Does a photo vault app with no ads still track you?

Why we measure, and why we tell you

York Vault has no ads, on any plan. We still pay for ads on TikTok, Meta and YouTube. We need to know which ones bring people to the app. That takes measurement. So this site says “no ads” and never claims that York Vault measures nothing.

Ads inside vault apps are a real worry. In the 836 App Store reviews we studied, 31 complain about ads. One user wrote that an app “flooded with adds” does not instil confidence that documents are safe. York Vault keeps ad code out of the app, with one exception: a single measurement partner.

One partner, not a stack of ad SDKs

York Vault uses one measurement partner with official links to TikTok, Meta and Google. It does not add a separate Meta or TikTok SDK unless the partner cannot cover that network. On iPhone, the partner starts only after your answer to the tracking prompt. It runs only in the main app.

What the partner receives

The partner can receive only these events:

• Install, and the number of each setup step you finish
• The lock type you chose
• A rough size range of the first scan result
• First item added and backup turned on
• Paywall shown, trial started, purchase, renewal, refund and cancellation

No event carries a file name, an exact count, an album name, a code or anything from your encrypted items. A schema test rejects any property that is not on this list.

How York Vault keeps the partner away from your library

We built six rules into the code. The security page lists them too:

1. The measurement code lives in a separate module. That module cannot load library code, and the build checks this.
2. Only events on the list above can leave the app.
3. No tap capture, no screen-view capture, no session replay and no capture of the screen layout.
4. No measurement code runs in the share extension, the camera, widgets or the App Clip.
5. The cover library and the main library send the same events. An erase code sends what a cover code sends.
6. Before each release, a test adds a file with a known name and records all network traffic. The release fails if that name, a code or the recovery key appears.

On iPhone: the Apple tracking prompt

Right after the welcome screen, York Vault explains the prompt on one plain screen. Then Apple shows its own prompt. Apple says: “If you choose Ask App Not to Track, the app developer can’t access the system advertising identifier (IDFA).” No York Vault feature depends on your answer.

York Vault also uses SKAdNetwork and AdAttributionKit. These Apple systems send an ad network a limited report. Apple sets the detail of each report so that each person stays anonymous in a crowd. Apple says AdAttributionKit “helps advertisers measure the success of ad campaigns while helping maintain user privacy.”

To change your answer later, go to Settings, then Privacy & Security, then Tracking.

On Android: install referrer and advertising ID

On Android, two tools do this job:

Tool	What it gives	What you control
Play Install Referrer	The link you came from and the time of the install	Nothing to turn on or off
Advertising ID	An ID for ads that Google Play services gives	Delete it in Android settings

Google calls the advertising ID “user-resettable, and user-deletable”. To delete it, go to Settings, then Privacy, then Ads, then Delete advertising ID. Apps then get a string of zeros. The same data rules apply on Android: the partner never sees your library.

Turn it off inside York Vault

In York Vault, go to Settings, then Privacy. You see three switches, each with one line about what it does:

• Ad measurement. On iPhone, it follows your iOS tracking setting.
• Usage analytics. Counts for setup and retention, from the same event list.
• Crash reports. York Vault removes paths and text from reports before it sends them.

When you turn a switch off, that tool stops at once. A button asks each vendor to delete the data for this device.

Labels that match the code

Apple asks developers to declare the data that “third-party partners” collect, including SDKs. The York Vault privacy label lists identifiers and usage data for ad measurement. It also states that York Vault does not collect your content. The privacy manifest declares tracking and the partner domains. Our privacy policy names every vendor. We check all three at each release.

For what we cannot see at all, read zero knowledge. For the full list in plain words, read what we can and cannot see.