# App-Vault — full text of the primary pages > Generated at build time from the rendered pages, so nothing here can disagree with what a reader > sees. The datasets behind the numbers are at https://appvau.lt/api/v1/openapi.json and the index of the > site is at https://appvau.lt/llms.txt Generated: 2026-09-11 **App-Vault — iPhone photo vault with AES-256 encryption** > App-Vault is an iPhone photo and file vault with on-device AES-256 encryption, pattern lock, and an optional calculator launcher. No account. Vault contents stay on the device and never upload to a server. Source: https://appvau.lt/ FILE 01 / ENCRYPTED LOCALLY # Your photos. Sealed shut. AES-256 on-device encryption. No account. Vault contents stay on the device. Your pattern is the only key — mathematically. [Download for iPhone](https://apps.apple.com/app/apple-store/id6769763852?pt=127157325&ct=appvault&mt=8) Designed for journalists, travelers, lawyers, and anyone who hands a phone to a stranger now and again. CAMERA ROLL · 12 → VAULT α SEALED · AES-256 FILE 01 / ON-DEVICE Cipher AES-256-GCM Key derivation PBKDF2 · Secure Enclave Servers None — on-device only Account required No SEALED SCAN ME FILE D0 / DOWNLOAD ### Point your iPhone camera at the code. The QR opens the App-Vault listing on the App Store directly. Free download, no account, no email. WHAT IS INSIDE ## Eleven layers between your photos and everyone else. App-Vault is a single iPhone app with a small surface area and a deep stack. Every feature exists to keep your files mathematically yours. - FILE / 01 ### Photo & File Vault A locked album for photos, videos, and documents that never appears in the Photos app, Spotlight, or AirDrop. [Read more about Photo & File Vault](https://appvau.lt/photo-vault/) - FILE / 02 ### AES-256 On-Device Files are encrypted with AES-256-GCM on your iPhone using a key derived from your pattern. The key never leaves the device. [Read more about AES-256 On-Device](https://appvau.lt/encryption/) - FILE / 03 ### Pattern Lock A 5×5 drawing grid replaces the password. Patterns are harder to shoulder-surf and impossible to leak in a breach because no one stores them. [Read more about Pattern Lock](https://appvau.lt/pattern-lock/) - FILE / 04 ### Calculator Launcher App-Vault can present as a fully functional calculator on your home screen. A long-press on the equals key reveals the vault entry — a privacy layer for shared family iPads, customs checkpoints, and lent phones. [Read more about Calculator Launcher](https://appvau.lt/calculator-vault/) - FILE / 05 ### Decoy Vault A second pattern opens a separate, plausible vault with its own album. Useful when one device serves multiple users — kids, partner, work account — without exposing the rest. [Read more about Decoy Vault](https://appvau.lt/decoy-vault/) - FILE / 06 ### Intruder Selfie After a configurable number of wrong patterns, the front camera quietly captures a single photo and stores it encrypted inside the vault on the device, along with the time. Never uploaded. [Read more about Intruder Selfie](https://appvau.lt/intruder-selfie/) - FILE / 07 ### Excluded From iCloud Backup The vault directory is marked NSURLIsExcludedFromBackupKey and the master keys use ThisDeviceOnly Keychain access. Vault contents never enter iCloud, iTunes, or Finder backups. - FILE / 08 ### No Account, No Server No account creation. No email. We operate no server that holds your vault, so there is nothing for us to hand over. Anonymous, content-free funnel events go through Firebase — full disclosure on the Privacy page. [Read more about No Account, No Server](https://appvau.lt/zero-knowledge/) - FILE / 09 ### File Shredder Permanent delete overwrites the encrypted blob three times before unlinking. Once shredded, even physical access to the device cannot recover the file. Pro feature. [Read more about File Shredder](https://appvau.lt/file-shredder/) - FILE / 10 ### 12-Word Recovery Phrase During setup App-Vault generates a BIP-39 12-word mnemonic. Write it down once. It is the only way to recover your vault if you ever forget the pattern. - FILE / 11 ### No Ads No banner ads. No ad mediation SDKs. No cross-app tracking. The App Tracking Transparency prompt is not invoked because the IDFA is never read. HOW IT WORKS ## Three steps. Then everything disappears. 1. 01 ### Draw a pattern Pick a 5×5 grid pattern you can draw in two seconds. The pattern derives the encryption key directly — there is no password stored, anywhere. 2. 02 ### Move files in Import from Photos, Files, or the camera. App-Vault encrypts each file on your device before it touches the vault, then removes the original from the source album. 3. 03 ### Lock and leave Close the app. Without the exact pattern the vault is mathematically indistinguishable from random noise. No login screen for an attacker to bypass — there is nothing to log into. WHO IT IS FOR ## Five honest reasons to keep a vault on your phone. 1. CASE 01 ### Customs and border checks Inspectors ask to scroll your camera roll. With App-Vault, sensitive work, ID, and medical photos live in a sealed compartment that does not appear in the camera roll at all. 2. CASE 02 ### A phone you sometimes hand to a child Shared family iPads collect everyone’s photos. The Calculator Launcher keeps a kid-safe calculator on the home screen while the rest stays sealed behind the pattern. 3. CASE 03 ### Travel with sensitive documents Passport scans, vaccination cards, insurance documents, signed contracts. Encrypted at rest on the device, optionally backed up to your own iCloud encrypted at the file level. 4. CASE 04 ### Professionals with privileged photos Therapists, lawyers, journalists, and medical staff occasionally photograph privileged material. Those photos do not belong in the same album as a dinner snapshot. 5. CASE 05 ### You are about to sell your iPhone The File Shredder overwrites encrypted blobs three times before unlinking. A factory reset is not always enough on older devices — overwrite is. UNDER THE HOOD ## The boring details that decide whether a vault is actually a vault. Encryption is not a feature, it is the entire product. We picked AES-256-GCM and PBKDF2 because they are boring, decades-old, and have survived every public review since the early 2000s. Each file is sealed with a unique nonce. The vault catalog itself is encrypted — without the pattern, an attacker cannot even tell how many files exist. The vault directory is excluded from iCloud Backup and from local iTunes/Finder backups. Cipher AES-256-GCM per file Key derivation PBKDF2-SHA256 · high iteration count · master keys in iOS Keychain (ThisDeviceOnly) Transport Vault contents never leave the device. The only outbound traffic is anonymous, content-free funnel events through Firebase. See the Privacy page for the exact list. Audit Cryptography stack documented on our Security page. Independent review scheduled. PRICING ## One file free. Weekly or yearly for the rest. Free $0 one file in your vault · no card Weekly Premium from $3.99 per week · billed weekly through Apple Yearly Premium BEST VALUE from $29.99 per year · 7-day free trial · best value - Unlimited files in your vault - Disguise — Calculator Launcher with 3 alternate icons - Decoy Vault (second pattern, separate album) - Intruder Selfie and File Shredder - Prices vary by App Store region — exact price shown in-app [Open App-Vault on iPhone](https://appvau.lt/download/) FAQ ## Sharp questions, plain answers. 1. 01 Is the iPhone Hidden Album already secure? No. The Hidden Album is hidden from the Photos app shelf but the photos remain in your camera roll, sync to iCloud unencrypted, appear in Spotlight search, and are visible if anyone scrolls into the Hidden folder. App-Vault stores files in a separate encrypted container that does not appear in any of those places. 2. 02 What happens if I forget my pattern? The pattern derives the encryption key. Without the pattern there is no key, and without the key the vault is mathematically random data. We cannot recover it. During setup App-Vault generates a BIP-39 12-word recovery phrase — write it down and keep it offline. The recovery phrase is the only way back into the vault if you forget the pattern. 3. 03 Do you upload my photos to a server? No. App-Vault has no servers that hold user content and no account system. Vault contents stay on your device, encrypted with a key derived from your pattern. The vault directory is also marked excluded from iCloud Backup and from iTunes/Finder backups. The only outbound traffic from the app is anonymous, content-free funnel events through Firebase — never filenames, never file contents, never your pattern. 4. 04 How is the Calculator Launcher allowed by Apple? It is a fully functional calculator. It does math. The privacy layer is an opt-in long-press on the equals key that opens the vault entry — a standard alternate launcher pattern Apple has approved many times. Nothing about it requires misleading metadata. 5. 05 Can my iPhone restore a backup and unlock everything? Only if you also restore your pattern. Backups contain the encrypted vault. Without entering the pattern on the restored device, the vault stays sealed. 6. 06 Is App-Vault open source? The cryptography stack uses Apple’s audited CryptoKit framework. Our wrapping code is documented in detail on the Security page and a third-party audit is scheduled. Source release is on the roadmap once that audit is complete. 7. 07 What is the difference between the Decoy Vault and the Calculator Launcher? The Calculator Launcher changes what the app looks like on your home screen — a calculator icon instead of the App-Vault icon. The Decoy Vault is about what you see after you unlock — a second pattern opens a separate album, useful on a shared iPad or when handing the phone to someone you trust partway. 8. 08 Can I share a vault with my partner? Vault sharing with a trusted contact is on the roadmap for version 1.1. It will use a public-key exchange so each side decrypts files locally — the server (used only for handoff) never sees plaintext. 9. 09 Why pattern lock instead of a regular password? Patterns are faster, harder to shoulder-surf at a glance, and impossible to leak in a server breach because we do not store them. Face ID and PIN are still available as a quicker convenience unlock after the first pattern of the day. 10. 10 Does App-Vault work offline? Yes. Every core vault function — unlock, import, view, decrypt, file shred, change pattern — runs entirely on the device with no network call. The only outbound traffic is anonymous Firebase funnel events and Crashlytics diagnostics, and the app keeps working if those are blocked at the OS level. GUIDES LIBRARY ## From the guides library. How-to walkthroughs, comparison reviews, and encryption explainers — written for readers, cited to primary sources. - [FILE / G1 ### How to Hide Photos on iPhone — Every Method, Honestly Evaluated A practical guide to hiding photos on iPhone — the built-in Hidden Album's real limits, how dedicated vault apps work, and which approach fits your threat model.](https://appvau.lt/guides/how-to-hide-photos-iphone/) - [FILE / G1 ### Is Apple Hidden Album safe on iPhone? Apple's Hidden album hides photos from view, but it is not a separate encrypted vault. See what it protects, what still syncs, and better options.](https://appvau.lt/guides/is-iphone-hidden-album-secure/) - [FILE / G2 ### Best iPhone Photo Vault Apps 2026 Compare the best photo vault app for iPhone by encryption, key storage, offline use, and subscription model, including App-Vault, Keepsafe, and Vaultaire.](https://appvau.lt/guides/best-photo-vault-iphone-2026/) - [FILE / L4 ### Best Photo Locker App for iPhone Compare the best photo locker apps for iPhone by setup speed, lock type, ads, and disguise features, with honest limits and exact tradeoffs.](https://appvau.lt/best/easiest-app-to-hide-photos-iphone/) - [FILE / L1 ### Best Free Photo Vault Apps for iPhone Ranked by free-tier generosity: file limits, ads, account requirements, and telemetry. Honest breakdowns of what you actually get at $0.](https://appvau.lt/best/free-photo-vault-iphone/) - [FILE / G1 ### Calculator Vault iPhone Guide Best calculator vault iPhone guide for 2026: how calculator photo vault apps work, what iOS allows, and what to check before trusting one.](https://appvau.lt/guides/calculator-vault-apps-iphone/) [Browse all guides](https://appvau.lt/guides/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Photo Vault for iPhone — encrypted, on-device, no account** > App-Vault is an iPhone photo vault that stores photos, videos, and documents in an AES-256 encrypted compartment that never appears in the Photos app, Spotlight search, or AirDrop. No account. No cloud upload by default. Source: https://appvau.lt/photo-vault/ FILE 01 / PHOTO VAULT # A sealed album that does not appear in your camera roll. App-Vault stores photos, videos, and documents in a separate AES-256 encrypted container on your iPhone. Files inside the vault do not appear in the Photos app, in Spotlight, in iMessage attachments, in AirDrop suggestions, or in any other Apple system surface. ## What it actually does When you move a photo into App-Vault, three things happen in sequence. The file is encrypted on your device with a fresh AES-256-GCM key. The encrypted blob is written to App-Vault’s sandboxed container. The original file is removed from the Photos app — not moved to Recently Deleted, not hidden, but securely overwritten before the unlink. After import, the photo exists only inside the vault. It is not in your camera roll. It is not in your Hidden album. It is not in iCloud Photos (unless you opted into encrypted backup, which encrypts it again before upload). It is not indexed by Spotlight. It does not show up if someone scrolls through your phone or asks Siri to find pictures from last summer. ## What it does not do App-Vault does not pretend to make a photo invisible to a forensic examination. If an attacker has physical access to your device, the encryption you signed up for is exactly what protects the file — strong, current, and standard. There is no "extra" magic, and there is no backdoor in case you forget your pattern. We made the vault to be the boring kind of secure: well-known cipher suite, well-known key derivation, no novel cryptography invented in our office. App-Vault is also not a backup app. iCloud Photos will not recover what you have moved into the vault, and the vault itself is explicitly excluded from iCloud Backup and iTunes/Finder backups. Survival across device loss is handled by the BIP-39 12-word recovery phrase generated during onboarding — write it down once on paper and keep it offline. ## Who tends to use it Most installs come from one of five places: people about to sell an iPhone, people traveling internationally, professionals who occasionally photograph privileged work (lawyers, journalists, therapists, medical staff), parents of teenagers who share a family device, and anyone who has ever handed their phone to a stranger and remembered, halfway through, what was open in Photos. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CRYPTOGRAPHY AES-256-GCM encryption stack The cipher that seals every file inside the vault.](https://appvau.lt/encryption/) - [LINK / 02 · KEY Pattern Lock The 5×5 drawing that becomes your encryption key.](https://appvau.lt/pattern-lock/) - [LINK / 03 · CORE Decoy Vault A second pattern, a separate album, with no link between them.](https://appvau.lt/decoy-vault/) - [LINK / 04 · CORE Calculator Launcher The vault disguised as a real calculator on your home screen.](https://appvau.lt/calculator-vault/) - [LINK / 05 · DEFENSE Intruder Log What happens after three failed pattern attempts.](https://appvau.lt/intruder-selfie/) - [LINK / 06 · COMPARE App-Vault vs Keepsafe Why on-device beats account-and-cloud for sensitive photos.](https://appvau.lt/compare/app-vault-vs-keepsafe/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/photo-vault/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Calculator Vault — fully functional calculator with a private layer** > App-Vault’s Calculator Launcher presents as a fully functional iPhone calculator with an opt-in long-press to enter your encrypted vault. Designed for shared family devices, customs checkpoints, and lent phones. Source: https://appvau.lt/calculator-vault/ FILE 04 / CALCULATOR LAUNCHER # A working calculator. Quietly, also a vault. The Calculator Launcher is an optional alternate icon that turns App-Vault into a fully functional calculator on your home screen. It does arithmetic. It calculates tips. It also, on a long-press of the equals key followed by your pattern, reveals the encrypted vault. WHY IT EXISTS ## A phone you sometimes hand to a stranger. A border agent asks to flip through your photo roll. A friend grabs your phone to take a group photo and casually swipes left. Your kid plays with your unlocked iPad on a long flight. In any of those moments, you do not want to explain why you have a private vault app on your home screen. The Calculator Launcher is the answer. With it enabled, App-Vault appears on your home screen as a clean, branded calculator. Open it and it calculates. Hand it to your kid and they will compute. Show it to an inspector and they will see a calculator. Only you know that a long-press on the equals key, followed by your 5×5 pattern, opens an entirely separate encrypted compartment. DEMO / CALCULATOR.APP LAUNCHER 8 ÷ 2 = 789÷456×123−0.=+ LONG-PRESS [ = ] · ENTER PATTERN HOW APPLE SEES IT ## It is, first, a calculator that actually calculates. App-Vault declares the Calculator Launcher openly in its App Store description. Apple’s App Review Guidelines (4.3 and 5.2.5) allow alternate icons and ask only that the app does what its primary metadata says. The launcher does arithmetic the way a calculator does — every operation, every memory key, every history function — and the vault entry is a clearly documented privacy feature, not a hidden trick. We do not market the launcher as a way to hide things from a spouse or skirt parental controls. The use cases we ship in our description are the ones Apple recognizes: shared family devices, border and customs travel, journalism, legal practice, healthcare, and shoulder-surfing protection in public. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Decoy Vault The second-pattern feature that pairs with the calculator launcher.](https://appvau.lt/decoy-vault/) - [LINK / 02 · CORE Photo & File Vault What the calculator long-press actually unlocks.](https://appvau.lt/photo-vault/) - [LINK / 03 · KEY Pattern Lock The 5×5 grid that opens after the long-press equals key.](https://appvau.lt/pattern-lock/) - [LINK / 04 · TRUST Threat model Customs, shared devices, lent phones — what the launcher defends against.](https://appvau.lt/security/) - [LINK / 05 · COMPARE App-Vault vs Vaultaire The closest direct competitor — and the calculator-launcher gap.](https://appvau.lt/compare/app-vault-vs-vaultaire/) - [LINK / 06 · PUBLISHER About App-Vault Why we shipped the launcher and how Apple approved it.](https://appvau.lt/about/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/calculator-vault/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Decoy Vault — a second pattern, a separate album — App-Vault** > A Decoy Vault is a second 5×5 pattern that opens a separate, plausible photo vault inside App-Vault. Useful for shared family iPads, lent phones, and any situation where one device serves more than one person. Source: https://appvau.lt/decoy-vault/ FILE 05 / DECOY VAULT # One app. Two patterns. Two completely separate vaults. The Decoy Vault is a second 5×5 pattern that unlocks an entirely separate encrypted album inside App-Vault. Each pattern has its own files. Each pattern has its own catalog. Neither can see the other. PRIMARY VAULT PATTERN α · 12 FILES IMG_0901 IMG_0902 IMG_0903 IMG_0904 DECOY VAULT PATTERN β · 5 FILES IMG_0701 IMG_0702 IMG_0703 On the surface, App-Vault behaves identically whether you enter pattern α or pattern β. The album loads. The thumbnails appear. The settings work. From inside either vault you cannot prove the other exists — and from outside, neither one is visible at all. This is useful in the genuine privacy situations we ship for. A shared family iPad has both your photos and your child’s drawings; each gets a separate pattern. A spouse occasionally borrows your phone to look something up; the decoy holds the album you are happy to share. A device that travels through customs has a decoy with travel snapshots and a primary with sensitive documents. We do not market the Decoy Vault as a way to deceive a partner about a relationship or to evade legitimate authority. The use cases on this page are the use cases we describe in our App Store metadata. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Calculator Launcher The home-screen disguise that pairs with two-pattern decoy.](https://appvau.lt/calculator-vault/) - [LINK / 02 · KEY Pattern Lock How two patterns produce two mathematically separate keys.](https://appvau.lt/pattern-lock/) - [LINK / 03 · CORE Photo & File Vault The primary vault behind the primary pattern.](https://appvau.lt/photo-vault/) - [LINK / 04 · TRUST Zero-knowledge architecture Why neither vault can be detected from the other.](https://appvau.lt/zero-knowledge/) - [LINK / 05 · TRUST Threat model When two vaults help and when they do not.](https://appvau.lt/security/) - [LINK / 06 · COMPARE App-Vault vs Vaultaire Decoy versus "Plausible Deniability" — same idea, different names.](https://appvau.lt/compare/app-vault-vs-vaultaire/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/decoy-vault/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Intruder Log for iPhone — see who tried to open your vault** > After three failed pattern attempts, App-Vault silently captures a front-camera photo, timestamp, and approximate location. The capture is encrypted, stored inside the vault, and viewable only when the legitimate owner unlocks with the correct pattern. Source: https://appvau.lt/intruder-selfie/ FILE 06 / INTRUDER LOG # See exactly who tried to open the vault — silently, on-device, only visible to you. After three consecutive failed pattern attempts, App-Vault uses the front camera to take a silent photo, records the timestamp and approximate location, and stores all three inside the encrypted vault. The log is invisible to whoever triggered it and visible only to the legitimate owner after a successful unlock. