Password & 2FA notes — logins + live TOTP codes with countdown ring QR code scanner for 2FA setup Decoy vault — duress trigger opens a separate empty vault Encrypted backup & restore (.captchastash files) Search, tags & auto-expiry Eleven CAPTCHA types — the seven new ones (Emoji Sequence, Counting, Odd One Out, Word Math, Analogy, Clock Reading, Memory) with live preview Multi-CAPTCHA & biometrics Inactivity auto-lock Screen-capture protection Safer clipboard (local-only, 60s auto-clear) Stronger security foundations (the hardening round — crash-safe Keychain, stronger backup KDF, lockout backoff, auto-wipe) Reliability & polish (redesigned Settings, About screen, faster saving, bug fixes)

What's New in Version 1.2 Rich Note Types CaptchaStash now stores more than just text. In addition to text notes, you can now save photos, videos, audio recordings, and documents — all protected by the same AES-256-GCM encryption as your text notes. Audio can be recorded directly in the app; photos and videos are imported from your library without requiring permanent photo access; documents can be imported from Files and shared or exported via the system share sheet. 7 New CAPTCHA Challenges Version 1.2 adds seven new CAPTCHA types, bringing the total to eleven: - Emoji Sequence — tap emojis in the correct order - Counting — count objects in a grid - Odd One Out — spot the item that doesn't belong - Word Arithmetic — solve simple word-based math - Analogy — complete the pattern - Clock Reading — read an analogue clock face - Memory — memorise and recall a sequence You can preview and try all 11 types from the Settings screen. Optional Biometric Second Factor Turn on Face ID or Touch ID as a second unlock step in Settings. After a correct CAPTCHA, the app can require a biometric confirmation before granting access — adding a hardware-backed layer of security. Settings explains the trade-offs clearly so you can decide what's right for you. Security Hardening This release brings a full security audit's worth of improvements: - Encryption keys now require the device passcode to be set; they are never backed up to iCloud - Attachments are excluded from iCloud backup and iCloud Keychain sync - The vault re-locks automatically whenever the app leaves the foreground - Failed CAPTCHA attempts now trigger exponential backoff (5 s → 15 s → 30 s → 60 s), and the lockout timer persists across app restarts — force-quitting doesn't reset it - All temporary files are written with Complete File Protection - A confirmation alert is shown before any file is sent to the share sheet About Screen Tap the ⓘ button on the unlock screen to open a full in-app reference covering note types, all CAPTCHA challenges, and a plain-language explanation of CaptchaStash's security architecture.

1. Military-grade encryption: AES-256-GCM provides both confidentiality and authentication 2. Secure key management: 256-bit keys stored securely in iOS Keychain 3. Replay protection: Each encryption uses a unique nonce 4. Device binding: Keys are device-specific and require device unlock 5. Authentication: Built-in tamper detection prevents data modification