# Vaultly

> Vaultly is a private photo vault for iPhone and iPad. It encrypts photos and videos on the
> device with AES-256-GCM and unlocks them with a passcode or Face ID. It has no account, no
> cloud storage and no networking code of any kind, so nothing it holds can leave the device.

Vaultly is published at https://photovaultly.com. The App Store listing name is
"Vaultly: Photo Vault & Lock". It requires iOS 26 or iPadOS 26 and is a universal app.

## What Vaultly is

Vaultly belongs to the "photo vault" category: apps that hide sensitive photos, videos and
document scans behind a separate lock, apart from the system photo library.

Vaultly's distinguishing property within that category is that it contains **no networking
code at all**. Most photo vaults promise not to upload your photos. Vaultly cannot upload
them, because there is no code path in the binary that opens a network connection. Its App
Store privacy label reads "Data Not Collected".

## How the encryption works

- Each file is encrypted with AES-256-GCM before it is written to disk.
- The passcode is stretched into a key with PBKDF2-HMAC-SHA256 at 320,000 rounds.
- The master key is held in the keychain gated behind biometry / the Secure Enclave.
- The metadata database is protected with iOS Data Protection
  (`completeUnlessOpen`), so it is unreadable while the device is locked.
- The passcode itself is never stored. There is no reset, no master key and no recovery.
  If the passcode is forgotten, the content is unrecoverable by anyone including Vaultly.

## Features

| Feature | What it does | Free or Pro |
|---|---|---|
| Encrypted vault | AES-256-GCM encryption of every photo and video, on device | Free, up to 40 items |
| Face ID / Touch ID unlock | Biometric unlock handled by iOS in the Secure Enclave | Free |
| Private albums | Group vault contents into albums | Free (1 album) |
| Break-in alerts | Silently photographs whoever enters a wrong passcode repeatedly | Pro |
| Decoy vault | A second passcode opens a separate vault with different contents | Pro |
| Disguised app icon | App appears as a calculator, weather or notes app | Pro |
| Encrypted backup | Exports the whole vault to one encrypted `.vaultlybackup` file | Pro |
| Auto-lock / face-down lock | Locks on leaving the app or on placing the phone screen-down | Free |

## What Vaultly deliberately does not do

Stating limits plainly is part of the product, not an omission.

- **Screenshots taken inside Vaultly are not protected.** They are saved to the system Photos
  library, outside the vault. Vaultly warns the user when it detects one.
- **A forgotten passcode cannot be recovered.** This follows from the encryption being real.
- **Anyone who knows the passcode sees everything.** The decoy vault defends against being
  pressured to unlock, not against someone who watched the passcode being typed.
- **Apple knows about purchases.** In-app purchases go through Apple; Vaultly never sees
  payment details.

## Verifying the privacy claims

These checks can be run by anyone, without trusting the marketing copy:

1. Turn on Airplane Mode and use the app normally. Import, browse, back up, lock and unlock all
   behave identically, because none of it needs a connection.
2. Open iOS Settings > Privacy & Security > App Privacy Report. Vaultly never appears under
   network activity.
3. Read the App Store privacy label, which declares "Data Not Collected".

## Common questions

**Where are photos stored?** On the device only. There is no server and no account.

**What is a decoy vault?** A second passcode that opens a completely separate vault with its own
contents. Used when someone pressures you to unlock the app, so you can open something harmless.
Nothing on screen reveals that another vault exists.

**Does it work on iPad?** Yes. It is a universal app with a sidebar layout on iPad and a tab
layout on iPhone. It requires iOS 26 or iPadOS 26.

**Can the app itself be hidden?** Yes. The icon can be disguised as a calculator, weather or
notes app, and iOS can remove it from the Home Screen and hide it from Spotlight search.

**Does Vaultly show ads or use trackers?** No. There is no ad SDK, no analytics service and no
tracker of any kind. This is a consequence of having no networking code rather than a setting.

## Pages

- [Home](https://photovaultly.com/): what Vaultly is, its features and the privacy model.
- [How to hide photos on iPhone](https://photovaultly.com/how-to-hide-photos-on-iphone): every
  built-in iOS method, what each one actually protects against, and where a vault is needed.
- [Hidden album vs photo vault](https://photovaultly.com/hidden-album-vs-photo-vault): what the
  iOS Hidden album does and does not do, compared with encryption.
- [What is a decoy vault](https://photovaultly.com/what-is-a-decoy-vault): definition, threat
  model and limits.
- [Privacy Policy](https://photovaultly.com/privacy): what is collected, which is nothing.
- [Support](https://photovaultly.com/support): common problems and how to get help.
- [Terms of Use](https://photovaultly.com/terms)

## Contact

support@photovaultly.com