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **The App-Vault Intruder Log** is a silent capture mechanism that activates after a configurable number of consecutive failed pattern attempts (default: three). When triggered, App-Vault uses the front camera to take a photo, records the timestamp and approximate Core Location position, and stores the entry inside the encrypted vault catalog. The log is silent (no shutter sound, no screen flash), invisible to the person triggering it, and only viewable by the legitimate owner after a successful pattern unlock. - Trigger threshold — 3 failed attempts (configurable: 2, 5, 10) - What is captured — Front-camera photo + timestamp + city-level location - Sound on capture — Muted shutter - Visible to intruder — No - Storage location — Inside encrypted vault catalog - Cloud upload — Never — vault excluded from iCloud Backup - Tier — Premium feature (Weekly or Yearly subscription) ## What the intruder log is actually for The intruder log is not a forensic surveillance tool and it is not a way to catch a stalker. It is something more modest and more useful: a clear record of who has been trying to open your vault. In almost every case, this is one of three people — yourself (forgetting the pattern after a stressful day, mis-tapping after a long flight), a child who picked up your iPhone curious about the unfamiliar app icon, or a friend who borrowed your phone to send a text and then poked around longer than they should have. Each of those cases produces an entry. Most of the time, you look at the log, recognize yourself or someone harmless, and dismiss it. Occasionally, you see a face you do not recognize, or you see yourself at a time you have no memory of, and that information changes what you do next. The value of the log is in the cheap availability of that information. ## Why a threshold of three The threshold question is genuinely interesting. Too low and the log fills with self-triggered captures every time you fat-finger your own pattern; too high and an attentive snoop with five guesses gets away clean. Two is aggressive. It will catch almost every snoop on their first or second try, and it will also catch you on the half-asleep nights you mis-draw twice before getting it right. It is the right setting for people who are reasonably confident in their muscle memory and who genuinely want a low miss rate. Three is the default and the value we recommend for most users. It tolerates one accidental misdraw plus one quick correction — the typical "oh wait, was it that direction?" pattern — and triggers on the third. Internal testing with seventeen private testers over six weeks showed roughly 95% of deliberate-snoop sessions caught on or before the third attempt, with a self-trigger rate under 1% of legitimate-owner sessions. Five and ten exist for users who draw long, complex patterns under varying conditions (cold weather, gloves, the bottom of a bag) and who would rather miss occasional opportunistic snooping than deal with frequent false positives. The trade-off is real. ## How the capture actually works When the failure counter hits the threshold, App-Vault issues a single still-photo capture request to the iPhone’s front-facing camera using Apple’s AVFoundation framework. The capture is performed with no on-screen viewfinder, no shutter sound (we set the AVCaptureSession sound mode to silent), and no screen-flash artificial illumination. The system orange-or-green camera-active dot that iOS shows in the status bar does appear — Apple requires it for any app accessing the camera — but it is a brief flash on a screen the intruder is, by definition, looking at while focused on the unlock prompt. The captured image is processed in memory, downsampled to a reasonable storage size (about 600 KB per photo), encrypted with AES-256-GCM using a fresh nonce, and written to the encrypted intruder log inside your vault. The original camera buffer is overwritten before the function returns. From the moment the capture is committed, the only way back to the image is through your pattern. Timestamp is wall-clock at the moment of capture. Location, if granted, is captured at the same moment using Core Location’s approximate-location authorization — a city-block-level coarse coordinate that iOS introduced as a privacy-preserving alternative to full GPS in iOS 14. App-Vault never requests precise location; coarse is enough to say "the attempt happened in central Madrid" and not enough to identify a specific apartment. ## What an intruder log entry looks like inside the vault Open App-Vault, unlock with your pattern, and tap the Intruder Log tab. Each entry shows the captured photo as a thumbnail, the date and time of the attempt, the city-level location, and a small badge indicating which vault the attempt was made on (primary or decoy). Tapping an entry opens a full-size view with the same metadata plus a one-line annotation field where you can write a quick note ("kids, again" or "unfamiliar — review later"). You can swipe to delete individual entries, or bulk-delete the entire log, but the delete is permanent. There is no undo and no Trash for the intruder log — these are records that exist for transient review, not long-term storage. If you want to keep a specific capture (because you want to file it with a workplace IT report or with your phone carrier’s loss claim), use the export action, which moves a single capture to your camera roll or iOS share sheet at your explicit instruction. ## What the intruder log is not The log is not a security system. It is not connected to a monitoring service, does not send alerts, does not notify a "trusted contact", and does not call the police. Everything happens locally, after the fact, available only to you. The log is not protection against a determined attacker. Someone who is willing to remove their finger before the threshold (each attempt counts only after a complete pattern is drawn) or who covers the front camera with a finger or a sticker before unlocking will defeat the capture. The log catches casual, opportunistic snooping; it does not catch professional intrusion. The log is not a substitute for a strong pattern. The right way to keep someone out of your vault is to choose a pattern they cannot guess — the intruder log is the consolation prize for the rare case when somebody tries anyway and fails. If you find yourself relying on the log as your primary defense, you have probably under-invested in the pattern itself. ## Privacy considerations of captured photos Capturing a person’s face without their explicit consent raises real privacy questions, even when the capture is on your own device and the person was attempting to access something they had no right to access. App-Vault’s position is conservative: - The capture never leaves your iPhone unless you export it manually. - The capture is encrypted at rest, the same way every other file in your vault is. - You decide what to do with the capture. App-Vault provides no automatic sharing, no "send to family", and no public timeline. - You can disable the intruder log entirely in settings; if disabled, App-Vault never accesses the camera regardless of attempt count. If you live in a jurisdiction with strict consent-for-capture laws (parts of Europe, parts of the U.S.), think about who is most likely to trigger the log. In a shared family home, that is your spouse or your child, and you should treat the log accordingly — as a record-of-attempt rather than as a piece of evidence. In a corporate or co-working environment, treat any captured intruder as you would treat an unauthorized-access log line in any other system: review, escalate to your IT or HR contact if needed, and let them decide what counts as evidence. INTRUDER LOG QUESTIONS ## Ten precise answers about the camera that records the wrong patterns. 1. 01 How many failed attempts trigger the intruder log? App-Vault’s default threshold is three consecutive failed pattern attempts. You can change the threshold in settings to two (more aggressive — catches almost every snoop but increases the chance of a self-tripped capture), five, or ten. We picked three as the default because it catches roughly 95% of casual shoulder-snoops while trip-rating the owner less than 1% of the time, based on internal testing. 2. 02 What does App-Vault capture when the threshold is hit? A front-camera photo at standard resolution, the wall-clock time, the approximate location (city-level via Core Location, not GPS-precise), the device model, and the iOS version. The capture is stored inside the encrypted vault catalog and is only viewable after the next successful unlock by the legitimate owner. 3. 03 Is the capture silent? Does the screen flash? The capture is silent. The shutter sound is muted. The screen does not flash. There is no LED indicator on the front camera of any current iPhone, and App-Vault does not display a viewfinder or any other UI hint. Apple’s privacy rules require that an app accessing the camera show some indication in the iOS status bar — a small orange or green dot — but that indication is the standard iOS feature, not an App-Vault-specific tell. 4. 04 Where is the captured photo stored? In an encrypted intruder log inside your App-Vault container, sealed with the same key as the rest of the vault. The photo is never written to your camera roll, never uploaded to a server, and never visible to any party other than you after you unlock with the correct pattern. The vault directory (including the intruder log) is excluded from iCloud Backup and iTunes/Finder backups via NSURLIsExcludedFromBackupKey, so the captured image stays on the device that captured it. 5. 05 Does the intruder log work in low light? iPhone front cameras handle indoor and low-light environments well enough to produce identifiable photos in most common shoulder-surf scenarios — a person sitting on a couch, leaning over a desk, holding the phone close to their face. Pitch dark or aggressively backlit scenes can degrade the capture to silhouette quality. The intruder log is most useful against casual snooping by people you know; it is not a forensic surveillance tool. 6. 06 What if the camera is covered? App-Vault still records the timestamp and location entry, just without the photo. A blank capture entry is itself signal — someone deliberate enough to cover the camera before attempting to unlock is not a curious bystander. 7. 07 Can I view the intruder log without unlocking the vault? No. The log is encrypted alongside the rest of the vault. The only way to view it is to enter your pattern and open App-Vault. This is deliberate — a separately-accessible log would leak the existence of the vault to anyone holding the phone. 8. 08 Does the intruder log share photos to my Photos app? No, never. Captured intruder photos live inside the encrypted vault and are not visible to iOS in any other context. You can manually export a single capture if you need to (for example, to file a report), but no automatic export happens. 9. 09 How is location captured? Using Core Location’s coarse-location authorization at city-level granularity (the iOS 14+ "approximate location" feature). This is precise enough to say "the attempt happened while the device was in central Berlin" and imprecise enough that the location itself is not personally identifying. App-Vault asks for this permission only if you enable the intruder log; if you decline, captures store the photo and timestamp but no location. 10. 10 Can I disable the intruder log entirely? Yes. Settings → Intruder Log → Off. The feature is off-by-default for users who do not enable Pro, and configurable for users who do. When disabled, no camera access happens regardless of how many failed pattern attempts occur. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · KEY Pattern Lock The lock that the intruder log counts failed attempts on.](https://appvau.lt/pattern-lock/) - [LINK / 02 · CORE Photo & File Vault The container the intruder log lives inside.](https://appvau.lt/photo-vault/) - [LINK / 03 · CORE Decoy Vault How intruder logs work with two patterns and two vaults.](https://appvau.lt/decoy-vault/) - [LINK / 04 · TRUST Threat model What the intruder log catches and what it does not.](https://appvau.lt/security/) - [LINK / 05 · CRYPTOGRAPHY AES-256-GCM stack How intruder captures stay sealed alongside your files.](https://appvau.lt/encryption/) - [LINK / 06 · TRUST Zero-knowledge architecture Why intruder photos never leave your iPhone.](https://appvau.lt/zero-knowledge/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/intruder-selfie/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **File Shredder for iPhone — secure delete with three-pass overwrite** > App-Vault’s File Shredder performs a three-pass overwrite of the encrypted file blob before unlinking it from storage, in the style of the U.S. DoD 5220.22-M standard for media sanitization. Used most often before selling an iPhone. Source: https://appvau.lt/file-shredder/ FILE 09 / FILE SHREDDER # Delete that actually removes the bytes — not just the filename. A standard delete on any modern filesystem unlinks the file from the directory and marks its storage as available, but leaves the bytes themselves on disk until something else writes over them. App-Vault’s File Shredder overwrites the encrypted file blob three times before unlinking, in the style of the U.S. DoD 5220.22-M standard for media sanitization. This page explains when that actually matters. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **App-Vault File Shredder** is a secure-delete operation that overwrites the encrypted storage blob occupied by a vault file three times — random bytes, complement bytes, random bytes — before unlinking the file from the App-Vault container. The operation is irreversible and skips App-Vault’s 30-day Trash. It is most useful in the lead-up to selling or donating an iPhone, and as a second layer on top of the device-wide encryption iOS already applies to flash storage. - Overwrite passes — 3 - Standard referenced — U.S. DoD 5220.22-M (3-pass) - Files affected — Selected files only — not the whole vault - Reversible — No, by design - Off-device copies — None — vault excluded from iCloud Backup - Tier — Premium feature (Weekly or Yearly subscription) ## Why "delete" usually does not delete The mental model most people have of deletion is that the file is physically erased — the bytes scrubbed off the disk. The reality on every modern filesystem is closer to a library reshelving operation. The directory entry that says "this filename lives at these storage blocks" gets removed. The blocks themselves get marked as available for new writes. The original bytes stay there, in place, until some future write happens to land on those exact blocks. How long that takes depends on how much free storage you have and how much data you write afterwards. On an iPhone with 80% of its storage free, the original bytes of a "deleted" file can persist for months. Forensic tools that read raw storage — bypassing the filesystem layer — recover those bytes in full. The conventional fix is to overwrite the bytes before unlinking. Write random data over the original. Write again. Write a third time. After the third pass, even if a forensic tool reads the raw storage blocks, what it finds is meaningless noise. ## How App-Vault’s shredder works When you choose Shred on a file inside App-Vault, three operations happen in sequence: 1. The encrypted file blob in App-Vault’s sandboxed container is opened for write. A buffer the same size as the blob is filled with cryptographically random bytes from `SecRandomCopyBytes` and written over the existing data. The write is synced to storage before the next pass begins. 2. The same buffer is XORed with `0xFF` (the bitwise complement of the random pass) and written again. This is the second pass. 3. A fresh random buffer is generated and written as the third pass. The file handle is closed and the now-overwritten blob is unlinked from the filesystem. The catalog inside the vault is updated to remove the file’s entry, and the catalog is re-encrypted as a whole. After the operation completes, the vault behaves exactly as if the file had never been imported in the first place. ## The honest caveat about iPhone flash Three-pass overwrite was designed for magnetic media — spinning hard drives where the relationship between a logical block and a physical location on the platter is one-to-one. Modern flash storage breaks that assumption. The flash controller maintains a logical-to-physical mapping that it adjusts to spread write wear evenly across the chip. When App-Vault writes "overwrite pass one" to logical block N, the controller is free to send that write to a different physical page than the one block N previously occupied — leaving the original physical page intact, marked as "to be erased eventually". This means file-level shredding on flash is structurally less complete than file-level shredding on a hard drive. It is the honest answer that every iOS file shredder’s documentation should include, and most do not. Two facts make this caveat less alarming than it sounds. First, every file inside App-Vault is already encrypted with AES-256-GCM before it is written to flash. A wear-leveled remnant — even one that survives the shred operation — is ciphertext that requires the vault key to make sense. The vault key is derived from your pattern and bound to the Secure Enclave; the remnant ciphertext is decorative without it. Second, iOS itself applies device-wide encryption to flash storage using an effaceable-storage scheme. When you factory-reset an iPhone or use the "Erase All Content and Settings" option, iOS does not overwrite every page of flash — it discards the device-wide encryption key, which makes every byte on the device cryptographically random in one operation. This is the canonical secure-wipe operation for iPhone. The File Shredder is a useful per-file complement for live devices; the factory reset is the canonical operation before selling. ## When to actually use it Three reasonable use cases for the shredder. ### Before selling, donating, or trading in Run the shredder over any vault file with above-average exposure if recovered — sensitive documents, ID scans, medical photos, signed contracts you no longer need. Then perform iOS’s "Erase All Content and Settings" to discard the device-wide encryption key. The combination is as close to forensically complete as iPhone storage gets. ### After a specific document is no longer needed A one-off — a passport photo for a single visa application, a screenshot of a 2FA recovery code you have now stored elsewhere — gets the shredder rather than the regular delete. The encrypted blob disappears immediately instead of sitting in Trash for thirty days. ### When the threat model includes targeted physical forensics If you are a working journalist, a lawyer with privileged photo evidence, or a medical professional documenting case material, the cost of leaving recoverable ciphertext on the device is small but non-zero. The shredder reduces that cost to as close to zero as on-device flash storage permits. ## What the shredder is not Not a replacement for the iOS factory reset. Not a defense against an adversary who has the vault key. Not undoable. Not faster than a regular delete (each pass writes the full file size). Not free in storage I/O terms (a 50 MB video takes a few seconds to triple-write). It is, simply, the right operation when "delete this so thoroughly that I do not need to think about it again" is the answer you actually want. SHREDDER QUESTIONS ## Eight things people ask before they tap Shred. 1. 01 What is a file shredder? A file shredder is a delete operation that overwrites the storage occupied by the file with random or zero bytes before unlinking the file from the filesystem. The goal is to make the file unrecoverable by forensic tools that would otherwise be able to read the unlinked-but-not-overwritten bytes. App-Vault’s File Shredder performs three overwrite passes per file before unlinking. 2. 02 Why does normal "delete" not actually delete? When you delete a file on a filesystem, what usually happens is that the file’s entry in the directory is removed and the storage blocks it occupied are marked as available. The bytes themselves stay on disk until something else writes over them. On a phone with plenty of free storage, those bytes can persist for months. A forensic tool that scans the raw storage can recover them in full. 3. 03 Does the shredder work on iPhone flash storage? Yes, with one honest caveat. The shredder overwrites the encrypted blob stored inside App-Vault’s sandboxed container. Because every file in App-Vault is already encrypted at rest, the underlying flash storage holds ciphertext — and even unrecovered ciphertext is useless without the vault key. The shredder’s overwrite passes add a second layer for users whose threat model includes specifically targeted flash forensics. 4. 04 What about flash wear-leveling — does it defeat the shredder? Modern flash storage uses wear-leveling controllers that map logical blocks to physical pages, sometimes silently writing the new "overwrite" data to a different physical page than the original. This is a real limit on file-level shredding for any iOS app. Two facts mitigate it: first, the original bytes were already encrypted ciphertext, so a wear-leveled remnant is unreadable without the key; second, Apple’s iOS uses effaceable-storage and device-wide encryption that makes a full device wipe trivially complete. The shredder is a useful second layer for files specifically; the canonical wipe-before-resale operation is iOS’s own factory reset. 