FAQ
VaultShield FAQ: your photo vault questions, answered
The things people ask before they trust an app with their private photos, including the answers that aren’t in our favour.
Getting started
What VaultShield is and how it works day to day.
You add photos and videos from your library, or take photos with the in-app camera. VaultShield encrypts each file and keeps it in its own vault, separate from the Photos app. You open the vault with your pattern, and it locks again as soon as you leave the app.
See the photo vaultImporting makes an encrypted copy and leaves the original where it is. After importing, you can remove the originals from Photos in one step. iOS asks you to confirm, and they move to Recently Deleted, so empty that album too if you want them fully gone. Photos taken with the in-app camera never appear in your camera roll.
Clear out originalsNo. There's no sign-up, email or password. You set a pattern and start adding photos.
No accountYes. The vault never needs an internet connection. The only parts that go online are the built-in private browser, and iCloud backup if you turn it on.
Not yet. VaultShield is for iPhone, and it runs on iPad too.
Security and privacy
How your photos are protected, and what no app can protect against.
Your photos and videos are encrypted on your iPhone with XChaCha20-Poly1305 before they are stored. Your pattern is turned into a key with Argon2id, and the key is protected by your iPhone's Secure Enclave. No app is perfectly secure, so instead of slogans we explain exactly how it works.
How your vault is protectedThere is no VaultShield account and no VaultShield server holding your photos. Files are encrypted on your iPhone before they are stored. If you turn on iCloud backup, Apple stores an encrypted copy that can't be opened without your vault key.
Face ID can be added as an extra step, but it never replaces your pattern. Your pattern is always required to open the vault.
Pattern and Face IDThey'd still need your pattern. The vault key is tied to that iPhone's Secure Enclave, so the files can't be decrypted on another device, and guesses on the phone itself are slowed by Argon2id and growing waits.
Set a duress pattern. Draw it instead of your real one and a decoy vault opens like normal, while your real vault is permanently erased.
Duress patternRecovery and backup
Forgotten patterns, new iPhones, and what can and can't be brought back.
Use the 24-word recovery phrase you were shown when you set up the vault. It gets you back in, and then you choose a new pattern. Lost the phrase but still know your pattern? Open the vault and create a new phrase in Settings. If you lose both, nobody can open the vault, including us.
Recovery phraseDeleting the app deletes your vault from that iPhone. Your recovery phrase restores your key, not your files, so without a backup those photos can't be brought back. Turn on encrypted iCloud backup if you want a copy that survives.
Not with a normal iPhone transfer. Your vault is deliberately left out of device backups and its keys never leave your iPhone, so a new phone starts with an empty vault. To move it, turn on the optional encrypted iCloud backup, then restore on your new iPhone with your recovery phrase.
Encrypted iCloud backupNo. It's shown once and never stored, so there's no copy anywhere to send. That's also why nobody else can get it from us.
Features
What else the vault can do.
Yes. The vault holds photos, videos and documents like PDFs, all encrypted the same way.
DocumentsYes. Give any folder its own pattern, password or passcode. It stays shut even while the rest of your vault is open.
Locked foldersYes. Each vault has its own pattern and recovery phrase. There's no vault list: the pattern you draw opens the vault it belongs to.
Multiple vaultsYes. Swap the Home Screen icon for a look-alike, like a Calculator or a Level. Opening it still asks for your pattern.
Disguised app iconNo. It blocks well-known trackers and keeps your browsing off your iPhone, but websites can still see your IP address and your internet provider can still see the sites you visit.
Private browser