A small team building a serious privacy tool.

PRINCIPLES

The five rules we wrote down before the first commit.

1. No account, no email, no recovery.

Every photo vault breach since 2014 has been an account-database breach. The cryptography held; the metadata did not. We decided the only way to win that argument is to not run an account database. The trade-off is that we cannot recover a forgotten pattern — and we are willing to lose that argument every time it comes up.

2. No servers we cannot afford to shut down tomorrow.

AppVault has zero infrastructure that holds customer data. The website serves static HTML. There is no API, no admin panel, no logging pipeline. If Vastflow disappears tomorrow, your installed copy of AppVault keeps working exactly as it does today — because there is nothing to disappear with.

3. No advertising inside a privacy product.

Advertising SDKs are network-connected, data-exfiltrating binaries running inside the app. Even when the SDK is well-behaved, the surface exists. We chose to fund the product directly through paid tiers instead. The free tier covers a single small vault; the paid tiers fund development.

4. No claims we cannot link to a primary source.

Every cryptographic statement on this site — "AES-256-GCM", "PBKDF2 with 600,000 iterations", "Secure Enclave-bound" — points to a NIST publication, an IETF RFC, an Apple Platform Security page, or an OWASP recommendation. If we cannot link a claim to a primary source, we do not make the claim.

5. No marketing that overstates the threat model.

AppVault defends against shoulder-surfing, lost or stolen devices, customs and border inspections, and the half-second when someone borrows your phone. It does not defend against a coerced unlock, a jailbroken device, or a state-level adversary holding both your device and your wrists. We say so on the Security page in plain English, because a privacy product that overstates its threat model is the one you should not trust.