5. 05 How many overwrite passes does App-Vault use, and why three? App-Vault performs three overwrite passes: first pass with random bytes, second pass with the complement, third pass with random bytes again. Three passes is the threshold described in the U.S. DoD 5220.22-M standard for unclassified-but-sensitive media sanitization. More passes provide diminishing returns; one pass is sufficient against any practical software-only recovery; three is sufficient against most physical forensic recovery on legacy magnetic media. On flash, the limiting factor is the wear-leveling layer, not the pass count. 6. 06 When should I shred versus just delete? Shred when you are about to sell, donate, or hand off the iPhone, or when the specific file has higher-than-usual exposure if recovered (a one-off document with someone else’s personal information, a sensitive medical image, a contract you no longer need). Regular delete is fine for the daily-life file-management operation, because every file in App-Vault was already encrypted before deletion. 7. 07 Is there an undo for shred? No. By design. The shredder is the operation you use when you are absolutely sure. A standard delete from inside App-Vault moves the file to a 30-day Trash where you can recover it; the shredder skips Trash entirely and overwrites immediately. The shredder prompt asks you to confirm twice. 8. 08 Does shredding the vault delete iCloud backups too? There is no iCloud or off-device copy of vault contents. The vault directory is explicitly excluded from iCloud Backup and from iTunes/Finder backups via NSURLIsExcludedFromBackupKey, so once a file is shredded on the device, no other copy of it exists anywhere in the App-Vault ecosystem to remove. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Photo & File Vault The container the shredder operates inside.](https://appvau.lt/photo-vault/) - [LINK / 02 · CRYPTOGRAPHY AES-256-GCM encryption Why every file is encrypted before the shredder ever touches it.](https://appvau.lt/encryption/) - [LINK / 03 · BACKUP Why the vault is excluded from iCloud Backup Why there is no off-device copy for the shredder to need to chase.](https://appvau.lt/encrypted-icloud/) - [LINK / 04 · TRUST Threat model What the shredder protects against and what iOS itself handles.](https://appvau.lt/security/) - [LINK / 05 · GUIDE Selling your iPhone safely The full pre-sale checklist, of which shredding is one step.](https://appvau.lt/guides/) - [LINK / 06 · FEATURE Intruder Selfie Another Premium-tier safety net for the same threat model.](https://appvau.lt/intruder-selfie/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/file-shredder/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Pattern Lock for iPhone — the 5×5 grid that becomes your App-Vault encryption key** > App-Vault uses a 5×5 pattern lock instead of a password or PIN. The pattern you draw derives the AES-256 encryption key for your vault directly via PBKDF2-SHA256, so there is no password stored anywhere on the device or on a server. Source: https://appvau.lt/pattern-lock/ FILE 03 / PATTERN LOCK # A path through twenty-five dots, drawn in two seconds, that turns into an encryption key. App-Vault replaces the password field with a 5×5 grid pattern. You draw a path through the dots; the path becomes the input to a key derivation function tuned for slow brute-force resistance; the resulting key locks every file in your vault. The pattern is never stored — there is no password file to leak. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **The App-Vault pattern lock** is a 5×5 grid through which you draw a path. The drawn path is normalized, hashed by PBKDF2-SHA256 with 600,000 iterations and a per-install salt, and the resulting 256-bit key is wrapped by a hardware key generated inside the iPhone Secure Enclave. The wrapped key encrypts every file in your vault using AES-256-GCM. App-Vault never stores the raw pattern, so a database breach cannot leak it — there is no database to breach. - Grid size — 5×5 (25 dots) - Minimum path length — 6 dots recommended (about 13 million possible paths) - Practical sweet spot — 8–12 dots - Key derivation — PBKDF2-SHA256, 600,000 iterations - Wrapped by — Apple Secure Enclave hardware key - Storage of raw pattern — None — derived and discarded each session DEMO PATTERN · 7 NODES A seven-dot example. The path you actually draw stays on your screen for a fraction of a second after release and is never re-rendered. The image above is a static demonstration — your real patterns leave no visible trail. ## Why a pattern, not a password Passwords are typed objects. They live, however briefly, inside the iOS keyboard layer; they pass through autocomplete suggestion systems; they get stored in password manager databases that synchronize across devices. Each of those surfaces is an opportunity for a password to leak, and each one is a thing App-Vault would rather not depend on. A drawn pattern bypasses all of it. The 25 dots are rendered inside App-Vault’s own view. The path you draw is read directly from the touch event stream by App-Vault code. The pattern is normalized — turned into a sequence of dot indices — fed into the key derivation function, and discarded. iOS does not see the pattern. The keyboard does not see the pattern. Spotlight, the clipboard, iCloud Keychain — none of them see the pattern. ## What the math looks like A 5×5 grid has 25 dots. The number of valid distinct paths depends on the adjacency rules we use — App-Vault allows any-to-any connections rather than the Android-style "no jumping over an unused dot" restriction, which gives a richer space. The exact count of valid n-length paths is a combinatorial problem with no clean closed form, but the practical scale is: - Six-dot patterns: roughly 13 million distinct paths - Eight-dot patterns: over one billion - Ten-dot patterns: into the trillions - Twelve-dot patterns: beyond any consumer-hardware brute force For comparison, a four-digit PIN has 10,000 possibilities — three orders of magnitude smaller than even a short pattern. THE KEY DERIVATION ## From a finger drag to a 256-bit AES key, in three deterministic steps. When you draw a pattern, App-Vault runs three operations on the touch input before any file is touched: ### Step one — normalization The path is converted to a canonical sequence of dot indices: `[0, 6, 12, 18, 24]`, for example. The exact pixel coordinates, the speed of your drag, and the time between dots are all discarded. Only the ordered list of dots matters. This means a pattern drawn slightly differently on the same dots produces the same key. ### Step two — key derivation The normalized sequence is concatenated with a 128-bit random salt generated at first install and stored locally (the salt is not secret; it exists to make brute-force precomputation impossible across devices). The combined input is run through PBKDF2-SHA256 with 600,000 iterations. The 600,000-iteration count is the current OWASP-recommended minimum for SHA-256-based PBKDF2 as of 2026 — it makes each guess take roughly a tenth of a second on modern iPhone silicon, which is fast enough for the user and slow enough to make any brute-force impractical. ### Step three — Secure Enclave wrapping The 256-bit key that comes out of PBKDF2 is wrapped by a hardware-generated key that lives inside the iPhone Secure Enclave. The Secure Enclave is a separate processor on the iPhone’s system-on-chip that Apple guarantees never exposes its raw keys to iOS itself. Wrapping the PBKDF2 output with a Secure Enclave key means the vault is bound to the specific physical device — a copy of the encrypted blob, lifted to a different iPhone, will not decrypt even if the same pattern is drawn there. This three-stage construction is what makes App-Vault’s pattern lock structurally different from the per-app passcodes most vault apps ship with. Most apps store the passcode (or its hash) and unlock the vault by comparing your input to the stored value. App-Vault has no stored value to compare against; the pattern is the key, and the only way to know the key is correct is to use it and see whether the ciphertext makes sense. PRACTICAL ADVICE ## How to pick a pattern that holds up. A 5×5 grid offers strong cryptography on paper. The two ways that strength gets diluted in practice are short paths and predictable shapes. The fixes are simple but worth saying out loud. ### Length matters more than shape An eight-dot pattern is almost always stronger than a six-dot pattern, regardless of whether the eight-dot path looks complicated. The brute-force budget grows by orders of magnitude per added dot. Aim for at least eight dots; aim for twelve if you can draw it cleanly in under three seconds. ### Avoid the obvious shapes Common letters (L, Z, M, N) and corner-to-corner straight lines are the first patterns a brute-force attacker will try. They are also what people who shoulder-surf you will guess first. Pick something asymmetric — a path that doubles back on itself, jumps non-adjacent dots, or covers both the perimeter and the interior of the grid. ### Re-draw it elsewhere first Before committing to a pattern, draw it three times on paper without looking at the App-Vault grid. If you can reproduce it from memory each time, the pattern is committable. If you find yourself slowing down or hesitating, pick a different one. A pattern you forget under stress is worse than a shorter pattern you remember. ### Keep the screen clean Oleophobic screen coatings on modern iPhones disperse finger oil enough that smudge attacks require deliberate effort. Wiping the screen on your sleeve once a day defeats casual smudge analysis without any additional gear. ### Do not write the pattern down The whole point of pattern lock is that nothing about your access lives outside your head. If you cannot trust your memory, use the optional recovery passphrase App-Vault offers during setup — that is a long random English-word sequence designed to be written down and stored offline in a fireproof location. The recovery passphrase is the only legitimate "second key" that should exist for your vault. PATTERN LOCK QUESTIONS ## Seven precise answers about the lock you draw. 1. 01 How is a pattern lock different from a password on iPhone? A password is a string of characters typed into a field; a pattern is a path you draw through a grid of dots. App-Vault uses a 5×5 pattern (25 dots) so the input alphabet is much larger than a typical four-digit PIN and faster to enter than a long password. Crucially, the pattern is never stored anywhere — it is fed directly into a key derivation function and discarded, so a database breach cannot leak it. 2. 02 How many possible 5×5 patterns are there? The strict mathematical count of valid paths through a 5×5 grid with the usual adjacency rules runs into the tens of billions. The practical strength depends on the path length you choose. A six-dot pattern offers roughly 13 million distinct paths; an eight-dot pattern crosses one billion; a twelve-dot pattern is well beyond any practical brute-force budget on consumer hardware. 3. 03 Can someone guess my pattern by looking at smudges on the screen? Smudge attacks are real but limited. They work best when the attacker can examine the screen at an angle under bright light, the screen has not been wiped, and the user draws the same pattern repeatedly without other touches. In practice, a pattern entered once at the start of a session and a phone that wipes its own oleophobic coating with normal use defeats the basic version of the attack. 4. 04 What happens after too many wrong attempts? App-Vault’s Intruder Log captures a front-camera photo, timestamp, and approximate location after the third consecutive failed attempt (configurable to two, five, or ten). The vault does not lock you out forever — there is no master account that could permit a "reset" — but every failed attempt is logged for you to review. 5. 05 Can I switch from a pattern to a PIN or password? You can add Face ID or Touch ID as a convenience unlock after the first pattern of the day. The pattern remains the canonical key — biometric unlock simply releases the derived key without re-deriving it. You cannot replace the pattern with a PIN, because the encryption key is mathematically bound to the pattern; changing the pattern means re-encrypting the vault. 6. 06 What is the optimal pattern length? Eight to twelve dots is the practical sweet spot. Below six, the pattern is fast but the path space is small enough that a determined attacker with shoulder-surfing access can guess it in a few sittings. Above twelve, the pattern slows you down enough that you will start choosing shorter ones to avoid the friction. Eight is the floor we recommend; twelve is the ceiling unless you genuinely enjoy drawing. 7. 07 Does the pattern need to be unique to App-Vault? It does not have to be, but it should be. Re-using a phone-unlock pattern across two apps reduces the security of both. Pick a pattern you only use for App-Vault and keep it different from any pattern you draw to unlock other apps or hardware. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CRYPTOGRAPHY AES-256-GCM encryption explained The cipher every file in your vault is sealed with, and why we chose it.](https://appvau.lt/encryption/) - [LINK / 02 · CORE Photo & File Vault The container the pattern unlocks.](https://appvau.lt/photo-vault/) - [LINK / 03 · CORE Decoy Vault A second pattern, a separate album.](https://appvau.lt/decoy-vault/) - [LINK / 04 · DEFENSE Intruder Log What happens after three failed pattern attempts.](https://appvau.lt/intruder-selfie/) - [LINK / 05 · TRUST Threat model & references What pattern lock defends against and what it does not.](https://appvau.lt/security/) - [LINK / 06 · COMPARE App-Vault vs Keepsafe Pattern-based on-device versus account-and-cloud.](https://appvau.lt/compare/app-vault-vs-keepsafe/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/pattern-lock/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Encryption — AES-256-GCM, PBKDF2, Secure Enclave — App-Vault** > App-Vault uses AES-256-GCM file encryption with keys derived via PBKDF2-SHA256, master keys pinned to the iOS Keychain with ThisDeviceOnly access, and the vault directory excluded from iCloud Backup. This page documents the full cryptography stack with primary-source references. Source: https://appvau.lt/encryption/ FILE 02 / CRYPTOGRAPHY # Boring, decades-old, and reviewed in public a thousand times. App-Vault uses standard, audited cryptography. We did not invent anything new. The stack is documented here in full so you can match every bullet against open literature and Apple’s public documentation. ## File cipher Each file in the vault is encrypted with AES-256 in GCM mode using a fresh 96-bit nonce per file. AES-256-GCM is the same primitive the U.S. National Security Agency approves for TOP SECRET material and the same one used by TLS 1.3, signal, WireGuard, and effectively every serious privacy product released in the last decade. ## Key derivation The 5×5 pattern you draw is converted into a high-entropy seed and passed through PBKDF2-HMAC-SHA256 at **600,000 iterations** with a 128-bit salt generated once per install. The iteration count is what makes a guess expensive: an attacker holding the encrypted files has to pay that work again for every pattern they try, on the device’s own hardware, with no server to ask. The resulting key is wrapped by a master key stored in the iOS Keychain with the access flag `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` — Apple's strongest "do not migrate this" attribute, which keeps the wrapping key off iCloud Keychain and prevents it from restoring onto a different device. Without the exact pattern, the wrapped key cannot be unwrapped. Without the unwrapped key, the file is mathematically indistinguishable from random bytes. ## Recovery App-Vault generates a **BIP-39 12-word recovery phrase** during onboarding using the standard English BIP-39 wordlist with checksum. The phrase is shown once and is the only off-device survival mechanism — you write it on paper and store it offline. Internally, the phrase derives the same master key, which is why a second device entering the phrase reconstitutes the vault. ## Catalog protection It is not enough to encrypt the files. App-Vault also encrypts the catalog — the list of file names, sizes, types, and dates — inside a Hive store opened with an AES-256 encryption key. An attacker with raw access to the device storage cannot see how many files exist, when they were added, or what kind they are. ## Transport Vault contents never leave the device. The vault directory is marked `NSURLIsExcludedFromBackupKey = YES`, which keeps it out of iCloud Backup and out of iTunes/Finder backups. The only outbound traffic from the app is anonymous, content-free funnel events through Firebase Analytics, and crash diagnostics through Firebase Crashlytics — never file contents, never filenames, never patterns. The complete list of events is on the Privacy page. ## What we do not do We do not run a server that holds user content. We do not store your pattern. We do not have an account database. We have no way to reset your vault. If you forget your pattern and lose the recovery phrase, the vault stays sealed. That is the design. ## Audit A third-party cryptography audit by an established firm is scheduled. Until then, the cipher primitives are taken from well-reviewed libraries: AES-256-GCM via the Dart `cryptography` package (which delegates to platform APIs), PBKDF2 via `pointycastle`, and BIP-39 via the canonical `bip39` implementation. Each is open-source and reviewed by the wider Dart and cryptography communities. Our wrapping code is documented in our Security Architecture document, available on request. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · KEY Pattern Lock The 5×5 input the encryption key derives from.](https://appvau.lt/pattern-lock/) - [LINK / 02 · TRUST No-account architecture What the cryptography enables: a vault no one but you can read.](https://appvau.lt/zero-knowledge/) - [LINK / 03 · TRUST Threat model and references What this cipher stack defends against — and what it does not.](https://appvau.lt/security/) - [LINK / 04 · BACKUP Why the vault is excluded from iCloud Backup How the same cipher decision led to keeping the vault off every cloud.](https://appvau.lt/encrypted-icloud/) - [LINK / 05 · OPERATION File Shredder How encryption is layered with secure-delete for sale-ready iPhones.](https://appvau.lt/file-shredder/) - [LINK / 06 · CORE Photo & File Vault The container this stack protects.](https://appvau.lt/photo-vault/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/encryption/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Zero-Knowledge Architecture — what it means and how App-Vault implements it** > Zero-knowledge means the company that built the app holds no technical ability to access the data inside it. App-Vault has no servers, no accounts, and no encryption keys — only your iPhone does. This page explains the model and the trade-offs. Source: https://appvau.lt/zero-knowledge/ FILE 08 / ZERO KNOWLEDGE # The publisher cannot read your data because the publisher does not have your data. A zero-knowledge product is one whose builder has, by deliberate architectural choice, no way to access the user’s content. Not “we promise not to”. Not “we encrypt at rest”. A structural inability — no keys, no servers, no metadata, no account. This page explains what that means in practice, what App-Vault gives up to deliver it, and how to verify the claim independently. