**Encrypted notes in App-Vault — what is and is not stored, and why** > App-Vault v1 stores photos, videos, and documents. It does not store free-form text notes. The one text item that matters — the BIP-39 12-word recovery phrase — is generated on-device and written down on paper. Source: https://appvau.lt/encrypted-notes/ FILE 10 / NOTES — SCOPE # App-Vault encrypts files, not free-form text. On purpose. The one piece of text App-Vault produces is the 12-word recovery phrase shown during onboarding — and that lives on paper, not in the app. Free-form encrypted notes are not part of v1, and we are in no hurry to ship them poorly. UPDATED · 2026-05-20 · REVIEWED BY APP-VAULT DEFINITION **App-Vault note storage** is intentionally limited in version one. The encrypted compartment stores photos, videos, and documents imported from the iOS Photos library or the Files app. Free-form text notes are out of scope until we can ship them without growing the attack surface. The only text App-Vault itself generates is the BIP-39 12-word recovery phrase shown once during onboarding, which is meant to be written on paper and kept offline. ## The scope a small product can defend Every privacy product fails in the same direction: it tries to be everything, the attack surface grows, and a sharp edge somewhere lets the whole thing down. App-Vault v1 deliberately limits itself to a single primitive — an encrypted container for files you import — and refuses to grow that scope until each existing primitive has been audited and matured. Free-form text notes look small from the outside. From the inside, they are not. A text-note feature wants to grow: rich text, autofill into other apps, browser extensions, structured fields, search across notes, sharing one note without the rest, OCR pulling text out of photos. Each of those is a new attack surface. Each one needs its own cryptographic story. Each one is a place where a single bug turns the vault into a leak. We are not in a hurry to add all of that for a feature only some users want. ## The piece of text that App-Vault does care about There is one piece of text that matters: the **BIP-39 12-word recovery phrase**. App-Vault generates this phrase during onboarding using the standard English BIP-39 wordlist (the same wordlist used by Bitcoin wallets, with a checksum word that catches typos). The phrase is shown to you once, on a single screen, and asked to be written down. It is then used internally to derive the master key that wraps your per-file AES-256-GCM keys. The recovery phrase is the survival mechanism for device loss, theft, or a forgotten pattern. It is never uploaded anywhere by App-Vault. It is not stored inside the vault. It is not stored anywhere in the app once you have written it down. It exists in exactly two places: briefly in memory on your device while you read it, and on whatever paper you wrote it on. ## Where to put short secrets that are not the recovery phrase - **Passwords and login codes.** Use a real password manager — 1Password, Bitwarden, Apple iCloud Keychain. They are purpose-built, audited, and integrate with iOS autofill in ways a vault should not try to imitate. - **2FA backup codes.** Either print them and store them with the recovery phrase, or store them in your password manager next to the matching login. Both are defensible. - **Cryptocurrency seed phrases.** Paper. Offline. Two locations. Metal-stamped if the holdings are non-trivial. A digital backup defeats the threat model that motivated the seed phrase in the first place. - **The App-Vault recovery phrase itself.** Paper. Offline. Do not store it in Apple Notes, in your password manager, in a screenshot, or — as a special note — inside App-Vault. Storing the recovery phrase inside the vault it would unlock is a cyclic dependency that breaks on the same day everything else breaks. ## What would change our mind about adding notes A future version of App-Vault might add encrypted notes — but only if we can ship them with a deliberately narrow scope: short plain text, the same AES-256-GCM wrapping as files, no autofill, no browser integration, no form-field detection, no cross-account sharing. If that ever ships, it will be a feature in the same shape as the rest of the app: small, sharp, and limited to one job. QUESTIONS WE HEAR ## About text, secrets, and the recovery phrase. 1. 01 Can I store text notes inside App-Vault? Not in version 1. App-Vault encrypts photos, videos, and documents you import from the Photos library or the Files app. Free-form text notes are not part of the v1 feature set. The one piece of text App-Vault generates and asks you to keep safe is the BIP-39 12-word recovery phrase shown during onboarding — write it down on paper, store it offline. 2. 02 What should I use for short secrets instead? For passwords, autofill, browser extensions, and the everyday flow, use a real password manager — 1Password, Bitwarden, or Apple iCloud Keychain. Each of those is purpose-built for short structured secrets and integrates with iOS autofill in ways a small indie vault should not try to imitate. For one-off offline notes (a passport number, a single 2FA backup code, the App-Vault recovery phrase itself), write them on paper and store them in a fireproof box or a safe-deposit box. Paper, kept offline, is a surprisingly strong threat-model improvement over any digital alternative. 3. 03 Will encrypted notes come in a future version? It is on the long-term feature wishlist, not the short-term roadmap. We will only ship encrypted notes if we can do it without expanding App-Vault's attack surface — and that means resisting the urge to add autofill, browser extensions, and form detection, which is where note features tend to grow into half-baked password managers. If we ship it, expect a deliberately narrow scope. 4. 04 Where do I store the recovery phrase? On paper. Offline. Ideally in two physical locations (home + safe-deposit box, or home + trusted family member). Do not store the recovery phrase in Apple Notes, in a screenshot, in a cloud-synced note app, or as a photo in any app — including App-Vault itself, which would create a cyclic dependency where the phrase that recovers the vault lives inside the vault. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Photo & File Vault What App-Vault does store.](https://appvau.lt/photo-vault/) - [LINK / 02 · BACKUP Why the vault is excluded from iCloud Backup And how the recovery phrase replaces it.](https://appvau.lt/encrypted-icloud/) - [LINK / 03 · CRYPTOGRAPHY AES-256-GCM encryption stack The cipher under the vault.](https://appvau.lt/encryption/) - [LINK / 04 · TRUST Threat model What App-Vault defends against and what it does not.](https://appvau.lt/security/) - [LINK / 05 · TRUST No-account architecture No server holds your data because no server exists.](https://appvau.lt/zero-knowledge/) - [LINK / 06 · OVERVIEW All features The full list of what is in v1.](https://appvau.lt/features/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/encrypted-notes/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0).