The short version
- An item is “Verified” only after its stored copy is read back and matches your original, byte for byte.
- Every verified item is kept as two copies in separate storage, and both are re-checked every week. If one goes bad, it’s rebuilt from the other.
- Deleted items wait 30 days in Recently deleted. Bulk changes show exactly what will happen first, and leave a receipt.
- StoreMore asks your other services for read-only access. Connecting a source copies nothing by itself.
- We email you about every new sign-in and every newly connected source.
- You can export everything, with fingerprints to check it, and leave whenever you want.
Verified, not just uploaded
Before anything is called protected, your browser or phone works out a fingerprint (SHA-256) of the file you chose. After the upload, StoreMore reads the stored copy back and compares its size and fingerprint with the original. Only an exact match is marked Verified. Anything else is reported as not protected, with the reason, and the bad copy is removed.
Two copies, checked regularly
Every verified item is copied to a second, separate store, and that copy is checked the same way. Both stores are Amazon S3, in India and hundreds of kilometres apart: the first in Mumbai, the second in Hyderabad.
Every 7 days, StoreMore reads both copies of every item again and compares them with the original fingerprint. Your library shows when each item was last checked and how many copies it has.
- If one copy no longer matches, it’s rebuilt from the other, and the repair appears in your Activity.
- If neither matches, we email you straight away, the item stops being shown as protected, and we tell you which file to back up again.
No service can promise that data will never be lost. What we can promise is that you’ll hear about a problem from us, not when you need the file.
Deleting is reversible
- Deleting from your library moves items to Recently deleted. They stay there for 30 days and can be restored with one click. After that, every StoreMore copy is removed.
- Before any bulk change, StoreMore shows exactly which items are affected and what will happen. Afterwards you get a receipt with Undo, and a lasting record in Activity.
- Deleting in StoreMore never touches the originals on your phone or in your other services.
- When StoreMore deletes in a connected service (later, and only with your separate permission), it will use that service’s own trash or recently-deleted folder, never a permanent delete.
Who can see your files
- Your files are shown only to you, after you sign in. Every file request checks your session, and files are served in a way that stops them running as a web page.
- StoreMore has no tool for staff to browse people’s files. Our servers accept web traffic only through Cloudflare, and administrative access only from approved addresses.
- Data is encrypted in transit (HTTPS). Both stored copies, the database and its backups are encrypted at rest with AES-256.
- Access to your connected services is read-only, and those access tokens are encrypted by StoreMore (AES-256-GCM) before they’re stored.
- We don’t send promotional messages, sell personal data, or use your photos and files for advertising. StoreMore AI isn’t available yet, so no AI looks at your files. How it will work is explained in How we handle your data.
If a breach affects your data, we’ll tell you and the Data Protection Board of India, as the law requires.
Your account’s security
- Sign in with a passkey (Face ID, a fingerprint or your device PIN), which can’t be phished, or with a 6-digit code sent to your email. Codes expire after 10 minutes, allow 3 tries, and are stored only as hashes.
- We email you whenever a new device signs in or a source is connected, so nobody can do either without you knowing.
- Settings › Signed-in devices lists every device on your account and can sign any of them out.
- Activity keeps a record of sign-ins, connected sources, deletions, restores, exports and repairs.
Leaving StoreMore
- Export everything from Settings › Your data: a ZIP of every verified item, plus a manifest of fingerprints so you can check each file yourself.
- Deleting your account removes every StoreMore copy, disconnects your sources, and asks each service to revoke StoreMore’s access where it supports that.
- If you stop paying for a plan, your files stay available to download for 90 days, and we remind you 30, 7 and 1 day before.
If StoreMore ever closes
We’ll email you at least 90 days before the service shuts down, keep export working until the last day, and then delete every copy. If StoreMore is ever acquired or merged, your data moves only under this policy’s protections, and we’ll tell you beforehand so you can export or delete your account first.
Companies we use
These companies process data for StoreMore. We’ll update this list before we add a new one.
| What for | Company | Where |
|---|---|---|
| Storing your backed-up copies | Amazon Web Services (S3) | Mumbai, India |
| The second copy | Amazon Web Services (S3) | Hyderabad, India |
| Running the app and its database | Amazon Web Services (Lightsail) | Mumbai, India |
| Sending email (sign-in codes, security alerts, and reminders you turn on) | Amazon Web Services (SES) | Mumbai, India |
| Delivering and protecting this website | Cloudflare | Worldwide network |
| Counting how the website and app are used, only if you allow it | Google (Google Analytics) | May be outside India |
Independent checks
We list independent reviews here only once they’re complete, and we don’t show badges for checks we haven’t passed. Planned:
- Google’s app verification and security assessment, which Google requires before StoreMore can read Google Drive for everyone.
- Dropbox production approval and Microsoft publisher verification.
- An external penetration test before launch.
Report a security issue
Email security@storemore.ai with what you found and the steps to reproduce it. We’ll acknowledge it within 2 business days, keep you updated, and tell you when it’s fixed. We don’t pay rewards yet, but with your permission we’ll thank you by name once it’s fixed.
If you look for security issues in good faith and follow these rules, we’ll treat your research as authorised: we won’t take legal action against you, or ask the police to, for that research, and if anyone else does, we’ll make clear you had our permission. (Indian law may still require us to report a security incident to CERT-In; if so, we’ll say you reported it in good faith.)
- Only test accounts you own, or have the account holder’s permission to test. Don’t access, change or delete anyone else’s files or data beyond the minimum needed to show the issue. If you come across personal data, stop, tell us, and don’t keep or share it.
- Don’t disrupt StoreMore for other people: no denial-of-service, spam or automated scanning that slows the service down, and no social engineering of StoreMore staff.
- Give us reasonable time to fix the issue (up to 90 days) before telling anyone else, and don’t ask for payment in return for keeping it private.
- This covers storemore.ai, app.storemore.ai and the StoreMore apps. We can’t give permission to test services we use, such as Amazon Web Services, Cloudflare or Google: follow their own rules.
Our contact details are also in security.txt.