The publisher cannot read your data because the publisher does not have your data.

What AppVault literally cannot know

A zero-knowledge product is best defined by the list of things it cannot do — because each item is a thing it has thrown away on purpose, in exchange for the guarantee that no one can use it against the user later.

AppVault literally cannot:

• Identify who you are. There is no account, email, phone number, or device identifier we collect or correlate.
• Count your files. The catalog inside the vault is encrypted alongside the files; without your pattern, we cannot see whether your vault holds one file or one thousand.
• See file types. Photo, video, document — without the catalog, every file looks like a stream of random bytes the same way every other file does.
• Detect when you used the app. The app makes no network call by default. Even Apple’s App Store install counts are aggregated and not tied to individuals.
• Recover your pattern. The pattern is never written to disk in any form. PBKDF2 derivation happens in memory and the output is wrapped by the Secure Enclave; nothing about the original input survives the next garbage collection cycle.
• Reset your vault on request. There is no support ticket that can unlock a vault. We do not run an admin tool. There is no override.

What we accept in exchange

Zero-knowledge has a real cost. Every "could we just..." moment that the marketing department of a conventional app would happily accept — automatic backup to our cloud, password reset by email, "tap here to recover", concierge support that can move your vault to a new phone — is a moment that zero-knowledge says no to.

We accept this cost because every photo-vault breach since 2014 has happened in exactly those moments. A password reset flow leaks. An account database leaks. A "trusted backup" turns out to have been less encrypted than the marketing copy implied. The only honest answer is to not have the surface at all.

So AppVault has the inconvenient features of being inconvenient: forget the pattern and the vault stays sealed. Lose the phone and the recovery passphrase, both, and the vault is gone. We say this in onboarding, in the App Store description, and on this page, because anyone who tells you a vault is both unrecoverable-by-attackers and recoverable-by-support is lying about one of those two claims.

How zero-knowledge differs from end-to-end encryption

The two terms are often used interchangeably and they should not be. End-to-end encryption (E2EE) is a property of a communication channel: messages sent between Alice and Bob are encrypted such that the relay carrying them — WhatsApp, Signal, iMessage — cannot read them. E2EE makes a statement about what the middle of the pipe cannot see.

Zero-knowledge is a stronger statement about the endpoint provider itself. A messaging app can be perfectly end-to-end encrypted and still hold the metadata that says you exchange messages with a specific contact 27 times a day at predictable hours. The content is private; the relationship is not. Zero-knowledge throws out the metadata too.

For a photo vault, this distinction matters because metadata leakage from a non-zero-knowledge vault — "this user has 1,247 photos uploaded, accessing the app daily from 22:00 to 22:15" — is enough to identify the user and produce a credible blackmail or coercion case even without ever cracking the cipher.

Other tools that operate this way

Zero-knowledge is a niche stance even within the privacy space, but a few well-known tools share it in spirit:

• Signal — the messaging app. Zero-knowledge for message content; their sealed-sender protocol pushes further into zero-knowledge for metadata than any other major messenger.
• Bitwarden (self-hosted) — the password manager. End-to-end encrypted by default and zero-knowledge when self-hosted on your own infrastructure.
• ProtonMail — zero-knowledge for message content, though Proton holds enough metadata for spam filtering and abuse handling.
• Standard Notes — the encrypted note-taking app. Strict zero-knowledge for note content.

AppVault’s zero-knowledge is closer in spirit to Standard Notes than to Signal — there is no relay, only a local vault, so the contact-graph problem does not arise at all.

How to verify the claim

Zero-knowledge is a claim about absence, which is famously hard to prove. The credible way to verify it is to look for evidence that absence would leave behind.

• Install AppVault, enable airplane mode, and use every feature. Everything except the optional iCloud backup works. There are no failed network calls in iOS Console because none are attempted.
• Run a packet inspector (Charles Proxy, Little Snitch, Apple’s built-in network logging) against AppVault. You will see zero outbound traffic. Most apps light up like a Christmas tree in this view; AppVault stays dark.
• Inspect the app’s privacy nutrition label on the App Store. AppVault’s declares no data collected of any category — Apple verifies this label and will reject the app if it does collect undeclared data.
• Read the cryptography stack on the Security page. Every claim links to a primary source you can check yourself.

The combination — no network traffic, no privacy-label data collection, no account, audited reference cryptography — is what makes zero-knowledge a structural property rather than a marketing claim.