Show HN: Zoldy – Protect your information while in danger or at risk

Hello HN, hello showHNers,

You know when an idea is in your head pushing, even annoying sometimes?, when after years it is still there and still pushing?, this is Zoldy, my creation, about 25 years pushing till get real. Zoldy is a service (app) whose objective is to provide capabilities to protect any confidential information and its holders, especially if they are in a situation of risk, threat or danger due to the possession of that information.

I came to this idea when I needed this service back in 1995, at that time there were no smartphones nor internet,.., only floppies. At that time the only thing you could do holding confidential information were copies from those floppies and give them to friends with instructions. I lived one of those situations and did not want my friends to be involved. From that time I have spent lots of time developing the concept. By 2010 technology was almost there to have Zoldy working but prices to develop it were too high, at last, in 2021 the idea became real.

The app is free to download to have the tool ready to use, when you need it up and running you pay for time of service, 30 days, 7 or 1 day and set your Zoldy up, upload your confidential files, set emails (5 max.) and messages, attach those files to any email. If something should happen to you or you are under a direct threat the app can help you to take control giving you options of negotiating with the information you hold and/or delivering the files to your pre-set email recipients along with their messages, even if you become unresponsive.

No registration is required, the service does not work with username and password. You get time of service and the app starts it automatically, not even email or number. Privacy from the first step.

Negotiator mode, you have uploaded your confidential files, you have set up emails and messages and if you are under a direct threat this screen gives you options to negotiate with the information you hold, if you touch this screen your Zoldy runs your settings, sending messages and links to files for downloading to the recipients you have defined. This is for real danger situations where the threat is direct and it is important what is going to happen with that information, it gives you options to negotiate at the same time that it ensures the sending of emails if necessary.

In real house alarms there is a secret password so that if you are under a direct threat and you turn your alarm off with this password, the alarm goes off but in the central controlling your alarm know you are in troubles because you used this password and call the police, In the app there is a panic pass simulating this. If you use it Zoldy runs your setting in the background - sending emails, messages and files -. There is also a Notification Service: if you activate it and you do not reply to 3 consecutive notifications your Zoldy reacts by sending messages and links to files to the recipients you defined. So even unresponsive you can count on the service to deliver them, the same happens if you uninstall the app with the Notifications Service activated, preventing this way attempts to stop the service through uninstallation.

No humans behind, the service is completely autonomous, no admin tool or anything like that. I had to put a "Single Clause" about it in the legal Terms and Conditions of the service.

Files, emails, messages are automatically deleted once the service has finished. Track is not possible more than the invoice from the official Stores that says Zoldy Services. Yes, everything is encrypted.

No cookies, no ads, no tracking tools, I wrote myself the website line by line, with the help of Bulma (https://github.com/jgthms/bulma -CSS only framework-). I really enjoy writing from scratch, I have some control and site flies from my end point. Server in Europe.

I will be happy answering any question or comment you may have. All the best.

P.S.1 - If you are curious about data have a look to https://www.zoldyapp.com/legal-info#privacy, there it is described publicly how the information you send through Zoldy is processed, used and deleted.

P.S.2 - One man and his idea, no corporation, no agency, the one showHNing.

Sorry you take that impression at first view, although I do understand it living in the world we live. This is not a dead man, I am really alive -ironic just in case :P, it is only me behind this idea, not they. If you want to know anything about how data flows, have a look, please, if you did not https://www.zoldyapp.com/legal-info#privacy. This is how it is, none in the middle, you and the machine.

If your battery dies or you have no reception there wont be any app working for you, at least not internet based, if this happens and you have activated the Notifications Service in your Zoldy you wont be able of replying back to those Notifications and with 3 consecutive times Zoldy will run your settings sending emails, the same if you uninstall the app with this activated. Sorry you have this perception.

Yeah, a smartphone based deadman is not great for the reasons listed. Ideally you would have key escrow running in a few places ala Shamir and then already have the data widely distributed (bittorrent, ipfs) but encrypted.

You can still handle check-in via device but you need a 2nd factor of something only you know, with false values that will trigger a dispersal.

> I'm not saying the app is useless, I'm just saying it's not as easy as the website says. I personally wouldn't use a mobile app for that, because it's too risky in my opinion.

It is assumed that you are in a risky situation, or you want to have control of the information if something were to happen, I honestly think it is easy or maybe I should try harder to explain it better, you upload the files, configure the emails and activate or deactivate the different functionalities it offers which yes it is true they are varied and nonexistent in the market. I thought of this service for smartphones because it is what you carry with you almost always, I never thought, sincerely in a web service.

> Suppose we have a scenario where someone has confidential information incriminating one of my theoretical adversaries and sets up Zoldy with the data. What if I hire a thug to steal and destroy the phone? Will the owner be able to stop the messages he doesn't want sent?

I suppose in this situation a person has the phone and is being attacked to destroy it in order to stop the service so that the emails are not sent, however in the above reasoning something escapes me, you see, if I have the service activated it is because I want to use it in case something happens to me, why would I want to stop it. If the phone is destroyed without the service being Notifications On, when the service time is over everything will be automatically erased, which links to the next question...

> Can the application be restored to a functional state on another device? If so, then a malicious third party could access the Google/Apple account and restore it by gaining control of sensitive information.

No, the app only works on a single device, in fact, it is tied to it, the device is the "user". You can't move it between devices or share it.

> According to the website, the data is stored in Firebase. But how does the application access them, is there a gateway server that controls? If so, I wouldn't even bother with the above scenarios, but attack that server and get ALL the data. Not just from one target, but from all, which would be pretty much a disaster (for you, the app and all clients).

Your files go from your terminal to Firebase directly, they don't go anywhere else, the app doesn't access them just upload them, you can delete them of course, you can attach those files to any email and they stay there for the duration of the service and if the emails are sent they stay there for 15 days so the recipients can download them, then everything is automatically deleted, files, emails and messages.

That way your files go from your terminal to Firebase and if for any reason the emails were sent, only go to the recipients you have previously defined.