Private photo vault
Privacy Policy
Effective September 2, 2026
The short version. There is no account, no sign-up and no server of ours. Your photos and
videos are encrypted on your own device. We never receive them, and we could not read them if we
did — the key never leaves your device.
What we collect
Nothing that identifies you. We operate no server and no database. The app has no analytics SDK,
no advertising SDK and no crash reporter.
Your photos and videos
- Files you add are encrypted on the device with AES-256 before they are written anywhere.
- On iPhone and iPad, the encrypted files go to your own private iCloud container, under
your Apple ID. The key is generated on the device and lives in your iCloud Keychain, which Apple
protects with end-to-end encryption.
- On Android, the encrypted files stay in the app's private storage on the phone. The key is
generated on the phone and wrapped by its hardware keystore, which does not let it be copied out.
Android's cloud backup is switched off for this app on purpose: it would carry the files away from
the key and leave you with a vault nothing can open. Moving to a new phone is done with an encrypted
backup file you save yourself, protected by a password only you know.
- Neither store's copy is readable by us. We have no access and no way to request it.
Permissions the app asks for, and why
- Picking photos. Selection happens in the system picker — Apple's on iOS, Android's photo
picker on Android. It runs outside the app and hands over only what you chose; the app never reads
the rest of your library and, on Android, never asks for permission to.
- Photos, on iOS only. Requested if you choose to delete the originals after importing, and
only for the items you picked. Android gives no app the ability to delete a photo it was handed, so
there the originals stay in your gallery until you clear them yourself.
- Saving back out. Exporting writes the file to your own photo library. On Android this
needs no permission at all.
- Biometrics. Face ID and Touch ID on iOS, fingerprint and face unlock on Android. Used to
unlock the vault and to reset a forgotten passcode. Biometric data never leaves the device's secure
hardware and is never seen by the app.
- Camera. Off by default. If you switch on the break-in log's photo option, the front camera
takes one still after repeated wrong passcodes. That picture is encrypted on the device with the same
key as your files and stored beside them, so it travels with the vault like everything else. It never
reaches us — we have no server to send it to — and clearing the log deletes it.
Purchases
Subscriptions and the lifetime purchase are processed by the store you bought from — Apple on iOS,
Google Play on Android. We use RevenueCat, Inc. to verify receipts and to tell the app whether your
purchase is active. RevenueCat receives a random identifier generated for your installation plus the
transaction details the store provides. It does not receive your name, your email or anything about
your files. See
RevenueCat's privacy policy.
This is the only external service the app contacts.
Children
The app is not directed to children under 13 and collects no personal information from anyone.
Changes
If this policy changes, the new version appears on this page with a new effective date.
Contact
[email protected]