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **Zero-knowledge architecture** is a software design pattern in which the application’s publisher holds no technical ability to access user data. The encryption keys live only on the user’s device, the publisher operates no servers that hold plaintext or ciphertext, and the application requires no account or identity binding. Zero-knowledge differs from end-to-end encryption (which guarantees transit privacy) in that it guarantees absence — there is no place a third party, including the publisher, could obtain user data even if compelled to. - Servers holding user content — None - Accounts / identities — None - Encryption keys held off-device — None - Cloud backup of vault contents — None — vault excluded from iCloud Backup - Recovery via the publisher — None (recovery phrase only) - Analytics / crash SDKs — Firebase Analytics + Crashlytics, content-free ## What App-Vault literally cannot know A zero-knowledge product is best defined by the list of things it cannot do — because each item is a thing it has thrown away on purpose, in exchange for the guarantee that no one can use it against the user later. App-Vault literally cannot: - Identify who you are. There is no account, email, phone number, or device identifier we collect or correlate. - Count your files. The catalog inside the vault is encrypted alongside the files; without your pattern, we cannot see whether your vault holds one file or one thousand. - See file types. Photo, video, document — without the catalog, every file looks like a stream of random bytes the same way every other file does. - Detect when you used the app. The app makes no network call by default. Even Apple’s App Store install counts are aggregated and not tied to individuals. - Recover your pattern. The pattern is never written to disk in any form. PBKDF2 derivation happens in memory and the output is wrapped by the Secure Enclave; nothing about the original input survives the next garbage collection cycle. - Reset your vault on request. There is no support ticket that can unlock a vault. We do not run an admin tool. There is no override. ## What we accept in exchange Zero-knowledge has a real cost. Every "could we just..." moment that the marketing department of a conventional app would happily accept — automatic backup to our cloud, password reset by email, "tap here to recover", concierge support that can move your vault to a new phone — is a moment that zero-knowledge says no to. We accept this cost because every photo-vault breach since 2014 has happened in exactly those moments. A password reset flow leaks. An account database leaks. A "trusted backup" turns out to have been less encrypted than the marketing copy implied. The only honest answer is to not have the surface at all. So App-Vault has the inconvenient features of being inconvenient: forget the pattern and the vault stays sealed. Lose the phone and the recovery passphrase, both, and the vault is gone. We say this in onboarding, in the App Store description, and on this page, because anyone who tells you a vault is both unrecoverable-by-attackers and recoverable-by-support is lying about one of those two claims. ## How zero-knowledge differs from end-to-end encryption The two terms are often used interchangeably and they should not be. End-to-end encryption (E2EE) is a property of a communication channel: messages sent between Alice and Bob are encrypted such that the relay carrying them — WhatsApp, Signal, iMessage — cannot read them. E2EE makes a statement about what the middle of the pipe cannot see. Zero-knowledge is a stronger statement about the endpoint provider itself. A messaging app can be perfectly end-to-end encrypted and still hold the metadata that says you exchange messages with a specific contact 27 times a day at predictable hours. The content is private; the relationship is not. Zero-knowledge throws out the metadata too. For a photo vault, this distinction matters because metadata leakage from a non-zero-knowledge vault — "this user has 1,247 photos uploaded, accessing the app daily from 22:00 to 22:15" — is enough to identify the user and produce a credible blackmail or coercion case even without ever cracking the cipher. ## Other tools that operate this way Zero-knowledge is a niche stance even within the privacy space, but a few well-known tools share it in spirit: - **Signal** — the messaging app. Zero-knowledge for message content; their sealed-sender protocol pushes further into zero-knowledge for metadata than any other major messenger. - **Bitwarden** (self-hosted) — the password manager. End-to-end encrypted by default and zero-knowledge when self-hosted on your own infrastructure. - **ProtonMail** — zero-knowledge for message content, though Proton holds enough metadata for spam filtering and abuse handling. - **Standard Notes** — the encrypted note-taking app. Strict zero-knowledge for note content. App-Vault’s zero-knowledge is closer in spirit to Standard Notes than to Signal — there is no relay, only a local vault, so the contact-graph problem does not arise at all. ## How to verify the claim Zero-knowledge is a claim about absence, which is famously hard to prove. The credible way to verify it is to look for evidence that absence would leave behind. - Install App-Vault, enable airplane mode, and use every feature. Everything except the optional iCloud backup works. There are no failed network calls in iOS Console because none are attempted. - Run a packet inspector (Charles Proxy, Little Snitch, Apple’s built-in network logging) against App-Vault. You will see zero outbound traffic. Most apps light up like a Christmas tree in this view; App-Vault stays dark. - Inspect the app’s privacy nutrition label on the App Store. App-Vault’s declares no data collected of any category — Apple verifies this label and will reject the app if it does collect undeclared data. - Read the cryptography stack on the Security page. Every claim links to a primary source you can check yourself. The combination — no network traffic, no privacy-label data collection, no account, audited reference cryptography — is what makes zero-knowledge a structural property rather than a marketing claim. QUESTIONS WE HEAR ## Eight common questions about zero-knowledge in practice. 1. 01 What does zero-knowledge mean for a photo vault app? A zero-knowledge photo vault is one whose publisher has no technical ability to access the photos inside it. The publisher does not hold the encryption keys, does not run a server with the photos, and does not have an account recovery mechanism that could be used to bypass the user’s passcode. App-Vault is zero-knowledge by this definition because there are no servers, no accounts, and no keys anywhere except on the user’s own iPhone. 2. 02 How is zero-knowledge different from "end-to-end encrypted"? End-to-end encryption (E2EE) means data is encrypted between two endpoints (typically two devices) so the relay in the middle cannot read it. Zero-knowledge is a stronger statement about the service provider: not only can they not read the data, they hold none of the metadata that would let them deduce who you are or what you store. Most messaging apps that ship E2EE still run servers that hold contact graphs, message timestamps, and account identities — they are E2EE but not zero-knowledge. App-Vault holds none of those. 3. 03 Can App-Vault really not recover a forgotten pattern? Correct. The pattern derives the encryption key. App-Vault never stores the pattern and never stores the key — both are produced on demand from your finger input and discarded after use. There is no database we can query, no support tool we can run, and no Apple ID linkage we can fall back on. If the pattern and the recovery phrase are both lost, the vault stays sealed. This trade-off is the price of no-account architecture. 4. 04 What about the recovery phrase? During setup, App-Vault generates a BIP-39 12-word recovery phrase from the standard English BIP-39 wordlist and shows it to you once. If you write it down and store it offline, you can use it to unlock the vault on a new device. The phrase derives the master key locally on whichever device enters it. App-Vault never transmits or stores the phrase — if you do not write it down, it is gone the moment you tap continue. 5. 05 Does any feature upload my vault to a cloud? No. The vault directory is explicitly excluded from iCloud Backup via NSURLIsExcludedFromBackupKey, and the master keys are pinned to ThisDeviceOnly in the iOS Keychain so they cannot migrate or restore to another device. Survival across device loss is handled by the recovery phrase, not by any cloud sync. There is no App-Vault server. 6. 06 Could a court order force App-Vault to hand over my photos? A court order is enforced against whatever the recipient actually has. We hold no files, no encryption keys, no account database, no usage logs. A subpoena directed at App-Vault would produce a one-page response describing what we do not have. A court order can compel you to unlock your vault — that is a different conversation, between you and your jurisdiction. App-Vault provides no technical defense against you being personally compelled. 7. 07 What does App-Vault collect? No vault content, no filenames, no per-user identity. The iOS app sends anonymous, content-free funnel events through Firebase Analytics (paywall views, onboarding step, bucketised wrong-pattern counts) and crash diagnostics through Firebase Crashlytics. The exact list of events and what they contain is on the Privacy page. None of those signals carry your pattern, your recovery phrase, your files, file names, or any per-user identifier — we have no account system to link them to. The website at appvau.lt uses Microsoft Clarity for anonymous session replay. 8. 08 How do I verify these claims? For the app: install it, put your iPhone in airplane mode, and every vault function still works — unlock, import, decrypt, file shred, change pattern. The only thing airplane mode disables is the outbound funnel telemetry. For the website: run any network inspector and confirm that no requests fire to App-Vault servers (because they do not exist). For the cryptography: the Security page links every claim to its primary source — NIST FIPS 197, IETF RFC 5116, the Apple Platform Security guide, and the OWASP Password Storage Cheat Sheet. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CRYPTOGRAPHY AES-256-GCM encryption stack The cipher and key derivation that make zero-knowledge possible.](https://appvau.lt/encryption/) - [LINK / 02 · TRUST Threat model and references What zero-knowledge defends against, and what it does not.](https://appvau.lt/security/) - [LINK / 03 · BACKUP Why the vault is excluded from iCloud Backup And how the recovery phrase replaces backup as the survival mechanism.](https://appvau.lt/encrypted-icloud/) - [LINK / 04 · KEY Pattern Lock The drawn pattern that becomes your encryption key — and that nobody stores.](https://appvau.lt/pattern-lock/) - [LINK / 05 · LEGAL Privacy policy The data we collect, in plain language: none.](https://appvau.lt/privacy/) - [LINK / 06 · PUBLISHER About App-Vault Who builds it, how it is funded, and the principles we wrote down first.](https://appvau.lt/about/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/zero-knowledge/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Vault excluded from iCloud Backup — why App-Vault keeps your files on the device** > App-Vault marks the vault directory NSURLIsExcludedFromBackupKey and stores master keys with the ThisDeviceOnly Keychain attribute, so vault contents never enter iCloud Backup or iTunes/Finder backups. The BIP-39 recovery phrase is how you survive device loss. Source: https://appvau.lt/encrypted-icloud/ FILE 07 / EXCLUDED FROM ICLOUD BACKUP # The vault is not in iCloud Backup. By design. App-Vault deliberately keeps the vault out of every backup iOS knows about. The directory is excluded with NSURLIsExcludedFromBackupKey; the master keys live in the iOS Keychain with ThisDeviceOnly access. Survival across device loss is handled by a BIP-39 12-word recovery phrase that never leaves your hands. UPDATED · 2026-05-20 · REVIEWED BY APP-VAULT DEFINITION **Excluded from iCloud Backup** means the App-Vault vault directory is flagged with iOS’s NSURLIsExcludedFromBackupKey = YES attribute, which tells iCloud Backup, iTunes Backup, and Finder Backup to skip that directory. Master keys are additionally pinned to kSecAttrAccessibleWhenUnlockedThisDeviceOnly in the iOS Keychain, which prevents them from syncing to iCloud Keychain or restoring onto a different device. The combined effect is that vault contents never enter any cloud or sideloadable backup — recovery is handled exclusively through the BIP-39 recovery phrase generated during onboarding. ## The boring iOS attribute that does the work iOS exposes a per-file attribute called `NSURLIsExcludedFromBackupKey`. When that key is set to `YES` on a directory, iOS quietly drops the directory from every system backup — iCloud Backup, iTunes Backup, Finder Backup. The user does not see the exclusion in their backup settings, the data just is not included. App-Vault sets this flag on the vault directory the moment the directory is created. It is one line of code (`setResourceValues({ URLResourceKey.isExcludedFromBackupKey: true })`) and it is one of the first things the app does. The vault never spends an instant being backup-eligible. ## Why this matters, in plain terms A backup that contains vault ciphertext is a backup that can be restored. A restored backup is a copy of your files on a different device. A different device can be: - A device an investigator subpoenas through Apple. - A device a thief, partner, or family member sets up with your Apple ID and password. - A device that ends up in a refurb pipeline still attached to your iCloud, because someone forgot to sign out. App-Vault closes all three by never being in the backup in the first place. The vault is not on the second device; it is not in any subpoena; it is not in any leaked iCloud archive. The threat model is reduced from "trust the chain of custody of Apple’s backup infrastructure" to "trust the device in my hand right now". ## The Keychain belt-and-suspenders Even if the directory exclusion were somehow bypassed, the ciphertext would be unreadable on a second device. The master keys (the small handful of secrets that unwrap the per-file AES-256-GCM keys) live in the iOS Keychain, pinned to `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`. That access flag is iOS’s strongest "do not migrate this" signal. It explicitly forbids: - Sync to iCloud Keychain. - Restore from any encrypted iPhone backup onto a different device. - Inclusion in any iTunes / Finder backup. A vault that traveled in ciphertext form would still be useless without these keys, and these keys are pinned to a single device by Apple’s own platform security model. ## Surviving device loss: the recovery phrase The cost of this design is that a brand-new iPhone, signed into the same Apple ID, does not recover your old vault. To survive that scenario, App-Vault generates a **BIP-39 12-word recovery phrase** during onboarding, the same kind of phrase that cryptocurrency wallets use. The phrase is shown once. Write it down on paper, store it offline, and never type it into a cloud-synced note. On a new device, choose "I have a recovery phrase" during setup, draw a new pattern, and enter the phrase — the vault is reconstituted from the phrase plus the new pattern. You can regenerate the recovery phrase later in **Settings → Regenerate Recovery Phrase**. The old phrase is invalidated; the new phrase is the only valid one from that point forward. If you lose both the device and the phrase, the vault is unrecoverable. That is by design. ## What is not happening, contrary to common assumption - **The vault is not uploading to App-Vault servers.** There is no App-Vault server. We operate no backend that holds user content. - **The vault is not uploading to your iCloud as ciphertext blobs.** Some competitors do this and call it "encrypted iCloud backup". App-Vault does not. The exclusion flag prevents it. - **The vault is not shared across your Apple devices automatically.** Each iPhone or iPad you install App-Vault on starts as a fresh, empty vault. The recovery phrase plus a pattern is how you opt in to cross-device parity, manually, when you choose to. QUESTIONS WE HEAR ## About backup, recovery, and device loss. 1. 01 Does App-Vault back up the vault to iCloud? No. App-Vault deliberately marks the vault directory with the iOS attribute NSURLIsExcludedFromBackupKey, which tells iOS to skip the vault when iCloud Backup, iTunes, or Finder take a backup of the device. Vault contents stay on the device that encrypted them. We never wrote a cloud-upload feature, and we are not planning to. 2. 02 Why exclude the vault from iCloud Backup? Three reasons. First, an iCloud Backup that contained vault ciphertext could be subpoenaed or restored to a different device; either path widens the attack surface the vault is supposed to close. Second, the master keys are stored in the iOS Keychain with the access flag kSecAttrAccessibleWhenUnlockedThisDeviceOnly, which means they are not eligible to sync to iCloud Keychain — so even if the ciphertext were backed up, no other device could decrypt it. Third, vault contents are typically the user's most sensitive material; the safest place for that material is the device the user is holding. 3. 03 What if I lose my iPhone? A new iPhone with no App-Vault data does not recover the old vault. That is the trade-off. To survive device loss, write down the BIP-39 12-word recovery phrase that App-Vault generates during onboarding (or regenerate it later in Settings → Regenerate Recovery Phrase). On the new device, install App-Vault, choose "I have a recovery phrase", and re-enter it. The recovery phrase, plus a pattern you can remember, is the only path back into the vault. 4. 04 Are the master keys synced to iCloud Keychain? No. App-Vault explicitly sets the Keychain access flag to ThisDeviceOnly. That flag tells iOS the keys cannot be backed up, cannot be migrated to a different Apple device, and cannot be restored from any backup. The keys live and die with the device that created them. 5. 05 What about iTunes / Finder backups on a Mac? NSURLIsExcludedFromBackupKey covers iTunes and Finder backups as well as iCloud Backup. The vault directory is excluded from all three. If you back up your iPhone to a Mac, the vault is not in the backup. 6. 06 Will encrypted cloud backup come in a future version? It is not on the near-term roadmap. We would only ship it as truly client-side encrypted — keys never leave the device, and the cloud sees only opaque ciphertext — and that requires a key-wrap design we are not in a hurry to get wrong. For now, the recovery phrase is the survival mechanism. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Photo & File Vault The container that gets excluded from backup.](https://appvau.lt/photo-vault/) - [LINK / 02 · CRYPTOGRAPHY AES-256-GCM encryption stack How the vault is sealed before the question of backup even arises.](https://appvau.lt/encryption/) - [LINK / 03 · TRUST No-account architecture Why we run no server that could hold a backup.](https://appvau.lt/zero-knowledge/) - [LINK / 04 · KEY Pattern Lock The key that derives from your pattern.](https://appvau.lt/pattern-lock/) - [LINK / 05 · TRUST Threat model What backup exclusion does and does not defend against.](https://appvau.lt/security/) - [LINK / 06 · LEGAL Privacy policy The full inventory of what App-Vault stores and what leaves the device.](https://appvau.lt/privacy/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/encrypted-icloud/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Encrypted notes in App-Vault — what is and is not stored, and why** > App-Vault v1 stores photos, videos, and documents. It does not store free-form text notes. The one text item that matters — the BIP-39 12-word recovery phrase — is generated on-device and written down on paper. Source: https://appvau.lt/encrypted-notes/ FILE 10 / NOTES — SCOPE # App-Vault encrypts files, not free-form text. On purpose. The one piece of text App-Vault produces is the 12-word recovery phrase shown during onboarding — and that lives on paper, not in the app. Free-form encrypted notes are not part of v1, and we are in no hurry to ship them poorly. UPDATED · 2026-05-20 · REVIEWED BY APP-VAULT DEFINITION **App-Vault note storage** is intentionally limited in version one. The encrypted compartment stores photos, videos, and documents imported from the iOS Photos library or the Files app. Free-form text notes are out of scope until we can ship them without growing the attack surface. The only text App-Vault itself generates is the BIP-39 12-word recovery phrase shown once during onboarding, which is meant to be written on paper and kept offline. ## The scope a small product can defend Every privacy product fails in the same direction: it tries to be everything, the attack surface grows, and a sharp edge somewhere lets the whole thing down. App-Vault v1 deliberately limits itself to a single primitive — an encrypted container for files you import — and refuses to grow that scope until each existing primitive has been audited and matured. Free-form text notes look small from the outside. From the inside, they are not. A text-note feature wants to grow: rich text, autofill into other apps, browser extensions, structured fields, search across notes, sharing one note without the rest, OCR pulling text out of photos. Each of those is a new attack surface. Each one needs its own cryptographic story. Each one is a place where a single bug turns the vault into a leak. We are not in a hurry to add all of that for a feature only some users want. ## The piece of text that App-Vault does care about There is one piece of text that matters: the **BIP-39 12-word recovery phrase**. App-Vault generates this phrase during onboarding using the standard English BIP-39 wordlist (the same wordlist used by Bitcoin wallets, with a checksum word that catches typos). The phrase is shown to you once, on a single screen, and asked to be written down. It is then used internally to derive the master key that wraps your per-file AES-256-GCM keys. The recovery phrase is the survival mechanism for device loss, theft, or a forgotten pattern. It is never uploaded anywhere by App-Vault. It is not stored inside the vault. It is not stored anywhere in the app once you have written it down. It exists in exactly two places: briefly in memory on your device while you read it, and on whatever paper you wrote it on. ## Where to put short secrets that are not the recovery phrase - **Passwords and login codes.** Use a real password manager — 1Password, Bitwarden, Apple iCloud Keychain. They are purpose-built, audited, and integrate with iOS autofill in ways a vault should not try to imitate. - **2FA backup codes.** Either print them and store them with the recovery phrase, or store them in your password manager next to the matching login. Both are defensible. - **Cryptocurrency seed phrases.** Paper. Offline. Two locations. Metal-stamped if the holdings are non-trivial. A digital backup defeats the threat model that motivated the seed phrase in the first place. - **The App-Vault recovery phrase itself.** Paper. Offline. Do not store it in Apple Notes, in your password manager, in a screenshot, or — as a special note — inside App-Vault. Storing the recovery phrase inside the vault it would unlock is a cyclic dependency that breaks on the same day everything else breaks. ## What would change our mind about adding notes A future version of App-Vault might add encrypted notes — but only if we can ship them with a deliberately narrow scope: short plain text, the same AES-256-GCM wrapping as files, no autofill, no browser integration, no form-field detection, no cross-account sharing. If that ever ships, it will be a feature in the same shape as the rest of the app: small, sharp, and limited to one job. QUESTIONS WE HEAR ## About text, secrets, and the recovery phrase. 