Skip to content

App Lock

Your device's own lock screen protects Grafida when the device is locked. App Lock protects it when the device is not — when it is in somebody's hand, unlocked, and that somebody is not you.

It is optional and off by default. You can lock the whole of Grafida, or only particular sites, or both.

Open it from the Sites screen: tap the ⋯ button, then App Lock.

What it protects against, and what it does not

Grafida can reach every article of every site you have connected — including the ones that are private, and the ones that are not published yet. Your API token is kept in the device's Keychain and is never shown again after you enter it, so nobody can take it. But an unlocked device in the wrong hands does not need to take it: Grafida will happily spend it for them.

That is the gap App Lock closes. Somebody who picks up your unlocked device meets an authentication prompt instead of your articles.

It is not, and cannot be, protection against somebody who has your device and plenty of time. Anyone able to restore a backup or read the device's storage directly can reach the same data. App Lock raises the cost of the grabbed-device moment, and it prevents the accidental exposures described below. Treat it as that, not as a safe.

Locking Grafida

Turn on Lock Grafida and Grafida asks you to authenticate:

  • when you open it, and
  • when you come back to it after a minute or more spent in another app.

The minute is deliberate. Switching to Safari to copy a link, or to Photos to fetch a picture, is ordinary work in the middle of writing an article, and being asked to authenticate every single time would only teach you to turn the feature off.

Locking individual sites

Every connected site gets its own switch under Protected sites. A locked site asks you to authenticate before it opens, and stays open for the rest of your session under the same one-minute rule.

The two locks are independent. Locking Grafida does not unlock a protected site, and unlocking one site does not unlock another — if you keep one sensitive client site among several ordinary ones, you can protect just that one.

A protected site shows a small padlock beside its name in the Sites list.

Turning a lock off also asks

Switching any of these locks off asks you to authenticate first, exactly as switching it on does. That is the point: a lock that anybody holding your unlocked device could flip off in the Settings app would not be a lock at all. It is also why these two settings are the only ones in Grafida that are not in the device's Settings app.

Switching a lock on asks too, which confirms that authentication actually works on this device before you come to depend on it.

Face ID, Touch ID, or your passcode

Grafida asks iOS/iPadOS for authentication and lets it decide how: Face ID or Touch ID if your device has it, your device passcode otherwise — and your passcode is always available as a fallback if the biometry does not recognise you.

That fallback matters. Local articles you have not published yet exist only on this device. If a scratched finger or a bad angle could shut you out permanently, this feature would be more dangerous than the problem it solves.

If your device has no passcode at all, Grafida cannot ask you to authenticate, and it says so rather than locking you out. Set a passcode in the Settings app and the locks start working.

Hiding content from the app switcher and from screen recording

While anything is locked, Grafida also defends against showing your content by accident:

  • The app switcher. The preview tile iOS/iPadOS keeps of Grafida is covered. Switching apps during a presentation does not flash somebody's unpublished article onto the projector.
  • Screen recording and mirroring. While the screen is being recorded, sent over AirPlay, or mirrored to a display, Grafida hides its content and says why.

Screenshots

iOS and iPadOS do not let any app prevent screenshots. That is a limitation of the operating system, not a decision Grafida has made — and any app claiming otherwise is relying on undocumented behaviour that can stop working at any update.

What Grafida can do, and does, is tell you: take a screenshot while something is locked and a message appears reminding you that the picture may contain content from a protected site. What you do about it is then up to you.