// non-custodial · trust-minimised · sovereign-by-default

Backups you custody.
Bytes we can’t read.

Restic-encrypted, Tor-routed, XMR-settled. Your client cert is your account. No KYC, no email, no recoverable identity. We hold opaque ciphertext; you hold every key that matters.

$ get the binary read the stack

● no custodian · ● no chain analytics on this page · ● open-source clients

// THE STACK

Each layer is something you would have picked anyway.

Restic

client-side AES-256-GCM

Encrypts before transit. Open source since 2014. Multiple independent reviews. Keys generated on your hardware, never leave it.

Tor

onion-routed, hidden service

Three-hop transport. We never see your IP. You never need ours. Both endpoints are .onion.

mTLS / X.509

your cert = your account

SHA-256 of your cert is your only ID. No password. No recovery flow. Lose it, lose access.

Monero

subaddress per client

Stealth addresses, ring signatures. We only see the subaddress mapped to your cert. The chain shows nobody who paid whom.

Reproducible builds

don’t trust, verify

Every release is reproducible. SHA256 sums published. Build it yourself if you don’t want to take our word. Audit the crypto end-to-end.

0 custodial wallets held
on your behalf

0 PII fields
collected

∞ retention
(while balance > 0)

∞ keys you keep
yourself

// QUICKSTART

Run a node. Push some blobs. Forget about us.

$ curl -L https://privatearchive.xyz/releases/latest | sh
[+] privatearchive latest installed.

$ privatearchive init
[+] generating ed25519 client cert > ~/.privatearchive/client.pem
[!] BACK THIS UP. there is no recovery.

$ privatearchive pay
[+] send XMR to:
    8B5cBK29...e2NM (subaddress, yours)
[+] balance burns down by the second. top up when needed.

$ privatearchive backup ~/wallets ~/keys ~/.local/share/electrum
[+] restic snapshot abcd1234 encrypted client-side, routed via tor.
[+] service holds opaque ciphertext. only you can read it back.

// STORAGE

Client-side encryption. Opaque ciphertext. Sovereignty by construction.

Restic encrypts every byte on your hardware before it touches the wire. The service holds opaque ciphertext — nothing else. You don’t need to know where it lives, because nobody who does can read it. Pay-as-you-go in XMR. Subaddress per client. Balance burns down by the second. Top up when needed. No subscription, no commit, no minimum.

// BINARIES

Verify. Run.

OS	Arch	Format	SHA256 (truncated)
macOS	arm64	.tar.gz	`…`	↓ download
macOS	amd64	.tar.gz	`…`	↓ download
Linux	amd64	.tar.gz	`2c17e9f30de4…`	↓ download
Linux	arm64	.tar.gz	`9a4b6d827c11…`	↓ download
Windows	amd64	.zip	`71fe8c2b094a…`	↓ download
Windows	arm64	.zip	`…`	↓ download
FreeBSD	amd64	.tar.gz	`…`	↓ download
FreeBSD	arm64	.tar.gz	`…`	↓ download
OpenBSD	amd64	.tar.gz	`…`	↓ download
OpenBSD	arm64	.tar.gz	`…`	↓ download
source	any	.tar.gz	`a1b2c3d4e5f6…`	↓ source · audit the crypto

Full SHA256SUMS. Sources at source tarball. Build it yourself; don’t trust us.

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.

Backups you custody.Bytes we can’t read.