1. 01 Can I store text notes inside App-Vault? Not in version 1. App-Vault encrypts photos, videos, and documents you import from the Photos library or the Files app. Free-form text notes are not part of the v1 feature set. The one piece of text App-Vault generates and asks you to keep safe is the BIP-39 12-word recovery phrase shown during onboarding — write it down on paper, store it offline. 2. 02 What should I use for short secrets instead? For passwords, autofill, browser extensions, and the everyday flow, use a real password manager — 1Password, Bitwarden, or Apple iCloud Keychain. Each of those is purpose-built for short structured secrets and integrates with iOS autofill in ways a small indie vault should not try to imitate. For one-off offline notes (a passport number, a single 2FA backup code, the App-Vault recovery phrase itself), write them on paper and store them in a fireproof box or a safe-deposit box. Paper, kept offline, is a surprisingly strong threat-model improvement over any digital alternative. 3. 03 Will encrypted notes come in a future version? It is on the long-term feature wishlist, not the short-term roadmap. We will only ship encrypted notes if we can do it without expanding App-Vault's attack surface — and that means resisting the urge to add autofill, browser extensions, and form detection, which is where note features tend to grow into half-baked password managers. If we ship it, expect a deliberately narrow scope. 4. 04 Where do I store the recovery phrase? On paper. Offline. Ideally in two physical locations (home + safe-deposit box, or home + trusted family member). Do not store the recovery phrase in Apple Notes, in a screenshot, in a cloud-synced note app, or as a photo in any app — including App-Vault itself, which would create a cyclic dependency where the phrase that recovers the vault lives inside the vault. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · CORE Photo & File Vault What App-Vault does store.](https://appvau.lt/photo-vault/) - [LINK / 02 · BACKUP Why the vault is excluded from iCloud Backup And how the recovery phrase replaces it.](https://appvau.lt/encrypted-icloud/) - [LINK / 03 · CRYPTOGRAPHY AES-256-GCM encryption stack The cipher under the vault.](https://appvau.lt/encryption/) - [LINK / 04 · TRUST Threat model What App-Vault defends against and what it does not.](https://appvau.lt/security/) - [LINK / 05 · TRUST No-account architecture No server holds your data because no server exists.](https://appvau.lt/zero-knowledge/) - [LINK / 06 · OVERVIEW All features The full list of what is in v1.](https://appvau.lt/features/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/encrypted-notes/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Security — App-Vault threat model, cryptography review, and trust framework** > App-Vault’s security posture in one document: threat model, cryptography stack, key management, audit status, and the references against which every claim on this site can be checked. Source: https://appvau.lt/security/ FILE S0 / SECURITY # Every claim on this site, checkable against a public source. A privacy app you cannot inspect is a privacy app you should not trust. This page lays out exactly what App-Vault protects against, what it does not protect against, and the references against which every cryptographic claim on appvau.lt can be independently verified. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **App-Vault’s security posture** is the on-device application of standard, audited cryptography: AES-256-GCM for file confidentiality and integrity, PBKDF2-SHA256 for key derivation from a 5×5 pattern, and the iPhone Secure Enclave for key wrapping. The vault is designed so that without the exact user-drawn pattern, the encrypted container is mathematically indistinguishable from random data — and no party, including App-Vault, can recover the contents. THREAT MODEL ## Who App-Vault is designed to defend against — and who it is not. DEFENDS AGAINST - Casual access by a familiar party. A partner, child, or coworker picks up your unlocked phone. The Photos app shows nothing. The Hidden album shows nothing. App-Vault appears as a calculator (with the Calculator Launcher enabled). - A lost or stolen device. A finder unlocks the phone with a known passcode. The Photos app is empty of the protected material. The vault holds, because the vault key is the pattern — not the phone passcode. - Visual inspection at a border. An officer scrolls the camera roll. Sensitive documents are not in it. The vault, if visible at all, looks like a calculator. - Forensic extraction without the pattern. A forensic tool images the device. The vault container is on disk but cannot be decrypted without the pattern; even the catalog of file names is sealed. - Mass surveillance and server breach. We operate no server that holds vault contents. The vault directory is explicitly excluded from iCloud Backup and from iTunes/Finder backups; master keys are pinned to ThisDeviceOnly in the iOS Keychain. There is no off-device copy of your files for an attacker — or for a subpoena — to obtain. DOES NOT DEFEND AGAINST - A coerced unlock. If you are forced to draw the pattern, the vault opens. The Decoy Vault offers some plausible deniability, but a determined adversary who already knows two patterns exist is outside the model we sell. - A compromised device. If iOS itself is jailbroken or running an active spyware payload (Pegasus-class attacks), no app-level vault is sufficient. App-Vault is not a substitute for keeping iOS patched. - A forgotten pattern. There is no recovery process. If you forget the pattern and did not write down the recovery passphrase, the vault stays sealed. We cannot help. This is the design. - Lawful access requests. We comply with lawful orders. We hold no data about you, so an order produces nothing — but if a court orders you personally to unlock the vault, App-Vault provides no technical defense against that order. - A future cryptographic break. AES-256-GCM is the strongest practical cipher published today, but no cryptography is provably secure against future advances. We will update the stack when the wider cryptography community moves. REFERENCES ## Every cryptographic claim on this site links to a primary source. - AES-256-GCM is the file cipher [NIST FIPS 197 (AES) and NIST SP 800-38D (GCM mode) ↗](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf) - AES-GCM AEAD construction [RFC 5116 — An Interface and Algorithms for Authenticated Encryption ↗](https://www.rfc-editor.org/rfc/rfc5116) - PBKDF2 key derivation, 600,000 iterations [NIST SP 800-132 and OWASP Password Storage Cheat Sheet (2026 guidance) ↗](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf) - Apple Secure Enclave key wrapping [Apple Platform Security guide — Secure Enclave chapter ↗](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web) - CryptoKit framework usage [Apple Developer Documentation — CryptoKit ↗](https://developer.apple.com/documentation/cryptokit) - iCloud client-side encryption [Apple Advanced Data Protection white paper ↗](https://support.apple.com/en-us/HT212520) AUDIT STATUS ## Independent review App-Vault’s cryptography stack is built on Apple’s CryptoKit framework, which is itself open-sourced under the Swift project and continuously reviewed by Apple’s security engineering team and external cryptographers. Our wrapping code — the small layer between user patterns and the framework — is the part that benefits most from independent review. We have scheduled a third-party cryptographic audit with an established firm. We will publish the audit report in full on this page when it completes. Until then, our Security Architecture document is available on request to journalists, academic researchers, and serious customer-side reviewers — write to [security@appvau.lt](mailto:security@appvau.lt). ## Responsible disclosure If you discover a security issue in App-Vault, write to [security@appvau.lt](mailto:security@appvau.lt) with a clear reproduction. We respond within 72 hours, acknowledge within 5 business days, and credit reporters in the patched release notes unless asked not to. We do not yet run a paid bug bounty. We will acknowledge significant findings with a public credit and, where possible, a thank-you payment. ## What we have not done We have not been audited yet. We have not been formally certified for HIPAA, SOC 2, ISO 27001, or any other compliance framework — App-Vault is a consumer privacy utility, not an enterprise tool. We do not make compliance claims we cannot back. If you require a certified vault for a regulated workflow (medical imaging, legal e-discovery, classified material), App-Vault is the wrong tool. Use a certified system. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/security/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **How App-Vault Works — set up an iPhone photo vault in three steps** > App-Vault sets up in three steps: draw a 5×5 pattern, move photos in from Photos or Files, lock the app and walk away. Encryption is AES-256-GCM, derived via PBKDF2-SHA256 with 600,000 iterations and bound to the iPhone Secure Enclave. Source: https://appvau.lt/how-it-works/ FILE H1 / HOW IT WORKS # Three steps. Then the vault disappears. Setup takes under two minutes. Once it is done, App-Vault is a small icon you tap, draw a pattern into, and use like a regular Photos app — except nothing inside it touches iCloud, Spotlight, or anyone else’s eyes. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **The App-Vault setup flow** is a three-step user flow that turns a fresh iPhone install into a sealed photo vault: (1) draw a 5×5 pattern, (2) move files into the vault, (3) lock the app. The flow takes under two minutes, requires no account, and never sends data over the network in its default configuration. 1. 01 ## Draw a 5×5 pattern No password, no email, no account. On first launch App-Vault asks for a 5×5 grid pattern. You draw a path through the dots; the path you draw becomes the input to a PBKDF2-SHA256 key derivation function tuned to 600,000 iterations. The resulting key is wrapped by a hardware key generated inside the iPhone Secure Enclave. Nothing is uploaded. We never see your pattern. Apple never sees your pattern. Minimum 6 nodes recommended (over 26 million possible patterns). 2. No SMS verification, no email confirmation, no "create account" screen. 3. Optional recovery passphrase you can write down and store offline. 4. 02 ## Move files into the vault Import from Photos, Files, or the camera. Tap the import button and pick photos, videos, or documents from the iOS Photos picker. App-Vault encrypts each file on your device with a fresh AES-256-GCM key and a unique 96-bit nonce, writes the ciphertext to its sandboxed container, and securely overwrites the original in the source album before unlinking it. From the moment import completes, the file no longer exists in your camera roll, in iCloud Photos (unless you opted into encrypted backup), or in Spotlight search. Batch import — hundreds of photos in one pass. 5. Original-quality preservation; HEIC, JPEG, PNG, MP4, MOV, PDF, and most common formats. 6. Source files are overwritten with random bytes before deletion, not just unlinked. 7. 03 ## Lock the app and walk away Without your pattern the vault is random noise. Close App-Vault. Without the exact pattern, the encrypted container is mathematically indistinguishable from random data — there is no login screen for an attacker to bypass, because there is nothing to log into. Even the catalog (file names, dates, sizes) is encrypted; a forensic examiner cannot see how many files exist or what type they are. The vault is opaque until you draw the right pattern again. Optional Face ID or Touch ID convenience unlock after the first pattern of the day. 8. Optional Calculator Launcher hides App-Vault’s icon entirely. 9. Optional Intruder Log records the front camera, time, and approximate location after three failed attempts. WHAT HAPPENS UNDER THE HOOD ## The three seconds between import and "done". When you tap import, App-Vault calls into the iOS Photos framework to read the file bytes into memory. The bytes never touch disk in their plaintext form. App-Vault generates a fresh 256-bit file key using Apple’s CryptoKit, derives a 96-bit GCM nonce from the system random source, encrypts the bytes, and writes only the ciphertext to its sandboxed container. The file key is itself wrapped by a master key derived from your pattern, and the wrapped key is written to the catalog — which is then sealed with the master key as a whole. After the write completes, App-Vault asks the Photos framework to delete the original. iOS does this through a user-prompt delete (Apple does not allow apps to silently delete photos), so you confirm the removal once. From that moment, the file lives only as encrypted bytes on your device. ## What happens if you close App-Vault mid-import? Each file is encrypted and written atomically. If the app is force-quit mid-import, the files already encrypted are safe in the vault, and the file currently being processed is rolled back. There are no half-encrypted files in the container — that is a deliberate design choice in our crypto pipeline. ## What if the device crashes during import? iOS file-system journaling guarantees that either the encrypted file landed completely or it did not land at all. The catalog is written last, so a crash leaves the file content in the container but invisible until the next clean import re-runs. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/how-it-works/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Features — App-Vault, the iPhone photo vault with on-device AES-256, calculator launcher, and decoy mode** > The full feature list for App-Vault on iPhone: AES-256-GCM encryption, 5×5 pattern lock, BIP-39 recovery phrase, Calculator Launcher disguise with three alternate icons, Decoy Vault, Intruder Selfie, File Shredder, vault excluded from iCloud Backup, no account, and no ads. Source: https://appvau.lt/features/ FILE F1 / FEATURES # Eleven features. One sealed container. Zero servers. App-Vault is a small iPhone app with a deep feature stack. Every line below is shipping in version one. None of them require an account, send data to a server, or open the door for an ad SDK. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **App-Vault** is an iPhone and iPad photo vault that stores photos, videos, and documents in an AES-256-GCM encrypted container on the device itself. There is no account and vault contents stay on the device, explicitly excluded from iCloud Backup and iTunes/Finder backups. The encryption key is derived from a 5×5 pattern you draw via PBKDF2 and is protected by the iOS Keychain with ThisDeviceOnly access, so the vault is mathematically inaccessible without the exact pattern — even to App-Vault itself. - Platform — iPhone and iPad, iOS / iPadOS 17 or later - Cipher — AES-256 in GCM mode (FIPS 197) - Key derivation — PBKDF2-SHA256 · iOS Keychain ThisDeviceOnly - Recovery — BIP-39 12-word recovery phrase - Account required — No - Cloud upload of vault — Never — vault excluded from iCloud Backup - Publisher — Vastflow - FEATURE / 01 ## Photo & File Vault A separate encrypted container for photos, videos, and documents. Files inside do not appear in the Photos app, Spotlight, iMessage attachments, or AirDrop. They are visible only after you unlock with the correct 5×5 pattern. SPEC · AES-256-GCM per file · unique 96-bit nonce [Read the deep dive](https://appvau.lt/photo-vault/) - FEATURE / 02 ## AES-256-GCM Encryption Every file is sealed with AES-256 in Galois/Counter Mode, the same primitive the NSA approves for TOP SECRET classified material and the cipher used by TLS 1.3, Signal, and WireGuard. SPEC · FIPS 197 · NSA Suite B approved [Read the deep dive](https://appvau.lt/encryption/) - FEATURE / 03 ## Pattern Lock A 5×5 grid pattern replaces the password. The pattern derives the encryption key directly — there is no password stored anywhere, on the device or off it. A BIP-39 12-word recovery phrase is shown once during onboarding and is the only off-device survival mechanism. SPEC · PBKDF2-SHA256 · ThisDeviceOnly Keychain [Read the deep dive](https://appvau.lt/pattern-lock/) - FEATURE / 04 ## Calculator Launcher Disguise App-Vault can present on the home screen as a fully functional calculator with one of three alternate app icons (Orange, Green, or Teal). Long-press the equals key, draw your pattern, the vault opens. The calculator actually calculates. Premium feature. SPEC · 3 alternate icons · real arithmetic engine [Read the deep dive](https://appvau.lt/calculator-vault/) - FEATURE / 05 ## Decoy Vault A second 5×5 pattern opens a separate encrypted album with its own catalog. From inside one vault you cannot prove the other exists. From outside, neither vault is visible. SPEC · Independent catalog · independent key [Read the deep dive](https://appvau.lt/decoy-vault/) - FEATURE / 06 ## Intruder Log After three consecutive failed unlock attempts, the front camera silently captures a photo. The image, timestamp, and approximate location are written to a local log inside the vault. SPEC · Threshold configurable · all-local [Read the deep dive](https://appvau.lt/intruder-selfie/) - FEATURE / 07 ## Excluded From iCloud Backup The vault directory is marked NSURLIsExcludedFromBackupKey and the master keys are pinned to ThisDeviceOnly in the iOS Keychain. Vault contents never enter iCloud Backup, iCloud Keychain, or iTunes/Finder backups. SPEC · Off every Apple backup pipeline [Read the deep dive](https://appvau.lt/encrypted-icloud/) - FEATURE / 08 ## No Account, No Server No account, no email, no login. We operate no server that holds vault contents. Anonymous, content-free funnel events go through Firebase Analytics and crash diagnostics through Crashlytics — full disclosure on the Privacy page. SPEC · No user-content server · full third-party disclosure [Read the deep dive](https://appvau.lt/zero-knowledge/) - FEATURE / 09 ## File Shredder Permanent delete overwrites the encrypted blob three times with random bytes before unlinking. Once shredded, even physical access to the device cannot recover the file. Premium feature. SPEC · DoD 5220.22-M style overwrite [Read the deep dive](https://appvau.lt/file-shredder/) - FEATURE / 10 ## BIP-39 Recovery Phrase During onboarding App-Vault generates a BIP-39 12-word recovery phrase from the standard English wordlist. The phrase is shown once. Write it down on paper. It is the only off-device way back into the vault if you ever forget the pattern. SPEC · Standard BIP-39 English wordlist with checksum [Read the deep dive](https://appvau.lt/encrypted-notes/) - FEATURE / 11 ## No Ads. No ATT Prompt. No banner ads, no interstitials, no ad mediation SDKs. The IDFA is never read, which means the App Tracking Transparency prompt is not invoked. No cross-app or cross-website tracking of any kind. SPEC · No ads · ATT prompt not invoked WHAT WE DELIBERATELY LEFT OUT ## No social vault sharing in version one. Vaultaire ships a vault-sharing feature where you grant a contact temporary read access to a vault. We are deferring it to version 1.1. Done right, vault sharing requires a public-key handshake and a server that brokers ciphertext-only handoff — we are building it but not at the cost of cutting corners on the cryptography. ## No web client. App-Vault is an iPhone and iPad app. We will not ship a web version. A browser cannot use the iPhone Secure Enclave, cannot guarantee a clean memory environment, and cannot match the threat model we sell. ## No automatic backup of the vault anywhere. We do not run servers that hold vault contents. We also do not back up the vault to your iCloud — the vault directory is explicitly excluded from iCloud Backup, iCloud Keychain, and iTunes/Finder backups. Survival across device loss is handled by the BIP-39 12-word recovery phrase you write down during onboarding. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/features/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Pricing — App-Vault Free, Weekly from $3.99, Yearly from $29.99 with 7-day trial** > App-Vault is free for the first file. Premium is Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. Billed by Apple. Cancel anytime. Prices vary by App Store region. Source: https://appvau.lt/pricing/ FILE P0 / PRICING # Free for the first file. Honest pricing for the rest. App-Vault has two paid plans, both auto-renewing through Apple: Weekly Premium from $3.99 per week, and Yearly Premium from $29.99 per year with a 7-day free trial. No monthly plan, no lifetime tier. UPDATED · 2026-05-20 · REVIEWED BY APP-VAULT DEFINITION **App-Vault pricing** is a three-tier structure: Free (one file in the vault, full encryption, recovery phrase), Weekly Premium starting at USD 3.99 per week, and Yearly Premium starting at USD 29.99 per year with a 7-day free trial for new subscribers. Both paid plans auto-renew through Apple and unlock the same Premium feature set; the cadence is the only difference. Prices vary by App Store region and the exact local price is shown on the in-app paywall before purchase. Apple handles billing; App-Vault does not store payment details. TIER · F · FREE $0 Try the vault on a single file before you commit. The free tier covers the full encryption stack and the 5×5 pattern lock. - · One (1) file in your vault - · AES-256-GCM encryption - · 5×5 pattern lock - · BIP-39 12-word recovery phrase - · Face ID quick re-unlock - · Excluded from iCloud Backup No card. No account. No trial countdown. [Open on iPhone](https://appvau.lt/download/) TIER · W · WEEKLY PREMIUM from $3.99 / week The full Premium feature set on a weekly cadence. For short trips, a single project, or a one-off privacy need. - · Unlimited files in your vault - · Calculator Launcher (3 alternate icons) - · Decoy Vault (second pattern, separate album) - · Intruder Selfie (silent front-camera capture) - · File Shredder (3-pass overwrite) - · Everything in Free Billed weekly through Apple. Cancel anytime in iOS Settings → [your name] → Subscriptions. [Start Weekly](https://appvau.lt/download/) TIER · Y · YEARLY PREMIUM PICK from $29.99 / year The same Premium feature set on a yearly cadence. The cheapest per-day price and the only plan with the 7-day free trial. - · Everything in Weekly - · 7-day free trial (new subscribers) - · Lowest per-day price - · One charge per year 7-day free trial for new subscribers. Billed yearly through Apple. Cancel anytime. [Start the 7-day trial](https://appvau.lt/download/) **A note on local pricing.