Is Google Photos actually private? What zero-knowledge encryption means

"Is Google Photos private?" has an unsatisfying answer: it is secure, and it is not private in the way most people mean. Those are different properties, and the difference lives entirely in who holds the decryption keys.

Three levels of encryption, in plain language

Encryption in transit (TLS)

Your photo is scrambled while it travels from your phone to the server, so someone on the same café Wi-Fi cannot read it. Essentially every service does this. It says nothing about what happens after the upload lands.

Encryption at rest (provider-held keys)

The file sits encrypted on the provider's disks, which protects you if a hard drive is stolen or a data centre is physically breached. But the provider holds the keys and can decrypt on demand — for its own features, for lawful requests, and, in a worst case, for an attacker who compromises the right internal system. This is what Google Photos, iCloud Photos by default, and most mainstream services use.

End-to-end / zero-knowledge encryption

Your device encrypts the photo with a key derived from a secret only you have, before it leaves the phone. The provider stores ciphertext it genuinely cannot read. "Zero-knowledge" is the stronger framing: the provider has no knowledge of your content and no key path to it, even under legal compulsion or internal misuse.

So what can Google actually see?

Google is not hiding this — it is documented, and it is how the features work. Content analysis is what lets you search "dog on a beach" and get results, what groups faces, and what builds those year-in-review montages. Google states it does not use your personal photos to show you ads. But the underlying capability is unavoidable: the system can read your library, and the metadata around it (location, timestamps, device, who you share with) is even easier to analyse than the pixels.

The simple test: if a service can show you a thumbnail of a photo, or search inside it, without you entering a password, then the service can read your photos. That is not a scandal — it is just not zero-knowledge.

The honest trade-offs of zero-knowledge

Anyone selling zero-knowledge without mentioning the costs is selling you something. The real ones:

• Lost password can mean lost photos. If nobody but you holds the key, nobody but you can recover it. Recovery keys and codes exist for this reason and must be stored somewhere safe.
• Server-side content search does not work. Search has to run on your device, over what has been downloaded or indexed locally.
• Some conveniences get slower or clunkier — web previews, instant sharing to non-users, server-side transcoding of large videos.
• It does not hide everything. File sizes, upload times and account activity are still visible to the provider. Encryption protects content, not the fact that you uploaded something.

Where Memories on Cloud stands

Memories on Cloud is built so that your library is not readable for advertising, profiling or model training, and so that privacy is the default rather than a special locked folder you have to remember to use. We would rather describe our encryption model precisely in our Privacy policy than hide behind the word "military-grade", and we would rather you ask any provider — us included — the questions below before trusting them with a decade of family photos.

Questions to ask any "private" photo app

1. 1Who holds the decryption key — me, or you?
2. 2If I forget my password, can you restore my photos? (If yes, you hold a key.)
3. 3Is encryption on by default, or only inside a special folder?
4. 4Is metadata — location, timestamps, filenames — encrypted too, or only the pixels?
5. 5What exactly do you do with my data, in one sentence I can find in your privacy policy?
6. 6Can I export everything and delete my account without contacting support?

A provider that answers those clearly is worth more than one that just says "your privacy matters to us".