apt/release-key.asc | gpg --show-keysScoop:
scoop install https://privatearchive.xyz/scoop/privatebackup.jsonSmartScreen will warn that the publisher is unknown — click More info → Run anyway. Same caveat as macOS: this dismisses a warning, it doesn't verify anything; the auto-updater handles update integrity afterwards.
Read every line, build it yourself:
curl -fsSL -O https://privatearchive.xyz/releases/latest/privatearchive-source.tar.gz
tar xzf privatearchive-source.tar.gz
cd privatearchive-source && cat README.md
Every release tag is signed with GPG fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111 — the same key that signs the apt and dnf repos. Once installed, the auto-updater verifies a separate ed25519 manifest signature on every fetched binary, regardless of how you originally installed.
Trust model
Both signing programs require binding a real-world identity to the certificate. Apple validates the entity at signup and embeds a Team ID in every signed binary; Microsoft does the same via the Trusted Root CAs. The whole point of those signatures, from the OS's perspective, is to give users an identifiable party to blame.
A backup tool whose entire premise is that we don't collect anything that ties to your identity cannot also publish a permanent, machine-readable record of our identity in every binary we ship without undermining the message. So we don't.
The trust we offer instead doesn't depend on Apple or any CA. The auto-updater polls a signed manifest over Tor, verifies the ed25519 signature against a public key embedded in the binary at compile time, and refuses any artifact whose SHA256 doesn't match. So even on an unsigned-at-install platform, every update is tamper-evident — and updates are where most of the lifetime trust actually lives.
Above we lead with Homebrew Cask on macOS, because Cask removes the macOS quarantine flag for you, so unsigned apps run with no prompt at all. The bootstrap script does the same thing in one shell line. The "open from /Applications, click through Settings" path is genuinely the worst option, and we say so.
Out-of-band trust anchors: GPG fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111, public key at https://privatearchive.xyz/install/release-key.asc. Verifying out-of-band — getting the fingerprint via a different channel than the one you use to download — is the most paranoid thing you can do and we encourage it.
Design variants
Each subdirectory below represents a distinct design direction, audience, or message. All contain the same underlying value proposition; these are marketing and framing experiments.
General purpose
Explainer / educational
Manual / man page style
Billing / anonymous payment
Forget / manifesto angle
Glitch / hacker aesthetic
Zine format
Minimal design
Standard version
System status & specs
Journalist / sources
Self-custody angle
Small business
Technical deep-dive
Ownership message
Trust / general
Legal practice
Self-hosters
Consumer angle
Research material