# Are photo vault apps safe? What to check before you trust one

> A photo vault app is only as safe as its design. Check how it protects files, what unlocks it, what it collects, and what happens if you forget your secret.

Source: https://vault9app.com/guides/are-photo-vault-apps-safe/
Updated: 2026-11-12

Some are, and the App Store page often does not tell you which ones. A vault app is safe when it encrypts your files, keeps the key on your phone, and collects little about you. You can check most of this before you add one photo.

## Does it encrypt, or does it only lock?

This is the most important question. A lock screen decides who can open the app. Encryption (each file scrambled with a key) decides whether the stored files can be read at all.

Read the App Store description and the privacy policy, and look for a named method, such as AES-256-GCM. A PIN, a password or Face ID tells you how the app opens. It tells you nothing about how the files are stored. Our advice: if an app does not name its encryption, treat it as a lock screen.

## Does your iPhone passcode open it?

If it does, everyone who knows your passcode can open the vault. That may be the exact person you want to keep out.

Then ask where the key comes from. If it comes only from a short PIN, the PIN is the weak spot. A 4-digit PIN has 10,000 combinations.

Vault9 opens with a pattern or passphrase of your own plus a Secret Key, or Face ID if you turn it on. Your iPhone passcode does not open it. [Vault9 on the App Store](https://apps.apple.com/app/id6830759639?pt=129716075&ct=are-photo-vault-apps-safe-md)

## What does it collect about you?

Every App Store page has an App Privacy section. It lists the data types that the developer says the app collects, and whether that data is linked to you or used to track you. The developer fills it in, so read the privacy policy too. Also check if the app needs an account.

## What happens if you forget your secret?

Here you choose between two costs. Some apps can reset your lock. Then ask how they do it, because whoever can reset the lock may also have a way to your files. Other apps cannot reset anything. Then a forgotten secret can mean lost photos, so look at what recovery material you get.

We chose the second kind. Vault9 cannot reset your pattern or passphrase, and we cannot open your vault for you. If you forget your pattern and did not write it on your [Emergency Kit](https://vault9app.com/emergency-kit/), the vault is lost. We think this is the right trade for a vault, but it is a trade.

## Where do the copies go?

If the app makes a backup or a cloud copy, ask 3 things: where it goes, whether it is encrypted, and who holds the key.

## Our answers, weak spots included

Vault9 encrypts each file on the iPhone with AES-256-GCM before it stores it. Each file has its own key.

There is no Vault9 account and there are no Vault9 servers. We never receive your photos or your keys. The app does send usage statistics to PostHog EU, and this is on by default. You can turn it off in **Settings**, **Privacy**, **Share usage statistics**.

The iCloud backup is the only copy of the vault outside the iPhone. It goes to your own iCloud storage and never contains the Secret Key. See [what the iCloud backup does](https://vault9app.com/features/icloud-backup/).

Vault9 does not protect a vault that is open on an unlocked phone, and it does not protect against malware on the phone. No independent security audit has happened yet.

## Sources

- [Apple Support: About privacy information on the App Store](https://support.apple.com/en-us/102399) (checked 2026-11-06)
- [Apple Developer: App privacy details on the App Store](https://developer.apple.com/app-store/app-privacy-details/) (checked 2026-11-06)