Security

My Vault never reaches a server

My Vault files stay in this device's app folder. The code that handles those files contains no network calls at all. It isn't an upload setting you turn off — there is no path up.

The key never leaves the device

The vault key is stored in the iOS Keychain as ThisDeviceOnly. Items marked this way are excluded from every backup and never migrate to another device. Apple guarantees that property; it isn't something we can switch off.

What goes into a backup

An iCloud device backup does include the vault's ciphertext. The key does not, for the reason above. So restoring a backup onto a new device shows the items but cannot open them. Not by us, and not by Apple.

Put plainly: lose the device and you lose the vault. That is the design, not a side effect. A vault that can be restored isn't a vault.

The couple vault uses a server. Can the server see it?

No. Everything is encrypted on the device before it goes up, and the key that opens it exists only on the two phones. The key exchange happens between those two devices when the invite code is used. The server moves and stores ciphertext.

If you forget the passcode

There is no recovery. The 6-digit passcode is the only way into the decryption key, and we hold neither. No reset email, no support unlock.

What we do see

App and device version, how many items failed and the reason code, and a crash record. No photos, no file names, no capture information. Diagnostics can be turned off in Settings, and the app shows you exactly what would be sent.

Activity log

In the couple vault, who opened what is visible to the two of you and clears after 90 days. The private vault is never logged.