Your photos.
Your private
photo vault.

What is encrypted?

Original photo and video files, their previews, and sensitive library metadata are encrypted before they are stored in the vault. AES-GCM provides authenticated encryption: changing the encrypted bytes or using the wrong key causes authentication to fail.

256-bit keys, independent vaults

Each vault starts with a randomly generated 256-bit encryption key. Separate media and preview keys are derived for stored objects. Your chosen password, six-digit passcode or swipe pattern protects access to the vault key together with a device-held secret. All lock methods use the same AES-256 encryption; more pattern dots do not change the encryption key size. A stronger password or less predictable pattern still matters.

Who can open the vault?

Photo Vaulty does not operate a photo-storage server or keep a developer master key. Your passwords and recovery keys are not sent to Apple or RevenueCat through the purchase integration. We cannot decrypt your vault or reset a lost recovery key for you. Face ID or Touch ID is an optional device-local way to unlock; it does not replace encryption or your recovery key.

What happens during unlock?

Private content is decrypted for use only after successful authentication. The locked-screen blur is decorative artwork, not a saved screenshot or blurred copy of your private photos. The blur-to-clear reveal happens after unlocking. Relocking removes the private library view; a separate privacy cover protects the app-switcher view.

Backups and sharing

Personal backups are encrypted and need the appropriate recovery key. Pro sharing and device transfers create independent encrypted snapshots with a separate transfer key. Keep keys separate from the files they unlock. Transfers do not automatically synchronize changes or revoke other copies.

The protection has boundaries

Encryption protects stored vault data. It cannot prevent someone from seeing an already unlocked screen, taking a screenshot, accessing explicitly exported plaintext, or using a compromised operating system. Imports leave original copies in Apple Photos, including any independently enabled backups. Duress deletion affects local vaults and device-held keys, not external copies or flash-memory remnants.

Verification and status

Automated tests have checked the 256-bit key requirement, tampering rejection, incorrect-key handling, locked storage, recovery, encrypted backups and isolated deletion. These tests are not an independent security audit. Additional physical-device, accessibility and purchase testing remain part of preparation for release.