№01
Object

Private
Archive

An offsite backup service that does not learn the identity of its users. Files are encrypted on the user’s device, transmitted through Tor, and settled in Monero.

A1 / B1
2026

№02
System

System

01EncryptionRestic, AES-256-GCM

02Key generationOn user device, at install

03Key custodyUser only. Service holds none.

04Service seesCiphertext only

05NetworkTor hidden service

06IdentityX.509 client certificate (mTLS)

07Account recoveryNone. Lose the certificate, lose the account.

08SettlementMonero, subaddress per client

09Personal data collectedNone

№03
Tariff

Tariff

Model	Currency	Term	Billing
Pay-as-you-go	Monero	None	Burns down by the second

No subscription. No commitment. Balance burns down by the second.

№04
Method

Method

A. Install client. A certificate is generated on your device.
B. Fund balance. Send Monero to the printed subaddress.
C. Back up. privatearchive backup ~/Documents
D. Verify. Restore one file before you trust the system with the rest.
E. Forget.

№05
Distribution

Distribution

Direct builds — verify each against the published SHA256SUMS:

OS	Architecture	Format	File
macOS	arm64 · Apple Silicon	.tar.gz	privatearchive-darwin-arm64.tar.gz
macOS	amd64 · Intel	.tar.gz	privatearchive-darwin-amd64.tar.gz
Linux	amd64	.tar.gz	privatearchive-linux-amd64.tar.gz
Linux	arm64	.tar.gz	privatearchive-linux-arm64.tar.gz
Windows	amd64	.zip	privatearchive-windows-amd64.zip
Windows	arm64	.zip	privatearchive-windows-arm64.zip
FreeBSD	amd64	.tar.gz	privatearchive-freebsd-amd64.tar.gz
FreeBSD	arm64	.tar.gz	privatearchive-freebsd-arm64.tar.gz
OpenBSD	amd64	.tar.gz	privatearchive-openbsd-amd64.tar.gz
OpenBSD	arm64	.tar.gz	privatearchive-openbsd-arm64.tar.gz
Source	—	.tar.gz	Source · privatearchive-source.tar.gz
Checksums			SHA256SUMS

Builds are reproducible. Source is published under a permissive licence.

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.

PrivateArchive