Cryptee is an open-source, web-based (progressive web app) end-to-end encrypted document editor and photo/video storage service launched in 2018 and operated by Svartlab OÜ, a small bootstrapped Estonian company founded and led by John Ozbay. Its privacy policy states that no personal information is required to sign up (a username and password suffice; email is optional), that file contents are encrypted on-device with keys the company never holds, that no cookies or third-party analytics are used, and it enumerates the unencrypted metadata it can see (folder counts, byte sizes, EXIF dates, payment dates, shared-album recipient emails and access IPs) plus its subprocessors (Google Cloud Platform, Cloudflare, Sentry, Stripe, and legacy Paddle). The web client is MIT-licensed on GitHub with the running commit hash shown in-app, but the backend is closed and, as the company's own threat model concedes, a web-delivered client means a compromised server could serve altered code. No third-party security audit, bug bounty, breach, or regulatory action was found; the company publishes an empty transparency report, a law-enforcement guideline, and a safe-harbor vulnerability disclosure policy.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Cryptee's homepage states that accounts can be created anonymously with only a username and password, but also offers email-and-password and Google-account sign-in as alternative login methods — the latter linking the account to a Google identity if the user chooses it.
Cryptee's privacy policy (undated, live 2026-08-16) states that no personal information is required to create an account — a username suffices and an email address is optional — and enumerates the unencrypted metadata the company can see (folder colors and counts, encrypted byte sizes and MIME types, version IDs, EXIF dates, storage used, payment amounts and dates, and for RAW photos camera make/model/lens/exposure), while stating it has no access to file contents; encrypted backups are kept up to 90 days, error reports 90 days, and abuse-detection IPs and user agents 180 days.
Cryptee's about page names founder and CEO John Ozbay as the company's lead, lists a small team by first name only, and states the company started in 2017, is 100% bootstrapped, profitable, subscription-funded, and takes no venture capital or external funding.
Cryptee's imprint identifies the operating legal entity as Svartlab OÜ at Narva mnt 5, Tallinn 10117, Estonia — the trading name (Cryptee / crypt.ee) differs from the registered company name — and lists dedicated legal, security, media, and general contact addresses.
The Cryptee web client repository on GitHub (default branch v3, updated August 2026) publishes the client source under the MIT License with Svartlab OÜ / Cryptee as copyright holder, letting anyone inspect the code that performs on-device encryption.
The web-client README states that Cryptee's backend code is deliberately not open source — citing abuse-prevention systems and limited resources — and argues that because all encryption happens in the front end, users can verify from the client code alone that data never leaves the device unencrypted; only the client half of the system is therefore publicly inspectable.
Cryptee's law-enforcement information page states that services are offered by Estonian company Svartlab OÜ, that the company will make reasonable efforts to notify affected users of lawful data requests unless prohibited, and that it never provides data directly to requesting agencies — any disclosable data is transmitted only through Estonian authorities, with foreign requests routed via MLAT.
Cryptee's privacy policy states it has no ads, will never share data except as described in its disclosure section, will disclose the limited metadata it holds (and encrypted blobs it cannot decrypt) only under an enforceable court order, and transmits data outside the EU only in encrypted form; it names its sub-processors as Google Cloud Platform (Google Ireland), Cloudflare (Portugal), Sentry (Netherlands), Stripe (Ireland), and Paddle for users who paid before 21 February 2021.
Privacy Guides lists Cryptee among its recommended cloud-based notebooks, a category whose minimum requirements state that clients must be open source and any cloud sync functionality must be end-to-end encrypted, describing it as an open-source, web-based E2EE document editor and photo storage application whose sign-up requires no email or other personally identifiable information.
Cryptee's published threat model acknowledges the core caveat of a web-delivered E2EE client: an attacker who gained control of Cryptee's servers could serve modified code to users' browsers to obtain plaintext or keys; the company says it mitigates this with independent monitoring of served code and in-app hash checks that refuse unreported releases, and it explicitly states Cryptee cannot protect against a compromised user device.
Cryptee's transparency report page states that the only actions it can be legally obligated to take are to provide encrypted data or to retain user data, that retained data is not handed over without a court order, and that as of the live page it has received nothing to report; no counts, dates, or third-party audit are published, and no breach or regulatory action involving Cryptee was found in this research.
Cryptee publishes a vulnerability disclosure policy in its web-client repository defining a security@crypt.ee reporting channel, in-scope systems (crypt.ee, beta.crypt.ee, cryptee.photos), a legal safe harbor for compliant researchers, a 120-day coordinated-disclosure window, and a public acknowledgements page; it offers no monetary bounty, and it notes the running GitHub commit hash is shown in the app's account settings so users can match the served client to the public code.
Cryptee's security page states that the company does not track or log user activity, does not require an email address or other personally identifiable information, and serves no advertisements; it also states files are encrypted on-device with AES-256 using OpenPGP.js or browser-native cryptography.
Cryptee's privacy policy states the service uses no cookies or tracking systems, relies on a self-built anonymous analytics system rather than a third-party one, and runs a script that deletes all cookies on each page load; it separately discloses that error reports are processed via Sentry (linked to a user ID, retained 90 days) and that Stripe's third-party JavaScript, which 'may contain other tracking', is loaded only on the payment page.