Media Den

Choosing a Storage Backend

Media Den does not run its own servers and never holds your files. Everything you put in the vault is encrypted on your device and then uploaded to a cloud account that belongs to you. You choose which cloud that is when you set the app up, and you can change it later or mirror to a second one.

There are four options: iCloud Drive, Amazon S3, Google Drive, and Microsoft OneDrive. This page lays out how they differ so you can pick the one that fits, and then walks through setting each of them up.

How the Four Compare

None of these is the "best" backend. The right pick depends on which of those rows you care about. The sections below describe the character of each.

iCloud Drive

The zero-configuration option. If you are signed into iCloud and have iCloud Drive turned on, setup is a single tap with no credentials to enter, and your vault syncs across devices signed into the same Apple ID. Storage comes out of your iCloud quota: 5 GB free, more with iCloud+. You do not choose where the data lives, and there is little to configure, which is the point. Saving is fast because a file is written to a local copy on your device and then synced up to iCloud in the background; the one thing to know is that a file which lives only in iCloud and has not downloaded to this device yet, one added on another device for instance, takes a moment to arrive before it opens.

Amazon S3

The most capable and the most involved. You create a bucket and an access key in your AWS account, then enter the bucket name, region, and keys into Media Den. In return you get things the consumer drives do not offer: you choose the region your data physically sits in (Media Den lists 15), and the bucket is a full cloud-storage platform you can layer your own versioning, cross-region replication, lifecycle rules, object lock, and event triggers on top of. Billing is pay-as-you-go per gigabyte and per request rather than a flat plan, which tends to be inexpensive for a personal vault but has no standing free tier. This is the option for people who already use AWS or who want the most control and room to scale.

Google Drive

Sign in with your Google account and grant access; there is nothing else to configure. Media Den asks only for permission to see and manage the files it creates, so it can never read the rest of your Drive. Storage comes from your Google account quota: 15 GB free, shared with Gmail and Google Photos, more with Google One. Because Drive addresses folders by an internal ID rather than by path, Media Den does a little extra folder resolution on each write that the path-based backends avoid.

Microsoft OneDrive

Sign in with your Microsoft account. One limit to know up front: only personal Microsoft accounts work, and work or school accounts are not supported. Media Den stores its data in a dedicated app folder rather than roaming your whole OneDrive. Storage comes from your OneDrive quota: 5 GB free, more with a Microsoft 365 plan. OneDrive can throttle a heavy burst of uploads, and Media Den handles that by backing off and retrying on its own.

Setting One Up

All four are configured from the same place in the app: open Settings, go to the Storage section, and choose a backend. What comes next depends on which one you picked.

iCloud Drive

1. On your iPhone, make sure iCloud Drive is on, under Settings > [your name] > iCloud > iCloud Drive.
2. In Media Den, open Settings > Storage and choose iCloud Drive.
3. Confirm the green "iCloud Drive available" indicator, then tap Save Configuration.

Amazon S3

1. In the AWS console, create an S3 bucket in a region close to you. Leave Block all public access switched on so the bucket stays private; nothing in it should ever be reachable from the open web.
2. Create a dedicated IAM user for the app and attach a policy scoped to just this one bucket, granting only the actions Media Den uses. The example policy below does exactly that; replace your-bucket with your bucket name. Do not use your AWS root account keys, and do not grant account-wide or all-bucket S3 access.
3. Generate that IAM user's access key ID and secret access key.
4. In Media Den, open Settings > Storage and choose Amazon S3.
5. Enter the bucket name, region, access key ID, and secret access key, then tap Save Configuration.

Example IAM policy. This grants read, write, and delete on the bucket's objects plus the ability to list the bucket, and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MediaDenObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::your-bucket/*"
    },
    {
      "Sid": "MediaDenListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket"
    }
  ]
}

Google Drive

1. In Media Den, open Settings > Storage and choose Google Drive.
2. Tap Sign in with Google and complete the consent screen. Media Den only requests access to files it creates.
3. Tap Save Configuration.

Microsoft OneDrive

1. In Media Den, open Settings > Storage and choose Microsoft OneDrive.
2. Tap Sign in with Microsoft, using a personal account, and complete the consent screen.
3. Tap Save Configuration.

Mirroring to a second backend

Media Den can also mirror your vault to a second backend for redundancy. In Settings > Storage, tap Add Replica and pick any of the four as the replica; it can be a different provider than your primary, so your vault might live in both iCloud Drive and Amazon S3 at once. When you attach it, the app copies your existing files across and then mirrors every later change, keeping a full, encrypted copy in both places, while ordinary reads still come from the primary. A replica that is offline or on cellular never blocks you: missed writes are queued and caught up later, you can limit that syncing to WiFi, and you can promote the replica to primary whenever you want to switch.