People increasingly use messaging apps not just to chat but to send the files that matter most: passport scans for a visa application, medical test results to a family member, a signed contract to a collaborator, or a folder of photos from a trip.
Signal and iMessage are two of the most privacy-conscious messaging platforms available. Both offer end-to-end encryption. But end-to-end encryption is not the whole story, especially when personal files are involved.
This post compares how Signal and iMessage handle the things you send — files, photos, documents — and what that means for your privacy and your data’s long-term security.
The Shared Foundation: End-to-End Encryption
Both Signal and iMessage encrypt messages (and files sent within those messages) end-to-end by default. This means:
- The content of your messages is encrypted on your device before it leaves
- It is only decrypted on the recipient’s device
- The platform itself — Signal Foundation or Apple — cannot read the content
This is a meaningful protection. It means a data breach at the platform level, or a government request without a device-level warrant, cannot expose the content of what you sent.
But end-to-end encryption only protects data in transit. What happens to files once they arrive — how they’re stored, synced, and retained — is a separate question, and this is where Signal and iMessage diverge significantly.
Signal: Minimal Data, Maximum Transparency
Signal is built around a single principle: collect as little data as possible and make the code open source so that claim can be verified.
What Signal stores about you
Signal’s data retention is unusually minimal:
- It knows your phone number (required for registration)
- It knows the date you created your account and the date you last connected
- It does not store your messages, files, or any content you send on its servers
Files sent through Signal — photos, documents, audio — are encrypted in transit and not retained on Signal’s servers after delivery. Once a message is delivered to the recipient’s device, the Signal server has nothing left.
Disappearing messages
Signal’s disappearing messages feature can be set to automatically delete messages (and attached files) from both devices after a timer you choose, ranging from a few seconds to weeks. This gives you control over the lifetime of sensitive files on both ends of the conversation.
What stays on your device
Everything you send and receive in Signal is stored on your device — encrypted within Signal’s own local database. If you back up your phone using iCloud, Google Drive, or any other cloud backup service, Signal messages are excluded by default from those backups.
This is a deliberate design choice. It means that if you lose your phone without a Signal backup, you lose your message history. It also means your conversations don’t get swept into Apple’s or Google’s servers via automatic backup.
Limitations
Signal is not without practical limitations for file sharing:
- There is a file size limit (currently 100 MB per file)
- Files sent in Signal do not automatically sync across multiple devices
- Signal on desktop does not always receive files that were sent to your mobile app before you installed the desktop version
- If the recipient saves a file to their device’s default gallery or downloads folder, it immediately leaves Signal’s protection
Signal is excellent for sending a sensitive file to a specific person with confidence that the transmission is private. It is not a file storage or archive system.
iMessage: Strong Encryption, But It Gets Complicated
Apple’s iMessage provides genuine end-to-end encryption between Apple devices. But its integration with iCloud creates a situation that many users don’t fully understand.
The iCloud backup problem (and solution)
By default, iCloud backs up your iPhone — and that backup includes your iMessage history, including every photo and file you’ve sent or received. iCloud backups are encrypted, but historically Apple held the encryption keys, meaning Apple could technically access them in response to a legal request.
Apple introduced Advanced Data Protection (ADP) — an opt-in setting that extends end-to-end encryption to iCloud backups. With ADP enabled, Apple cannot access your iCloud backup, including your iMessages, even with a court order. Only your trusted devices can decrypt it.
The critical qualifier: ADP is not enabled by default. You have to actively turn it on in Settings → [Your name] → iCloud → Advanced Data Protection.
If you use iMessage and have not enabled ADP, your messages — including attached files — are accessible to Apple via your iCloud backup, and therefore accessible to law enforcement via Apple.
Photos sent via iMessage and the Photo Library
When someone sends you a photo in iMessage, it lands in your Messages app. If you tap “Save Image,” it moves to your iPhone’s Photos app — and if iCloud Photos is enabled, it syncs to iCloud immediately.
At that point, the photo has left iMessage’s end-to-end encrypted context and entered iCloud’s standard encryption framework (or ADP’s stronger protection, if you’ve enabled it).
The file’s privacy now depends on where it lands, not where it started.
iMessage on non-Apple devices
iMessage only works between Apple devices. Messages sent from an iPhone to an Android device fall back to SMS or RCS — neither of which offers end-to-end encryption by default. This is an important limitation: if your contact uses Android, your “iMessage” conversation may be unencrypted at the network level.
Direct Comparison: Signal vs iMessage for File Sharing
| Factor | Signal | iMessage |
|---|---|---|
| End-to-end encryption | Yes, always | Yes, between Apple devices |
| Works on Android | Yes | No (falls back to SMS) |
| Server-side data retention | None | Messages backed to iCloud by default |
| Backup encryption | Excluded from cloud backups by default | Unencrypted unless ADP is enabled |
| Disappearing messages | Yes, flexible timer | Yes (but must be enabled per conversation) |
| File size limit | ~100 MB | Larger, but varies by connection |
| Cross-platform | iOS, Android, desktop | Apple devices only |
| Transparency | Open source, audited | Closed source |
| Metadata collection | Minimal (phone number, last login date) | More — Apple logs account activity |
What Neither Is Designed to Do
Both Signal and iMessage solve one problem: private, ephemeral communication between people. Neither is designed to be a file archive.
This distinction matters if you’re using a messaging app as your de facto storage system for important documents and photos.
Files sent via Signal can disappear if disappearing messages is enabled, or if a device is lost or replaced without a proper backup. Files sent via iMessage depend on your iCloud settings and can be affected by storage limits, account issues, or policy changes.
If you’re sending a scan of your passport to a family member once and need it nowhere else, Signal is excellent for that specific use case. But if you want to reliably store, organise, and access personal files over time — medical records, contracts, important photos, financial documents — you need dedicated storage, not a messaging app.
Messaging apps are pipes, not vaults.
The Right Tool for Each Job
Use Signal when:
- You need to send a sensitive file to a specific person privately
- You want confidence that the transmission cannot be intercepted
- You want the option to make the file disappear from both devices after a set time
- Your recipient is on Android or another platform
Use iMessage when:
- You’re already in the Apple ecosystem and your contacts are too
- You’ve enabled Advanced Data Protection in iCloud
- The file doesn’t require the same level of metadata minimisation that Signal provides
Use dedicated private storage when:
- You need to reliably store and retrieve files over time
- You want files accessible across devices without depending on a specific messaging thread
- You need to share files with someone without sending them through a chat
daftei is built for the storage and retrieval layer. Files are encrypted at rest using AES-256 and transferred using TLS 1.3. daftei does not sell your data, does not serve ads, and does not use your files for AI training. The 5 GB free tier is enough to test whether it fits your workflow before deciding on a paid plan.
The Honest Advice
Signal is the most private option for sending personal files to another person. Its minimal data collection, open-source codebase, and exclusion from cloud backups make it the best choice for one-off transmission of sensitive material.
iMessage is strong when Advanced Data Protection is enabled, but its Apple-only reach and the non-obvious nature of backup encryption make it a conditional recommendation that most users aren’t configured to take full advantage of.
Neither should be mistaken for a storage system. Use them to send files. Use something else to keep them.