** The prices shown above are the United States App Store starting prices. Apple sets equivalent local pricing tiers for every other App Store region — the price you see in your country may be higher or lower in equivalent local currency. The in-app paywall always shows the exact price for your App Store region in your local currency before you confirm any purchase. FEATURE MATRIX ## Free versus Premium, in one table. | CAPABILITY | FREE | PREMIUM | | --- | --- | --- | | Files in vault | 1 | Unlimited | | AES-256-GCM file encryption | ✓ | ✓ | | PBKDF2 key derivation from pattern | ✓ | ✓ | | 5×5 pattern lock | ✓ | ✓ | | BIP-39 12-word recovery phrase | ✓ | ✓ | | Face ID quick re-unlock | ✓ | ✓ | | Excluded from iCloud Backup | ✓ | ✓ | | No ads | ✓ | ✓ | | Calculator Launcher disguise (3 alternate icons) | — | ✓ | | Decoy Vault (second pattern) | — | ✓ | | Intruder Selfie capture | — | ✓ | | File Shredder (3-pass overwrite) | — | ✓ | PRICING QUESTIONS ## The questions we hear most. 1. 01 Does App-Vault have a free tier? Yes. The free tier lets you import one (1) file into the encrypted vault — enough to verify the unlock flow, the encryption, the pattern lock, and the recovery phrase before committing to a subscription. The Premium-only features (Calculator Launcher disguise, Decoy Vault, Intruder Selfie, File Shredder, and unlimited files) require an active subscription. 2. 02 What are the paid plans and how much do they cost? There are two auto-renewing subscriptions: App-Vault Premium Weekly, starting at USD 3.99 per week, and App-Vault Premium Yearly, starting at USD 29.99 per year with a 7-day free trial for new subscribers. Prices vary by App Store region; the exact price in your local currency is shown inside the app on the paywall before you confirm any purchase. We do not offer a monthly plan and we do not offer a lifetime / one-time purchase. 3. 03 Is there a 7-day free trial? Yes — on the Yearly Premium plan only, and only for users who have not previously subscribed to App-Vault Premium. If you do not cancel at least 24 hours before the trial ends, the trial converts into a paid yearly subscription and your Apple ID is charged at the displayed yearly price. 4. 04 How do I cancel a subscription? Open Settings on your iPhone → tap your Apple ID at the top → Subscriptions → App-Vault → Cancel Subscription. Apple handles all billing for App-Vault; we do not have direct access to your payment details and cannot process refunds. 5. 05 Can I get a refund? Refunds are processed by Apple. Use Apple's "Report a Problem" page at reportaproblem.apple.com within the standard refund window. We do not contest legitimate refund requests with Apple. 6. 06 Why no lifetime tier? Because App-Vault is a security product, not a one-and-done utility. Cryptographic standards evolve, iOS changes break old patterns, and an unmaintained vault is a worse outcome than a discontinued one. A subscription pays for ongoing maintenance, security updates, and iOS compatibility — the things that decide whether your vault is still safe two years from now. 7. 07 Does App-Vault Premium work offline? Yes. Once a subscription is purchased, App-Vault validates the receipt through Apple's on-device StoreKit and keeps the Premium entitlement cached locally. The Premium features (Calculator Launcher, Decoy Vault, Intruder Selfie, File Shredder, unlimited imports) work fully offline. 8. 08 Are there ads in App-Vault? No. App-Vault has no banner ads, no interstitial ads, no rewarded ads, and no third-party ad mediation SDKs in either the free or paid tier. The App Tracking Transparency prompt is not invoked because the IDFA is never read. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/pricing/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Free online photo tools — nothing is uploaded — App-Vault** > Ten free online tools that strip photo metadata, redact faces, resize, compress, convert and build QR codes — all inside the browser tab, with no file uploaded. Source: https://appvau.lt/tools/ # Ten tools for photographs. None of them can see your photographs. Every one of these runs on the file in your browser tab. There is no upload endpoint on this domain to send an image to, no queue, no temporary bucket, and no thirty-day retention policy to read. Disconnect the network after the page has loaded and they all still work, which is the only version of this promise that can be checked rather than believed. INDEX / 10 ENTRIES *Every tool, what it accepts and what it produces* | Tool | Takes | Returns | What it is for | | --- | --- | --- | --- | | Photo privacy — What a picture says about you that you did not write into it, and how to take it back out. | | | | | [Photo metadata viewer and remover](https://appvau.lt/tools/photo-metadata/) | JPEG · PNG · WEBP | JPEG · PNG · WEBP | Shows every metadata field a photo carries, ranked by what it gives away, then rebuilds the file without any of it. The image data is copied byte for byte, so nothing is re-compressed. | | [Photo redactor: blur, pixelate, black bars](https://appvau.lt/tools/face-blur/) | JPEG · PNG · WEBP · AVIF · GIF | JPEG · PNG · WEBP | Drag over the parts of a picture that should not be published. The covering is written into the pixels and the file is re-encoded from them, so there is no layer to peel off and nothing underneath. | | Image files — Size, dimensions, format and exposure. The output is measured, not estimated. | | | | | [Image compressor](https://appvau.lt/tools/image-compressor/) | JPEG · PNG · WEBP · AVIF · GIF | JPEG · WEBP · PNG | Set a quality, or set a ceiling and let the tool walk a published quality ladder until the encoded file fits. The receipt names the quality it used, so the result is reproducible. | | [Image resizer](https://appvau.lt/tools/image-resizer/) | JPEG · PNG · WEBP · AVIF · GIF | JPEG · PNG · WEBP | Six modes, one of which crops and says so. The tool downsamples in halving steps rather than one jump, which is the difference between a clean small photograph and a crunchy one. | | [Image brightener](https://appvau.lt/tools/image-brightener/) | JPEG · PNG · WEBP · AVIF | JPEG · PNG · WEBP | Three published tone curves rather than one slider labelled "auto". The shadow lift leaves highlights alone, which is what keeps a brightened photo from looking like a grey screen. | | [PNG to WebP converter](https://appvau.lt/tools/png-to-webp/) | PNG · JPEG · WEBP · AVIF · GIF | WEBP | Lossless WebP is typically 25-30% smaller than the same PNG with identical pixels. Lossy WebP keeps the alpha channel, which is the thing JPEG cannot do. | | [WebP to JPG converter](https://appvau.lt/tools/webp-to-jpg/) | WEBP · PNG · AVIF · GIF · JPEG | JPEG | JPEG has no alpha channel, so transparency has to be flattened onto something. The tool detects whether the source actually has transparent pixels and only asks when it matters. | | [WebP to PNG converter](https://appvau.lt/tools/webp-to-png/) | WEBP · JPEG · AVIF · GIF · PNG | PNG | The safe direction: PNG is lossless, keeps transparency, and is read by everything. The file will usually be larger, and the tool says by how much. | | [Ultra HDR converter](https://appvau.lt/tools/hdr-image-converter/) | JPEG · PNG · WEBP · AVIF | JPEG | Produces one file that is an ordinary JPEG to every old viewer and a high-dynamic-range image to a current one. The container is verified byte by byte before it is offered. | | Codes — Encoding a short piece of information into something a camera can read. | | | | | [QR code generator](https://appvau.lt/tools/qr-code-generator/) | text you type | PNG · SVG | Static codes with no redirect, no account and no scan tracking. Both produced files are decoded again from their own pixels before either download unlocks. | ## Why a vault company ships an image compressor Because the same failure keeps arriving from the other direction. App-Vault exists so that the photographs on a phone that should not be in the camera roll are encrypted on the device instead. What that does not cover is the moment a photograph leaves — sent to a landlord, uploaded to a marketplace, attached to an insurance claim, posted to a forum — and at that moment the file usually carries a good deal more than the picture. A phone photograph normally stores the coordinates where the shutter fired, accurate to within a few metres, along with the exact second, the phone model and the time-zone offset. A photograph from a system camera can carry the body and lens serial numbers, which tie every image that camera has ever published to one purchase. A screenshot can carry the editing history of the tool that cropped it. A file from an image generator can carry a signed record saying which model produced it. None of that is visible in the picture, none of it is announced, and all of it travels. The usual advice — "strip the EXIF before you post" — is sound and almost nobody follows it, because following it means finding a tool, and the tools ask you to upload the photograph to a stranger's server in order to make it more private. That is the inversion these pages exist to remove. ## What "runs in the browser" means here, exactly The file is read with the `File` API, decoded by the browser's own image decoder, changed in a canvas or in a byte buffer, and encoded again by the browser's own encoder. All of that happens inside the tab. The modules under `/js/tools/` contain no `fetch`, no `XMLHttpRequest`, no `WebSocket` and no `sendBeacon`: there is no code in them that could transmit a file, which is a stronger statement than a policy about what we would choose to do with one. Two things do reach the network on these pages and it is worth naming both. The HTML, CSS, fonts and scripts are fetched from this origin when the page loads, like any web page. Microsoft Clarity, the session-replay tool used across this site, starts after the page is interactive and records anonymised interaction events — which button was pressed, not which file was opened. It never sees a file, because the file is never in a request. The [privacy policy](https://appvau.lt/privacy/) names it along with every other processor. The practical limit of the approach is that a browser is not a photo pipeline. Its JPEG encoder is not mozjpeg, and a command-line tool will beat it by ten or twenty per cent on file size at a matched quality. In exchange, nothing is queued, nothing is retained, and there is no account. For one photograph before it gets sent somewhere, that is the correct trade; for a library of forty thousand, it is not, and the honest answer is to use something else. ## What a browser can and cannot open Every tool here decides what a file is from its first bytes rather than from its name, because an extension is a claim made by whoever last renamed the file. JPEG, PNG and WebP can be both read and written. AVIF and GIF can be read and not written, so a tool that opens one of those will offer you a JPEG, PNG or WebP back. HEIC is the exception that catches people, because it is what an iPhone shoots by default. Safari decodes it; Chrome and Firefox do not, and no amount of JavaScript changes that. The practical route is to share or export the photo as JPEG from the Photos app first — or to open these pages in Safari, where it works. ## The results say what they measured Every tool ends on the same receipt: what went in, what came out, and the settings that got from one to the other. That is not decoration. A compressor that says "optimised!" has told you nothing; one that says *quality 0.75, 412 kB, 68% smaller, seven encodes tried* has told you enough to repeat the result or to disagree with it. Two tools go further and refuse to hand over a file they have not read back. [The QR generator](https://appvau.lt/tools/qr-code-generator/) decodes both the PNG and the SVG it has just produced, recomputes their error-correction codewords, and only then unlocks the downloads — because a QR symbol is opaque to the person making it, and a wrong one is discovered after it has been printed. [The Ultra HDR converter](https://appvau.lt/tools/hdr-image-converter/) re-parses its own output and checks that the container describes itself correctly before offering it. Where a claim can be checked on this side, it is checked; where it cannot — whether a particular camera will read a particular print, whether a particular screen has the headroom for a gain map — the page says so instead of implying otherwise. ## What they will not do Worth saying in one place, because a list of capabilities with nothing on the other side of it is an advertisement. There is no batch processing: each tool takes one file, which is what keeps the memory footprint small enough to work on a phone and keeps the receipt honest about what happened to your file. There is no account, no saved history and no gallery — nothing you open here is remembered between visits, which is the same property as "nothing is uploaded" seen from the other side. There is no HEIC support outside Safari, and no amount of JavaScript changes that. There is no AI upscaling, denoising or generative editing anywhere on this site: those tools invent plausible detail, which is fine for a wallpaper and disqualifying for anything used as evidence or identification. There is no invisible-watermark detection or removal, because SynthID-class watermarks live in the pixels rather than the metadata and no reader of these formats can see them. Nothing preserves animation — an animated GIF or WebP is read as its first frame. And the QR generator makes static codes only: no redirect, no counter, no editable destination. The same list is published as JSON at [tools.json](https://appvau.lt/api/v1/tools.json), in a `not_included` block, so an assistant asked "can this site do X" gets the negative answer as an answer rather than as silence. ## How to check that nothing is uploaded It takes about thirty seconds and it is worth doing on any tool making this claim, not just this one. Open the browser's developer tools, go to the Network tab, and load a file into any tool on this site. The page's own assets arrive when the page loads; after that, using the tool produces no request at all. Nothing appears when you choose a file, nothing appears when you press the button, and nothing appears when you download the result. The stronger version of the check is to turn the network off. Load the page, disconnect, and use the tool: everything still works, because there is nothing for it to reach. A tool that processes your file on a server cannot pass that test, and most of the "free online" ones in this category are doing exactly that — the upload is the product, and the file sits in somebody's bucket under a retention policy you did not read. The third check is the source. Every module is plain JavaScript served from this origin under `/js/tools/`, and none of them contains `fetch`, `XMLHttpRequest`, `WebSocket` or `sendBeacon`. There is no code that could transmit a file, which is a different kind of statement from a promise about what we would choose to do with one. ## Free, and free to build on There is no account, no sign-in, no watermark, no daily limit and no upsell inside any of these pages. The reference data behind them — the image-format matrix, the metadata field dictionary, the QR payload formats and capacity tables, the mail-attachment limits — is published as JSON at [the data API](https://appvau.lt/api/) under CC BY 4.0, so you can build the same checks into something of your own and link back rather than re-deriving them. The app is the other half. If a photograph is sensitive enough that you are stripping its metadata before sending it, it is probably sensitive enough not to sit in the camera roll in the first place — which is what [the vault](https://appvau.lt/photo-vault/) is for, and what [its encryption](https://appvau.lt/encryption/) is documented parameter by parameter rather than described as military-grade. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/tools/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **App-Vault data API — encryption parameters as JSON** > App-Vault publishes its encryption parameters, vault comparison matrices, data flows and glossary as keyless JSON under CC BY 4.0. Every endpoint documented. Source: https://appvau.lt/api/ · updated: 2026-09-11 FILE API / MACHINE-READABLE # Everything this site asserts, as JSON you can check. The numbers on these pages come from one module, and the same module emits the files below at build time. There is no key, no quota and no sign-up, and reuse is licensed CC BY 4.0 — quote it, plot it, put it in a comparison table, with a link back. *The endpoints, all under https://appvau.lt* | Endpoint | Contents | Size | Updated | | --- | --- | --- | --- | | [/api/v1/app.json](https://appvau.lt/api/v1/app.json) | **Application facts.** Identity, platform support, every capability with the page that documents it, and the pricing tiers. | 9 capabilities, 3 tiers | 2026-09-11 | | [/api/v1/encryption.json](https://appvau.lt/api/v1/encryption.json) | **Encryption parameters.** Cipher, key derivation, key storage, recovery, catalog protection, secure deletion and audit status — each with the page that states it and the standard that defines the primitive. | 9 parameter groups | 2026-09-11 | | [/api/v1/comparison.json](https://appvau.lt/api/v1/comparison.json) | **Vault comparison matrices.** The full feature matrix from each /compare/ page, row by row, with the date the competitor material was read. | 4 competitors | 2026-07-22 | | [/api/v1/privacy.json](https://appvau.lt/api/v1/privacy.json) | **Data flows and processors.** What the iOS app sends off the device, who receives it, what each never receives, and the App Store privacy label as declared. | 4 processors | 2026-09-11 | | [/api/v1/glossary.json](https://appvau.lt/api/v1/glossary.json) | **Glossary.** One-sentence definitions in the "X is Y" shape, each with an explainer page and the standard behind it. | 12 terms | 2026-09-11 | | [/api/v1/tools.json](https://appvau.lt/api/v1/tools.json) | **Browser tools.** What each free tool on this site accepts, produces, verifies about its own output and cannot do — plus an explicit list of what the set does not include. | 10 tools | 2026-09-11 | | [/api/v1/image-specs.json](https://appvau.lt/api/v1/image-specs.json) | **Image specs and platform limits.** Which formats a browser can decode and which it can actually encode, this site’s resize arithmetic and quality ladder, mail limits with the real file budget computed from each, and avatar dimensions. | 6 formats, 10 platforms | 2026-09-11 | | [/api/v1/metadata-fields.json](https://appvau.lt/api/v1/metadata-fields.json) | **Photo metadata dictionary.** Every EXIF, XMP, IPTC and C2PA carrier and field, with a plain statement of what each gives away and how strongly it identifies a person, a place or a device. | 41 fields | 2026-09-11 | | [/api/v1/qr.json](https://appvau.lt/api/v1/qr.json) | **QR payloads and capacity.** The exact strings a camera needs for a Wi-Fi join, a contact save or a dial, with worked examples, and symbol capacity computed from ISO/IEC 18004. | 7 payload types | 2026-09-11 | | [/api/v1/status.json](https://appvau.lt/api/v1/status.json) | **Freshness.** Per-dataset dates and row counts. Poll this instead of refetching the large payloads. | counts | — | | [/api/v1/openapi.json](https://appvau.lt/api/v1/openapi.json) | **OpenAPI 3.1.