I m curious how people protect truly sensitive info when the real risk isn t AES gets broken, but it leaks during sharing, coordination, or human error over everyday channels (chat/email/cloud links).
Two examples:
Example A (friend, anonymized):
My friend shared a dissertation draft (epilepsy-medication research) via a folder link for quick feedback, planning to secure it later. The link got forwarded, permissions were too open, and the draft leaked. No hacking just human error + link forwarding.
Example B (real, last 2 years):
In Aug 2025, ICE accidentally added a random person to a group text ( Mass Text ), exposing sensitive operational details in real time. It wasn t a sophisticated breach it was a simple wrong recipient added to the thread mistake, but with serious consequences.
I m asking because I m a developer and I m currently prototyping an offline-first approach to send now, reveal later file sharing, where access can be conditional not just who has the link, but also when and where it becomes readable.
Hi Product Hunt 👋 maker here.
TrueLock is an offline-first way to share a single encrypted capsule file (.cfcaps) where the access rules travel with the file — so you can send it over any channel, but it only opens when the rules match.
Rules (AND/OR):
time window
geo radius (Windows geo can be confirmed via phone relay / QR proof)
password (Argon2id)
visual key (up to 5 images, can be split across people)
optional device checks (when available)
Capsules can include text + attachments/media, voice messages, and an in-app photo series.
Quick question: which rule would you actually use first?
A) “send now, open later” (time)
B) “open only at this place” (geo)
C) “team unlock” (visual key)
Reply with A/B/C + 1 sentence use case — I’ll prioritize the most requested workflows.
Hey Product Hunt 👋 maker here.
A bit more detail for anyone curious:
TrueLock creates a self-contained .cfcaps file: encrypted payload + embedded policy (rules travel with the file).
Rules can be combined with AND/OR: time window, geo radius (Windows via phone relay / QR proof), password (Argon2id), visual key (up to 5 images), optional device checks.
Capsules can include text + attachments/media, voice messages, and an in-app photo series.
Current clients: Android + Windows.
If you tell me your use case, I can suggest the simplest rule setup (and I’ll use feedback to refine onboarding).