Security Whitepaper

Security & Trust Architecture

A deep dive into how MediaRelay protects your memories, ensures direct cloud transmission, and cryptographically guards against accidental file deletion.

Pillar 1

Zero Relay Servers

MediaRelay never routes photo or video bytes through intermediary developer servers. Transmission happens exclusively over direct HTTPS/TLS connections from your phone to Google Photos API endpoints (photoslibrary.googleapis.com).

Pillar 2

Cryptographic Fingerprints

Every file is fingerprinted with a SHA-256 hash. If a file is altered, partially uploaded, or corrupted in transit, the upload is flagged as failed. Only files whose checksum is intact and verified by remote Google Media IDs can be cleared.

Pillar 3

Least-Privilege Scopes

MediaRelay requests only photoslibrary.appendonly and photoslibrary.sharing. MediaRelay cannot read your pre-existing photos library, cannot delete photos in Google Photos, and cannot view other albums.

Pillar 4

Non-Automatic Deletion

We treat user data with the highest sanctity. Under no circumstances does MediaRelay delete a local file autonomously in the background. The user must review eligible items and explicitly initiate deletion via Android system confirmation.

Architecture Data Flow

The diagram below illustrates the exact path of data in MediaRelay:

[ ANDROID DEVICE ] │ ├─► WhatsAppMediaScanner (Reads MediaStore relative paths in /Android/media/) │ │ │ ▼ Computes SHA-256 Hash ├─► Room Local Database (Stores local URI + SHA-256 hash + Status: PENDING) │ │ │ ▼ WorkManager Scheduled (Charging + Unmetered Wi-Fi constraints) ├─► MediaUploadWorker (Direct streaming binary upload using OkHttp/Retrofit) │ │ │ │ DIRECT TLS 1.3 CONNECTION (Zero Intermediate Servers) │ ▼ [ GOOGLE CLOUD INFRASTRUCTURE ] │ ├─► Google Photos REST API (https://photoslibrary.googleapis.com/) │ │ │ ▼ Returns Permanent Google Media Item ID (e.g., "AF1QipN9...") │ [ SAFE STORAGE RECLAIM ENGINE ] │ ├─► Verify Media ID != null ├─► Re-verify Local File SHA-256 Hash Unchanged └─► Status Updated to: BACKED_UP • Eligible for User-Confirmed Cleanup

OAuth 2.0 PKCE & Android Keystore Security

MediaRelay utilizes Google Identity Services and OAuth 2.0 with Proof Key for Code Exchange (PKCE). Tokens obtained during authentication are stored using Android's EncryptedSharedPreferences, backed by the hardware-backed Android KeyStore with AES-256 GCM encryption. At no point are access or refresh tokens exported outside of the app sandbox.

Firestore MediaMemory™ Cloud Ledger

For cross-device synchronization and duplicate detection, MediaRelay connects to Google Cloud Firestore (Project: mediarelayapp). The Firestore database rules strictly isolate records:

Only authenticated users can read or write their own records (request.auth.uid == userId).
Ledger records consist solely of: sha256Hash, fileName, fileSize, googleMediaId, and timestamp.
No image pixels, binary media, chat messages, or contacts are ever uploaded to Firestore.