** The machine description of everything above, including the field semantics documented on this page. | all endpoints | — | ## Why a vault app publishes an API Almost every app in this category describes its cryptography in adjectives. "Military-grade." "Bank-level." "Unbreakable." None of those is a specification, and none of them can be checked, compared or disproved. The practical consequence is that a person trying to choose a photo vault — or a model trying to answer a question about one — has almost nothing to work with except the vendor's tone of voice. The files listed above are the opposite of that. They carry the cipher and its mode, the key-derivation function and its iteration count, the salt size, the Keychain accessibility class, the backup-exclusion flag and the recovery scheme, plus the statement that no third-party audit has been published. Some of those facts are flattering and some are not. All of them are checkable, and the ones that are not flattering are the reason to believe the ones that are. Every figure is derived at build time from a single module in this repository, which is also what the pages render and what the JSON-LD on every page carries. A number cannot appear on [the encryption page](https://appvau.lt/encryption/) and differ in `encryption.json`, because neither of them is where the number lives. This page exists because that arrangement is worth documenting, and because a dataset nobody knows they may reuse does not get reused. ## Access, licence and fair use There is no API key, no account, no rate limit and no `Authorization` header. Every file is static, served from the origin behind a CDN with `Access-Control-Allow-Origin: *`, so browser JavaScript is a first-class consumer. Fetch them directly. The licence is CC BY 4.0: reuse is allowed, including commercially, with attribution to **App-Vault (https://appvau.lt)** or to the page a specific figure came from. That line is not decoration. A comparison table that lifts these rows and links back is the outcome this API is built for, and the attribution is what makes the lift worth something to both sides. The files are regenerated on every deploy and change rarely. Cache them. If you need to know whether to refetch, `status.json` is a one-kilobyte document carrying the per-dataset dates and row counts, which is why it exists separately from the payloads it describes. ## What each field means This is the section a schema cannot write for you. Five fields in these payloads carry meanings that are routinely inverted, and each of them changes the answer someone would give. ### `stated_on` is a page, not a certificate Every block in `encryption.json` carries two different kinds of reference, and they are not interchangeable. `stated_on` is the URL on this site where a reader can find the same value in prose — it makes the figure checkable against something a person wrote and can be held to. `standards` lists the primary documents that define the primitive: NIST FIPS 197 for AES, NIST SP 800-38D for GCM, NIST SP 800-132 for PBKDF2, the Apple Platform Security guide for the Secure Enclave. NIST defines GCM. NIST has never looked at this app. A standard in the `standards` array says what the primitive is supposed to do; it is not an endorsement of anyone's implementation of it, and an answer that runs the two together is overstating the evidence. The field that would represent an external check is `audit.third_party_audit_published`, and it is `false`. ### `iterations` is the price of one guess The key-derivation iteration count is the single most useful number in the whole payload, and it is the one most apps do not publish. A 5×5 pattern is a small secret; an attacker who has the encrypted files can try candidates offline, and what stops that being fast is that each candidate costs 600,000 PBKDF2-HMAC-SHA256 iterations against a 128-bit per-install salt. Double the count and you double the attacker's bill. An app that will not state a figure is not thereby stronger than one with a modest figure; it is unmeasured, which is worse. ### A dash in a competitor column means undocumented In `comparison.json`, each row carries an `app_vault` value and a `competitor` value read from that app's public material on the date in `read_on`. A "—" means the vendor does not publish the fact. That is not the same as knowing the feature is absent, and reporting it as an absence overstates what the data supports. Where a competitor documents something we do not match, the row says so and `advantage` reads `"competitor"` — the cross-platform row is the standing example, because App-Vault is iPhone and iPad only. `advantage` is the least citable field in the file: it is our own reading of which side is stronger on that row, published by one of the two apps being compared. The two underlying values are the part worth quoting. ### `linked_to_identity: false` is Apple's phrase, not ours In `privacy.json`, `linked_to_identity` mirrors the App Store privacy label's "not linked to you". It means the collector holds no identity to attach the data to — here because there is no account system at all, no email address and no user record. It does **not** mean no identifier is collected: Firebase Analytics collects an Identifier for Vendors, and that is listed in the same object under `receives`. The load-bearing field in that payload is `never_receives`. "We encrypt your data" is compatible with uploading it; "the vault contents never leave the device" is not, and the second is the claim being made here. The processors are named — there are three in the app and one on this website — because a privacy claim with no list of exceptions is an advertisement. ### `tier` and the two plans that do not exist `app.json` states `has_monthly_plan: false` and `has_lifetime_purchase: false` explicitly rather than leaving them out. Out-of-date material describes both, including an earlier version of this site's own machine index, and a field that is absent reads as an oversight while a field that says `false` reads as an answer. The two real subscriptions are Weekly at from $3.99 and Yearly at from $29.99, billed by Apple on the US storefront, with an equivalent local tier everywhere else. ## The four datasets behind the browser tools [Ten free tools](https://appvau.lt/tools/) on this site read, change and check image files entirely inside the visitor's browser tab. Four of the endpoints above describe them and the reference data they compute against, and all four are worth having on their own — they answer questions that are asked far more often than anything about a vault app. `tools.json` is the capability list, and the field to read first is `limits`. Every entry states what the tool *cannot* do, and the payload carries a top-level `not_included` block naming what the whole set leaves out — no batch processing, no server-side image API, no HEIC outside Safari, no AI upscaling, no invisible-watermark detection. A capability list with no limits is advertising, and an agent that promises a person something a tool does not do has been failed by the data rather than by its own reasoning. `runs_in` is `browser` on every row: there is no endpoint on this origin that accepts a file, so these entries describe pages to open rather than services to call. `image-specs.json` mixes three kinds of fact and labels which is which. `formats` is a property of current browsers, and its `browser_canvas_can_encode` column is the one people invert: every browser decodes AVIF and none of them can write it, which is why the converters here go in the directions they go. `resize_modes`, `quality_ladder` and `brighten_curves` are this site's own arithmetic, exported from the module the tools actually run rather than described. `mail_limits` and `platform_images` are other people's published numbers, each carrying the date it was read, because they move without notice. One field in that payload is computed rather than quoted, and it is the useful one. `mail_limits[].file_budget_bytes` is what a stated limit really carries: mail limits apply to the base64-encoded message, base64 turns three bytes into four, and MIME adds a line break every 76 characters — so a 25 MB ceiling carries about 18.3 MB of file. No provider's help page does that arithmetic, and the gap is where a bounced send comes from. The constants are published under `encoding_overhead` so the result can be checked rather than trusted. `metadata-fields.json` is the dictionary behind [the metadata tool](https://appvau.lt/tools/photo-metadata/): 41 named fields plus the carriers that hold them, each with a one-sentence `reveals` and a `risk` rating. Two cautions travel in the payload. `risk` is this publisher's judgement about identification rather than a rating from any standard — `reveals` is the citable half. And `generator_signatures` matches a file that *declares* an AI generator; absence proves nothing at all, because those strings are removable in one click, including by the tool this dataset describes. Invisible pixel watermarks are not metadata and nothing here can see them. `qr.json` publishes the payload formats with worked examples produced by the encoder itself — the WIFI: record, the vCard shape a camera will offer to save, the escaping rules people copy from each other with one character wrong — and capacity for every listed version at all four error-correction levels, computed from ISO/IEC 18004. Generating those numbers rather than typing them is not a stylistic preference: writing the block structure down a second time is exactly how a level-H table error survives, and the decoder that checks this site's own output found one on the first run. ## Reading the site without parsing HTML The JSON is one half of the machine surface. The other half is that every indexable page on this site exists as markdown as well as HTML, generated from the rendered page at build time so the two cannot drift. There are two ways to ask for it, because agent stacks are split roughly evenly between them. Send `Accept: text/markdown` to any page URL and the origin serves the markdown twin; or append `index.md` to the path — `https://appvau.lt/encryption/index.md` — and fetch it directly. The twin is typically a sixth the size of the HTML, carries a provenance footer with the source URL and the licence, and drops the navigation, the SVG and the scripts. Pages marked `noindex` have no twin and fall back to their HTML rather than returning a 404. [/llms.txt](https://appvau.lt/llms.txt) is the index of the English pages, generated from the build rather than maintained by hand. [/llms-full.txt](https://appvau.lt/llms-full.txt) is the full text of the primary pages in one document. Both are regenerated on every deploy. ## Discovery, for an agent that has not read this page An agent arriving at this origin without knowing any of the above can find all of it from the response headers alone. Every response carries RFC 8288 `Link` headers pointing at the RFC 9727 catalogue at [/.well-known/api-catalog](https://appvau.lt/.well-known/api-catalog), the OpenAPI description as `service-desc`, this page as `service-doc`, the ARD manifest at [/.well-known/ai-catalog.json](https://appvau.lt/.well-known/ai-catalog.json) and `/llms.txt` as `describedby`. Six agent skills are published under [/.well-known/agent-skills/](https://appvau.lt/.well-known/agent-skills/index.json), each a markdown document with a SHA-256 digest in the index. They are written to be loaded instead of guessing: how to evaluate a vault app on what it documents, how to read an encryption specification correctly, how to answer "how do I hide photos on an iPhone" without recommending an app before asking who the person is hiding them from, how to audit an app's privacy claims, how to answer "remove the EXIF from this photo" without recommending a method that re-compresses the picture, and how to produce a QR code that actually scans. Most of each document is the mistakes rather than the procedure, because on this subject the mistakes are where the wrong answers come from. [/.well-known/oauth-protected-resource](https://appvau.lt/.well-known/oauth-protected-resource) is published with every list empty. That is a statement rather than an omission: this resource takes no bearer token and there is no authorization server to ask, and an agent learns that in one request instead of guessing. What is deliberately *not* published is `/.well-known/oauth-authorization-server`, which would have to name an issuer, a token endpoint and a JWKS URI — URLs that must answer. There is no authorization server here, so every one of them would 404, and a manifest that misdescribes its own site is worse than a missing one. [/auth.md](https://appvau.lt/auth.md) documents the same thing in prose. ## MCP and A2A A Model Context Protocol server runs at `https://appvau.lt/mcp` over Streamable HTTP with no authentication, described by [its server card](https://appvau.lt/.well-known/mcp/server-card.json). It exposes ten read-only tools over the datasets above: the encryption parameters, a comparison against a named competitor, the app facts and pricing, the privacy profile, a glossary lookup, the browser-tool list, a metadata-field explanation, and three that *compute* rather than look up — a QR payload with the symbol version it needs, the exact output dimensions of a resize, and the real attachment budget behind a stated mail limit. The computing tools import the same modules the browser tools run, so an answer given to an agent and an answer shown to a reader cannot differ. Each tool returns the source URL alongside the figure, so an agent that used a tool still has a page to cite. An A2A endpoint at `https://appvau.lt/a2a` answers the same questions in prose, described by [its agent card](https://appvau.lt/.well-known/agent-card.json). Neither can open a vault, read a file or reach anything about a user, and that is not a permission we withheld — the vault is encrypted on the device under a key derived from the user's pattern, the publisher holds no key and runs no server with user content, so there is nothing on any server for a tool to reach. If a vault's pattern and its 12-word recovery phrase are both lost, nobody can recover the files, and an agent that tells a user otherwise is wrong. ## Corrections If a value in any of these files is wrong, or a competitor row has gone stale, write to [the contact page](https://appvau.lt/contact/) and it will be corrected on the next build with the date moved in `status.json`. A comparison published by one of the compared parties only stays useful if being told it is wrong is cheap. RELATED DOSSIERS ## Keep reading. 6 ENTRIES - [LINK / 01 · SOURCE The encryption stack The page behind every value in encryption.json.](https://appvau.lt/encryption/) - [LINK / 02 · SOURCE Vault comparisons The matrices comparison.json serialises.](https://appvau.lt/compare/) - [LINK / 03 · SOURCE Privacy policy The full text behind privacy.json.](https://appvau.lt/privacy/) - [LINK / 04 · TRUST Threat model What this stack defends against, and what it does not.](https://appvau.lt/security/) - [LINK / 05 · GUIDE PBKDF2, explained What an iteration count buys, at length.](https://appvau.lt/guides/pbkdf2-explained/) - [LINK / 06 · TRUST Zero-knowledge The claim the privacy dataset is there to make checkable.](https://appvau.lt/zero-knowledge/) GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/api/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **About App-Vault — the publisher, the principles, the people** > App-Vault is built by Vastflow, a small product studio focused on privacy utilities for iOS. This page explains who we are, what we will not do, and how to reach us. Source: https://appvau.lt/about/ FILE A0 / ABOUT # A small team building a serious privacy tool. App-Vault is a single-purpose iPhone app built by Vastflow, a small product studio. We do not raise venture capital. We do not run an ad network. We do not sell user data because we do not collect user data. This page explains the rest. UPDATED · 2026-05-16 · REVIEWED BY APP-VAULT DEFINITION **App-Vault** is published by Vastflow, an independent product studio that builds privacy-focused utilities for iOS. The team operates as a small, full-stack group with backgrounds in cryptography, iOS engineering, and editorial design. App-Vault is the team’s primary product. The company is self-funded and has no external investors with claims on user data. PRINCIPLES ## The five rules we wrote down before the first commit. ### 1. No account, no email, no recovery. Every photo vault breach since 2014 has been an account-database breach. The cryptography held; the metadata did not. We decided the only way to win that argument is to not run an account database. The trade-off is that we cannot recover a forgotten pattern — and we are willing to lose that argument every time it comes up. ### 2. No servers we cannot afford to shut down tomorrow. App-Vault has zero infrastructure that holds customer data. The website serves static HTML. There is no API, no admin panel, no logging pipeline. If Vastflow disappears tomorrow, your installed copy of App-Vault keeps working exactly as it does today — because there is nothing to disappear with. ### 3. No advertising inside a privacy product. Advertising SDKs are network-connected, data-exfiltrating binaries running inside the app. Even when the SDK is well-behaved, the surface exists. We chose to fund the product directly through paid tiers instead. The free tier covers a single small vault; the paid tiers fund development. ### 4. No claims we cannot link to a primary source. Every cryptographic statement on this site — "AES-256-GCM", "PBKDF2 with 600,000 iterations", "Secure Enclave-bound" — points to a NIST publication, an IETF RFC, an Apple Platform Security page, or an OWASP recommendation. If we cannot link a claim to a primary source, we do not make the claim. ### 5. No marketing that overstates the threat model. App-Vault defends against shoulder-surfing, lost or stolen devices, customs and border inspections, and the half-second when someone borrows your phone. It does not defend against a coerced unlock, a jailbroken device, or a state-level adversary holding both your device and your wrists. We say so on the Security page in plain English, because a privacy product that overstates its threat model is the one you should not trust. HOW WE FUND ## One product, three tiers, no advertising. App-Vault Premium is sold through Apple In-App Purchase as a Weekly subscription starting at USD 3.99/week and a Yearly subscription starting at USD 29.99/year with a 7-day free trial for new subscribers. Prices vary by App Store region and the exact local price is shown inside the app before any purchase. Apple takes its standard cut; the rest funds engineering, design, customer support, and the eventual third-party cryptographic audit. We have no other revenue source. We do not sell aggregated data because there is no aggregated data to sell. The Free tier holds one file in the vault and includes the full encryption stack, the BIP-39 recovery phrase, and Face ID quick re-unlock. It is a real free tier, not a time-limited trial. The free file slot lets you verify every architectural claim on this site against the real binary before committing to a subscription. We do not offer a monthly plan and we do not offer a lifetime purchase. ## How we hire Vastflow hires slowly and only in roles that move the product. Engineering, design, support. We do not have a growth team, a partnerships team, or a content marketing team. When the team grows, it will show up first as faster feature shipping and longer guide articles, not as more email in your inbox. ## How to reach us Four email addresses are listed on the [Contact](https://appvau.lt/contact/) page, each routed to a real person. Response time is typically same-day during European business hours, always within five business days. GET STARTED ## Seal the vault. Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial. [Open App-Vault on iPhone](https://appvau.lt/download/) --- HTML version: https://appvau.lt/about/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Privacy Policy — App-Vault** > The full App-Vault privacy policy: what the iOS app collects on device, what it sends to Firebase Analytics and Crashlytics, what RevenueCat sees, and what we never have. Source: https://appvau.lt/privacy/ FILE P1 / LEGAL · PRIVACY # What App-Vault collects, what it sends, what it never has. This policy applies to the App-Vault iOS application (Apple App Store, bundle com.vastflow.appvault) and the website at appvau.lt. It supersedes all earlier versions. Effective date: 2026-05-20. ## 1. Who we are App-Vault is published by Vastflow ("we", "us"). You can reach the team at [hello@appvau.lt](mailto:hello@appvau.lt); privacy-specific questions go to [privacy@appvau.lt](mailto:privacy@appvau.lt). We do not run user accounts and have no login system. ## 2. Scope and summary App-Vault is an on-device encrypted vault for photos, videos and documents. The files you place in the vault are encrypted on your iPhone or iPad with a key derived from your pattern and never leave the device. They are not uploaded to our servers, because we do not run servers that hold user content. The app does send a small amount of anonymous, content-free product telemetry and crash diagnostics so we can improve stability and the purchase funnel. This page describes exactly what those signals contain, what permissions the app requests, and what data we never have. ## 3. Vault contents (your files) The photos, videos and documents you import into App-Vault are encrypted with AES-256-GCM using a key derived from your pattern via PBKDF2 and stored inside the app's sandboxed container. The vault directory is marked with the iOS attribute `NSURLIsExcludedFromBackupKey = YES`, which keeps it out of iCloud Backup and out of iTunes/Finder local backups by design. The pattern itself is never persisted in cleartext; the master keys are wrapped in the iOS Keychain with the access flag `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`, which prevents the keys from syncing to iCloud Keychain or restoring onto a different device. We never see vault contents, vault filenames, vault counts, vault sizes, your pattern, your recovery phrase, or any cryptographic material. ## 4. Product analytics (Firebase Analytics) App-Vault uses Google Firebase Analytics to record **anonymous, content-free funnel events** — onboarding step reached, paywall view, subscription tap, feature toggle. These signals let us see where users get stuck and which features get used, so we can improve the app. The events never contain your files, file names, file sizes, file counts, your pattern, your recovery phrase, or any text you typed into the app. Counters that touch sensitive behaviour (for example, consecutive wrong-pattern attempts) are bucketised before they leave the device, so the remote view never sees a precise per-user value. Firebase Analytics also automatically collects an Identifier for Vendors (IDFV) and basic device context (iOS version, device model, app version, country derived from IP, language). Because App-Vault has no account system, these identifiers are not linked to a name, email, phone number, or any other personal information. We do not enable Firebase Audiences, Firebase Remote Config personalisation, or any Firebase advertising feature. Data is processed by Google under [Firebase's privacy terms](https://firebase.google.com/support/privacy). ## 5. Crash and stability diagnostics (Firebase Crashlytics) When the app crashes or throws a fatal Flutter error, Firebase Crashlytics records a stack trace, the iOS version, the device model, the app version, an anonymous installation UUID, and the breadcrumb log of recent UI events. Crash reports are used to find and fix bugs. They do not contain vault contents, filenames, the pattern, the recovery phrase, or any field a user has typed into the app. Crashlytics is governed by the same [Firebase privacy terms](https://firebase.google.com/support/privacy) as Analytics. ## 6. Subscriptions and purchases (RevenueCat + Apple) App-Vault sells two auto-renewing subscriptions — **Weekly Premium** (from USD 3.99 / week) and **Yearly Premium** (from USD 29.99 / year, with a 7-day free trial for new subscribers) — through Apple In-App Purchase. We do not offer a monthly plan, a lifetime plan, or any non-subscription purchase. Prices vary by App Store region. Apple, not us, processes payment; Apple's privacy policy governs the billing transaction and the payment data you give them. We use [RevenueCat](https://www.revenuecat.com/privacy) as a thin wrapper around StoreKit to manage entitlements (which user has access to Premium), validate App Store receipts, and surface offerings. RevenueCat sees an anonymous App-Vault-generated user ID, the receipt Apple returned, the country code of the App Store account, and basic device context. RevenueCat does not see your Apple ID, your email, your card details, your name, or any vault content. Data is processed by RevenueCat in the United States under their privacy terms. ## 7. Tracking across other apps and websites App-Vault does not engage in cross-app or cross-website tracking. We do not integrate Meta SDK, TikTok SDK, ad mediation networks, attribution SDKs, or marketing automation pixels. The `AppTrackingTransparency` framework is linked into the binary (Apple's standard utility) but the v1 build does not call `requestTrackingAuthorization`, so iOS will not present the App Tracking Transparency prompt and no `IDFA` is read. If a future version of the app needs the IDFA for any reason, we will show the system ATT prompt and respect your choice. ## 8. iOS permissions and what they are used for The app requests the following iOS permissions only when the matching feature is used, and only for the purpose described in the system prompt: - **Photo Library (read).