Your hunting data is locked. Only you hold the key.
Revier3D uses full end-to-end encryption. We cannot read your hunting data: not your photos, not your notes, not your marker positions, not your boundary, not your region. The server sees only ciphertext. Your connection data (IP address) is visible to us like any server, but we do not store it and cannot derive hunting data from it.
All of your hunting records are encrypted on your device before they reach our server. The server is a dumb, encrypted storage: it holds your data but cannot read it. The key is never on the server, not in backups, not in log files.
"We cannot read your hunting data. Not the operators, not an authority, not an attacker who fully compromises the server. Your hunting-ground data is encrypted, from the first byte."
That is the strongest security promise a cloud product can make.
Scope of encryption
What is protected
Everything that makes up your hunting ground. Not just photos and notes, but also positions, game species, dates, boundary and region:
📍 Positions
All marker coordinates (stands, feeding stations, game crossings), boundary, trail-camera locations
📸 Photos & videos
All images from markers, trail cameras, damage and harvest records, including previews
📝 Notes & names
Marker names, types, free-text fields, sketches, receipt and booking texts
🦌 Hunting data
Game species, class, date, weight, hunting method of harvest, harvest plan
🗺️ Ground metadata
Hunting-ground name, region/country, boundary polygon, 3D terrain model and aerial imagery
💰 Ledger
Receipts, booking texts, invoice details, change history
Honest limits
What stays in clear text
The absolute minimum without which the server cannot function. This data contains no hunting data:
Account emailLogin, billing, support
Tariff & payment statusPayment processor Paddle
Hunting-ground linkURL routing for shared access
That is all the hunting data. The server knows: "Account #31 pays for Hunting Ground #71, which uses 2.3 GB." It does not know where your boundary is, not where a marker stands, not what you harvested. Your IP address is seen for the connection but not stored. The payment country (Paddle) is mandatory for tax reasons and sits with Paddle, not in our database.
⚙️ Two metadata items the server briefly sees: (1) Your IP address on every connection (like any website), which we do not store. (2) For the 3D build When your 3D model is built, your browser sends a rough position (bounding box, accurate to 2 km) to the server for a few minutes so it can fetch aerial imagery and terrain data. After that, it is forgotten. From both, the rough area can be guessed, but never your markers, your notes or your images.
Technical architecture
How encryption works
1
Your password becomes a key
Your hunting-ground password is processed through Argon2id (memory-hard, GPU-resistant) to derive a key. This key is held in the browser's secure key store, never as a JavaScript variable (non-extractable). An XSS attack cannot steal it.
2
The Revier Key is unwrapped
The actual Revier Key (RK, 256-bit random) sits wrapped on the server. Only your password can unwrap it. The RK is then also held in the secure key store, non-extractable.
3
All data is encrypted
Every row (marker, harvest, note, photo) is stored as an encrypted blob (AES-256-GCM). The server sees only ciphertext. The key never leaves your device.
4
Trail camera: in it goes, nobody reads along
The camera sends its image to the server. There it gets encrypted with the public Revier Key (ECDH P-256). The server cannot read it afterwards. Only you, with the private key, can open it.
Key separation via HKDF: RK_data, RK_cam, RK_metaNonce as counter, not randomCrypto in Web Worker isolated
Defense in depth
Additional protection
Encryption is the foundation. On top of it stand further layers:
🔐 Non-extractable keys
The key is held in the browser's secure key store. JavaScript can use it but not read it. Even XSS cannot steal it.
⏱️ Auto-lock
After inactivity (default 5 minutes) the key is discarded. New actions require re-unlocking.
🛡️ Brute-force protection
Three wrong password entries trigger exponential lockout. Argon2id makes every attempt additionally expensive.
🧹 Key zeroization
When the tab or app is closed, all key handles and decrypted data in memory are overwritten.
🔄 Rotation on departure
When a hunting companion leaves, the key is rotated and all data is re-encrypted. New data is unreadable to them.
📦 Encrypted exports
When you export your data, the export is password-protected by default. Unencrypted only as a deliberate choice.
Responsibility
Password & recovery
The flip side of real encryption: no key, no data. If no one still has the hunting-ground password, the encrypted data is irretrievably lost. We cannot restore it either.
When you set up your ground, we show a recovery code (12 words) that you store safely, separate from the password. It is your only backup. We do not store it on our side.
⚠️ Forgotten password without recovery code = data loss. That is not a bug but the consequence of "we cannot look inside." It is explicitly stated in the terms.
Your password is checked against known databases (Have I Been Pwned) and rated for strength when you set it. A weak password makes even the best encryption attackable.
Verifiability
The proof: see it on your own data
The strongest promise is worthless if you cannot verify it. When encryption is active, you can see on this page on your own data what really sits on the server:
