You can now send photos and video in Shoal: a single picture, a short clip, or a whole album in one go, taken with the app’s own camera or pulled from your library. Like voice notes before them, the feature was easy to want and a little involved to build without bending the encryption rules.
Encrypted like everything else
A photo is content, so it’s treated like content. The image is encrypted on your device before it leaves, and our servers store an opaque blob — they never see the picture. The details that ride along with it, like its dimensions, its caption, and which album it belongs to, are tucked inside the encrypted envelope rather than left readable beside it. We reused the same two-step upload path the voice and video features already use, so there’s one well-worn road for media rather than a new one per file type.
The in-app camera
The old “take a photo” button just handed you off to the operating system’s camera. Now there’s a proper camera inside Shoal: a live preview, a photo/video toggle, a front-and-rear switch, and for video a clear elapsed-and-remaining timer that stops itself at the cap. Whatever you capture drops into the same caption-and-send screen as a picture from your library, so there’s one way to send, however the photo got there.
The small touches
A couple of details we cared about more than their size suggests. When a photo is loading, you see a soft blurred impression of it rather than a grey box — a tiny fingerprint of the image, generated on the device, that gives you the shape and colour while the real thing arrives. And a video shows a still poster frame before it plays, so a conversation full of clips doesn’t look like a wall of black rectangles.
An honest little bug, fixed
One we’ll own up to, because it’s a good example of the work: photos straight from an iPhone library are often in a format the browser can happily show but stubbornly refuses to decode through the usual route — and in an album, one such photo used to take the whole batch down with it. We taught the app to fall back to the same path it already uses to preview the picture, so the formats it can clearly display, it can now also send. Unglamorous, and exactly the kind of thing that decides whether a feature feels finished.
Some honest limits
There are sensible caps on size and clip length to keep things quick and storage honest. Very old devices can be fussy about certain camera and image formats, as the bug above hints; we handle the common cases and keep chipping at the rest. Media is held encrypted at rest like the rest of your conversation, within the same architectural limits described on the privacy page.
How this fits with everything else
Photos and clips are messages: admin oversight sees them, moderation acts on their captions, active hours gate them, and they queue in the offline outbox like anything else. The security page lists media alongside everything we hold encrypted.
Try Shoal, send the grandparents a photo dump, and tell us how it feels at [email protected].