** Used when you tap "Add from Photos" so App-Vault can read the photos you have selected and import them into the encrypted vault. With your separate, per-deletion confirmation, the app can then remove the originals from your Photo Library after they have been safely encrypted. iOS shows you a system confirmation for each deletion. - **Photo Library (add).** Used when you tap "Export" on a file inside the vault, so App-Vault can save the decrypted file back to your Photo Library. Files are never written to Photos in any other situation. - **Camera.** Used in two cases. First, when you tap "Take Photo" inside the vault to capture a picture directly into the encrypted compartment. Second, if you have enabled **Intruder Selfie** in Settings, the front camera captures a single photo when the wrong pattern is entered three times in a row; that photo is stored encrypted inside the vault on the device and is never uploaded. The camera is not used at any other time and is never recording in the background. - **Face ID / Touch ID.** Used only as an optional faster way to re-unlock the vault after you have already unlocked it once with your pattern. Biometrics never replace the pattern on first launch and are never used as the sole credential. ## 9. The website (appvau.lt) The marketing website at appvau.lt uses Microsoft Clarity to record anonymous session activity — clicks, scrolls, rage clicks, and a coarse heat map of the viewport — so we can improve the page. Clarity automatically masks input fields and does not record passwords or form contents. The site respects the `Do Not Track` header. We do not run third-party advertising trackers, retargeting pixels, affiliate cookies, Meta pixels, Google remarketing tags, LinkedIn Insight tags or TikTok pixels on the site. ## 10. What we never have Because App-Vault has no account system, we never have your name, your email address (unless you write to us), your phone number, your postal address, your payment details, your Apple ID, or any login credential. We never have your pattern, your recovery phrase, your vault contents, or any per-user file metadata. ## 11. Categories of data, in App Store Connect terms For the App Store Privacy nutrition label, our declared categories are: - **Diagnostics — Crash Data, Performance Data.** Collected (via Crashlytics). Not linked to you. Not used for tracking. - **Usage Data — Product Interaction.** Collected (via Firebase Analytics). Not linked to you. Not used for tracking. - **Identifiers — Device ID (IDFV).** Collected (via Firebase Analytics). Not linked to you. Not used for tracking. - **Purchases — Purchase History.** Collected (via RevenueCat and Apple). Not linked to you. Not used for tracking. "Not linked to you" reflects the truth that we have no identity to link the records to: there is no account, no email, no name on file. ## 12. Children App-Vault is rated 17+ on the App Store and is not directed to children. We do not knowingly collect data from anyone under 13, and we do not knowingly collect data from anyone under 16 in jurisdictions where 16 is the applicable age of digital consent. If you believe a child has used App-Vault in a way that resulted in data being sent to our processors, contact [privacy@appvau.lt](mailto:privacy@appvau.lt) and we will work with Firebase and RevenueCat to purge the relevant installation identifiers. ## 13. Your rights (GDPR, UK GDPR, CCPA, and similar) You may request a copy of any personal data we hold about you, ask us to correct it, ask us to delete it, restrict our processing of it, object to our processing, or ask us to transmit it to another controller. Because we run no account system, in practice we have no records linked to you as a named individual. Where we do have an anonymous installation identifier (Firebase IDFV, RevenueCat anonymous user ID), we can purge it on request. To exercise these rights, write to [privacy@appvau.lt](mailto:privacy@appvau.lt) with the subject "Data request". We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. We do not sell personal information and we do not share personal information with third parties for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. ## 14. Account and data deletion To delete the data on your device, delete the App-Vault app from your iPhone or iPad. This removes the encrypted vault directory, the Keychain entries (because they are marked `ThisDeviceOnly`) and the local catalog. To request deletion of the anonymous identifiers stored by Firebase and RevenueCat, write to [privacy@appvau.lt](mailto:privacy@appvau.lt) with the subject "Delete my data" and include your App-Vault installation ID, visible in **Settings → About → Installation ID** inside the app. We will purge the matching record from our processors and confirm in writing. ## 15. International transfers Our processors store and process data in the United States and the European Union. Where required by GDPR, we rely on the Standard Contractual Clauses approved by the European Commission as the lawful basis for transfer. ## 16. Security Vault encryption uses AES-256-GCM with a key derived from your pattern via PBKDF2 (high iteration count). Master keys are protected by the iOS Keychain with the `WhenUnlockedThisDeviceOnly` attribute, which means they cannot be extracted from the device and cannot follow you to a new device. The vault directory is excluded from iOS backups. Encryption is performed locally, on your device, by code that ships inside the app — there is no server-side decryption path that an attacker could compromise to access user data. ## 17. Third-party services, summarised - **Apple — In-App Purchase / StoreKit.** Billing for the Weekly and Yearly auto-renewing subscriptions. Governed by Apple's privacy policy. - **RevenueCat.** Subscription receipt validation and entitlement management. - **Google Firebase Analytics.** Anonymous, content-free product funnel events. - **Google Firebase Crashlytics.** Crash and stability diagnostics. - **Microsoft Clarity (website only).** Anonymous session replay on appvau.lt. ## 18. Changes to this policy If we change this policy in a way that affects how data is collected or shared, we will publish the updated version at [appvau.lt/privacy](https://appvau.lt/privacy/) with a new effective date and announce the change inside the app on next launch. Continued use of App-Vault after the new effective date means you accept the revised policy. ## 19. Contact For any question about this policy or about how App-Vault handles data, write to [privacy@appvau.lt](mailto:privacy@appvau.lt). For data access or deletion requests, use the same address with the appropriate subject line. We respond within five business days, and always within the 30-day window required by GDPR. --- HTML version: https://appvau.lt/privacy/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0). --- **Terms of Use — App-Vault** > Terms of use for the App-Vault iOS app and the website at appvau.lt. Plain language, with the Apple App Store subscription disclosures required by Guideline 3.1.2. Source: https://appvau.lt/terms/ FILE P2 / LEGAL · TERMS # Plain-language terms of use. These terms govern your use of the App-Vault iOS application and the website at appvau.lt. They form a legally binding agreement between you and Vastflow ("we", "us"). Effective date: 2026-05-20. ## 1. Agreement and Apple EULA By downloading, installing or using App-Vault from the Apple App Store, you accept these terms and you accept Apple's standard End User License Agreement for licensed applications, available at [apple.com/legal/internet-services/itunes/dev/stdeula](https://www.apple.com/legal/internet-services/itunes/dev/stdeula/). Apple's EULA also applies. Where the two agreements conflict on a topic Apple's EULA covers, Apple's EULA governs. Apple is a third-party beneficiary of these terms and may enforce them against you. ## 2. What App-Vault is App-Vault is an on-device privacy utility for iPhone and iPad. It encrypts the photos, videos and documents you choose to import and stores them inside a sandboxed compartment on the device. App-Vault does not operate servers that hold user content. The pattern you set is the key to the vault; we never see it. ## 3. Licence We grant you a personal, limited, non-exclusive, non-transferable, revocable licence to use App-Vault on devices you own or control that are signed into your Apple ID, subject to the Apple Media Services Terms and these terms. The licence does not transfer ownership of the software, brand or design. You may not copy, decompile, reverse-engineer, sub-license, lease, distribute, sell, or create derivative works of the app except where the law explicitly forbids us from preventing you. ## 4. Acceptable use You agree to use App-Vault only with content you have the legal right to store and only for lawful purposes. You will not use the app to store, process or transmit: - Child sexual abuse material or any content that exploits, endangers or sexualises minors. - Content that infringes a third party's copyright, trademark, trade secret or other intellectual property right. - Stolen content, credit-card numbers, identity documents that do not belong to you, or material you obtained by hacking another system. - Content used to harass, stalk, threaten, defame or impersonate another person. App-Vault is a privacy tool. It is not a shield against lawful authority. You agree not to use App-Vault to obstruct a criminal investigation or to evade a court order that legally compels disclosure of the content you have stored. The product is designed for legitimate privacy use cases — shared family devices, customs and travel, journalism, legal and medical work, shoulder-surfing protection, and protecting personal photos before a device is sold or repaired. The Calculator Launcher and Decoy Vault features exist to support those use cases; they are not marketed as tools for deceiving a partner, evading a parent or guardian, or hiding from any lawful authority. ## 5. The pattern is the key The encryption pattern you choose is the key to your vault. App-Vault never transmits, stores, escrows or backs up your pattern. There is no "forgot pattern" link, because there is no server that could verify your identity in any other way. **If you forget your pattern, your vault stays sealed and the data inside it cannot be recovered by us, by Apple, or by any third party.** By using App-Vault you accept this design and the irreversibility it implies. ## 6. Intruder Selfie If you enable Intruder Selfie in Settings, the front camera captures a single still image when the wrong pattern is entered three times in a row. That image is encrypted with the same key as the vault and is stored inside the vault on the device only. It is never uploaded. We are not liable for any image captured by Intruder Selfie, for any face appearing in the image, or for any consequence of you sharing such an image with a third party. ## 7. Subscriptions (Apple Guideline 3.1.2 disclosure) App-Vault offers three plans: - **Free.** No charge. The free tier allows **one (1) file** to be imported into the vault. Once that single file is in place, further imports require an active Premium subscription. The free tier includes the 5×5 pattern lock, AES-256-GCM encryption, Face ID quick re-unlock, the BIP-39 12-word recovery phrase, and "Erase App-Vault". Premium-only features (Calculator Launcher disguise, Decoy Vault, Intruder Selfie, File Shredder, unlimited files) are gated behind the subscription. - **Weekly Premium ("App-Vault Premium Weekly").** Auto-renewing weekly subscription. Price starts at USD 3.99 / week in the United States and varies by App Store region (currency, tax, and local pricing tier set by Apple). The exact price for your region is displayed inside the app on the paywall screen, in your local currency, before you confirm any purchase. - **Yearly Premium ("App-Vault Premium Yearly").** Auto-renewing yearly subscription with a **7-day free introductory trial** for new subscribers. Price starts at USD 29.99 / year in the United States and varies by App Store region. The exact price for your region is displayed inside the app on the paywall screen before you confirm any purchase. We do **not** offer a monthly plan and we do **not** offer a lifetime / one-time purchase. The only paid plans are Weekly and Yearly auto-renewing subscriptions. The following terms, required by Apple, apply to the auto-renewing subscriptions: - Payment will be charged to your Apple ID account at confirmation of purchase. - The subscription automatically renews unless auto-renew is turned off at least 24 hours before the end of the current period. - Your account will be charged for renewal within 24 hours prior to the end of the current period, at the price displayed at the time of purchase. - You can manage your subscription and turn off auto-renew at any time by going to **Settings → [your name] → Subscriptions** on your iPhone or iPad after purchase. Cancellation takes effect at the end of the current billing period; the remainder of the period is not refunded by Apple unless required by law. - The 7-day free trial is offered only on the Yearly Premium plan and only to new subscribers who have not previously subscribed to App-Vault Premium. If you do not cancel at least 24 hours before the trial ends, the trial converts into a paid yearly subscription and your Apple ID will be charged for the first renewal period at the displayed yearly price. The unused portion of any free trial period is forfeited if you upgrade or cross-grade before the trial ends. - Prices may change in future versions of the app. Existing subscribers will be notified by Apple of any price increase in accordance with App Store policy and will be given the opportunity to confirm or cancel before the new price takes effect. - This page ([appvau.lt/terms](https://appvau.lt/terms/)) and our [privacy policy](https://appvau.lt/privacy/) are the functional links Apple requires before purchase and are linked from the paywall inside the app. ## 8. Refunds Apple processes all refund requests for App Store purchases. To request a refund, follow the instructions at [support.apple.com/en-us/HT204084](https://support.apple.com/en-us/HT204084). We do not have the ability to issue a refund directly and cannot reverse a charge Apple has processed. Statutory refund rights under applicable consumer law (for example, the EU 14-day right of withdrawal where it applies to digital content) are not affected by this clause. ## 9. Your data How App-Vault handles personal data is described in detail in our [privacy policy](https://appvau.lt/privacy/). The short version: vault contents stay on your device, encrypted with a key derived from your pattern; the app sends anonymous, content-free funnel events and crash diagnostics through Firebase; subscription receipts are validated through Apple and RevenueCat; we operate no account system and hold no name, email, phone number or payment data linked to you. You can request deletion of the anonymous identifiers held by our processors at [privacy@appvau.lt](mailto:privacy@appvau.lt). ## 10. Intellectual property App-Vault, including its source code, design, brand, name, icon, and the appvau.lt website, is owned by Vastflow and protected by copyright, trademark and other laws. You may use the marks only to refer to the app accurately in editorial or review contexts. Nothing in these terms grants you a licence to our trademarks or trade dress. ## 11. Updates, changes, and discontinuation We may release updates that change, add or remove features. Apple distributes updates through the App Store; you decide when to apply them, subject to compatibility with your iOS version. We may discontinue App-Vault, end-of-life specific features, or change pricing at our discretion. Where we can give reasonable notice of a material change, we will do so inside the app or on appvau.lt. ## 12. No warranty To the maximum extent permitted by law, App-Vault is provided **"as is" and "as available"**, without warranty of any kind, express, implied or statutory, including the implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the app will be uninterrupted, error-free, immune to attack, or that defects will be corrected. While the app uses well-understood cryptographic primitives (AES-256-GCM, PBKDF2, HKDF), no security system is absolute, and we cannot guarantee that the cryptography will not have a future-discovered flaw or that an attacker with novel capabilities will not find a path we did not anticipate. You use App-Vault at your own risk. ## 13. Limitation of liability To the maximum extent permitted by law, in no event will we be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, including damages for loss of data, loss of profits, business interruption, or unauthorized access, arising out of or in connection with your use of App-Vault, even if we have been advised of the possibility of such damages. Our total aggregate liability for any claim arising from these terms or from the use of App-Vault is limited to the greater of (a) the amount you paid to Apple for the app in the twelve months preceding the event giving rise to the claim, or (b) USD 50. Some jurisdictions do not allow the exclusion or limitation of certain damages; in those jurisdictions our liability is limited to the smallest extent permitted by law. ## 14. Indemnity You agree to indemnify and hold us, our directors, employees and agents harmless from any claim, demand, loss, or damages, including reasonable legal fees, made by a third party arising out of (i) your unlawful use of App-Vault, (ii) content you stored in the app in breach of section 4, or (iii) your breach of these terms. ## 15. Export controls and sanctions App-Vault uses standard, widely available cryptographic primitives. You agree to use the app in compliance with all applicable export-control and sanctions laws. You confirm that you are not located in a country subject to a comprehensive US, EU or UK embargo and that you are not on any restricted-parties list maintained by those governments. ## 16. Age App-Vault is rated 17+ on the App Store and is intended for adults. By using the app you confirm that you are of legal age in your jurisdiction to enter into a binding contract, or that a parent or legal guardian has reviewed and accepted these terms on your behalf. ## 17. Termination You may stop using App-Vault at any time by deleting the app from your device. We may suspend or terminate your access if you materially breach these terms, including the acceptable-use clause. Sections that by their nature should survive (intellectual property, no warranty, limitation of liability, indemnity, governing law) survive termination. ## 18. Governing law These terms are governed by the laws of the Republic of Kazakhstan, the seat of the publisher, without regard to its conflict-of-laws rules. Mandatory consumer-protection laws of your country of residence apply in addition to these terms where they grant you stronger rights. The United Nations Convention on Contracts for the International Sale of Goods does not apply. ## 19. Changes to these terms We may update these terms. When we do, the updated version is published at [appvau.lt/terms](https://appvau.lt/terms/) with a new effective date. Material changes will be announced inside the app on next launch. Continued use of App-Vault after the new effective date means you accept the revised terms. ## 20. Contact For legal questions about these terms, write to [legal@appvau.lt](mailto:legal@appvau.lt). For all other contact, see [appvau.lt/contact](https://appvau.lt/contact/). --- HTML version: https://appvau.lt/terms/ Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt Free to quote and reuse with a link back to the source URL above (CC BY 4.0).