Are photo vault apps safe?

Almost every vault app puts “safe”, “secure” or “private” in its name. Few say what those words cover. This guide gives you six checks to run before you move a single photo into an app. Then it shows what we found for 8 apps on the US App Store. We checked every listing, rating and privacy label on 2026-10-02. Other facts come from the text and settings files inside each app package. User reports come from 836 App Store reviews of 7 of these apps.

What does “safe” mean for a photo vault app?

A vault app has two jobs, and it can fail at either one.

• Privacy. Nobody but you opens the photos. The risk is a person near you, a reset that someone else can use, or files that other apps can read.
• Keeping the photos. You can still open every item after a new phone, an update or a lapsed plan. The risk is a backup that never ran or a key that stayed on the old phone.

In our review study, 136 of 836 reviews report lost photos or videos. The triggers they name most are an app update (35), a new phone (28) and a reinstall (26). Lockouts come up in 26 reviews. Only 3 reviews call an email reset a back door. A vault that keeps photos private and then loses them has failed at its job.

The checklist

1. What does “encrypted” mean, and how can you check it?

Encryption turns a file into data that nobody can read without the key. What matters is the key: what makes it, and who else can use it. App listings describe this very differently.

• Keepsafe’s listing says “military-grade encryption”. Its help center names 256-bit AES.
• LockMyPix names “AES CTR”. Vaultaire names AES-256-GCM. Private Photo Vault’s app text names AES 256 bit.
• In the SPV and Calculator Lock packages we found no file encryption library. Privault’s listing says “encrypted storage” with no detail.

You cannot read an app’s code, but you can test what its claims imply:

• Does the listing or help center name the cipher and say where the key comes from? A name with no key detail tells you little.
• Does a forgotten code reset with no loss of files? If an email or a master code brings back every file, the key cannot come from your code alone. Someone else holds a way to make it.
• Does a code change take time? NQ Vault says a new passcode means it “needs to re-encrypt all photos and videos”. That suggests the code is part of the key.
• Are the files visible outside the app? Open the Files app, tap Browse, and look for a folder with the vault’s name. Calculator Lock exposes its documents folder to the Files app. Private Photo Vault and Privault expose theirs to file sharing on a computer.

2. Where do backups go, and are they encrypted?

A backup lives in one of three places. Some vault apps use their own servers: Keepsafe’s Private Cloud, Private Photo Vault’s Cloud Vault and NQ Vault’s Cloud Backup. Others use your own iCloud or Google Drive: Vaultaire, LockMyPix, Calculator Lock and SPV. Privault has no backup at all.

Ask four questions:

• How many items does the free plan back up? Keepsafe Basic backs up 200 items. Private Photo Vault’s listing says “The free version of the app does not backup your files to Cloud Vault”. Vaultaire backs up on its free plan, but that plan holds 100 photos and 10 videos in total.
• Is the backup encrypted before it leaves the phone? Vaultaire and Private Photo Vault both say they encrypt on the device with a key the company does not hold.
• Is there a status per item? Keepsafe marks each item that is “not backed up”. That is the right way to show it.
• Is it on by default? Vaultaire’s backup is. In most other apps you turn it on yourself.

Our guide to moving a photo vault to a new iPhone explains why Apple’s own iPhone backup is often not enough.

3. How do you get back in if you forget the code?

The apps we studied use four designs.

• Email reset. Keepsafe sends an access code to your account email after a delay of 15 minutes. NQ Vault, Privault and LockMyPix also reset by email. LockMyPix then shows your old password back to you, so it keeps the password in a form it can read.
• Your code in an email. Private Photo Vault offers to email you your PIN.
• Master code. Calculator Lock’s listing tells anyone to type “11223344=” and answer a security question.
• A phrase only you hold. Vaultaire gives you a recovery sentence. It has no email reset. If you lose the pattern and the phrase, nobody can open the vault.

Each design trades one risk for another. A reset that works through your email also works for anyone who can open that mailbox. A phrase only you hold has no back door and no way back if you lose it. Ask one question: who, besides me, can reset this?

4. What happens to your files if the subscription ends?

63 reviews in our study describe a paywall in front of files that were already in the vault. Users call it “hostage” and “extortion”. Check what each plan state does.

• Private Photo Vault. Its FAQ says photos in the app stay open after Premium ends, but “your Cloud Backup will be deleted”.
• NQ Vault. Its app text says Cloud Backup space drops to 1 GB when Premium expires.
• LockMyPix. The decoy vault stops opening when Premium lapses and asks you to reactivate Premium. A large backup can also hit a paywall on restore.
• Keepsafe. Trash recovery is a Premium feature. Before a downgrade to Basic, Keepsafe downloads your cloud files to the phone.
• SPV. The free plan caps exports at 5.

The question to ask: on the free plan, can I still view, export and restore every item I already added?

5. What does the App Store privacy label show?

Every listing has an App Privacy section. It can show three groups:

• Data Used to Track You. Apple defines tracking as linking app data with other companies’ data for targeted ads or ad measurement. Sharing data with a data broker also counts.
• Data Linked to You. Data tied to your identity, through an account, a device or other details.
• Data Not Linked to You. Data the developer says it collects without your identity.

Developers write these answers themselves, and each listing says Apple has not verified them. Here is what the 8 labels showed on 2026-10-02.

App	Data Used to Track You	Data Linked to You
Keepsafe	Usage Data	None listed
Private Photo Vault	Usage Data	Purchases, User Content, Identifiers, Usage Data, Diagnostics
LockMyPix	Identifiers	None listed
Vaultaire	None	Contact Info, User Content
NQ Vault	Identifiers	None listed
SPV	Identifiers, Usage Data, Diagnostics	None listed
Calculator Lock	Identifiers	None listed
Privault	Usage Data	Usage Data

7 of the 8 list data used to track you. A tracking entry does not mean the app reads your photos. It means the app may join data about you or your device with data from other companies for ads. Labels can also leave things out. Keepsafe lists no Data Linked to You, while its sign-up asks for an email address.

6. What happens if you delete the app?

Apple’s iPhone User Guide says “Deleting an app removes it and its data from your iPhone.” Data the app stored in iCloud stays. Offload App, in iPhone Storage, frees the app’s space but keeps its documents and data.

So a vault without a finished backup loses every item when you delete it. SPV’s listing says so. So do Privault’s app text and Calculator Lock’s listing. Keepsafe’s app text says “Only backed up files are safe during reinstalls.” Never delete a vault app to get past a forgotten code. Private Photo Vault’s FAQ gives the same warning.

The 8 apps side by side

Encryption and recovery come from each listing, help center and our teardown of each app package. Labels are from the table above.

App	Encryption claim	Backup	Forgot the code	Tracking on label
Keepsafe	256-bit AES	Own cloud, 200 items free	Email access code	Yes
Private Photo Vault	AES 256, cloud password	Own cloud, paid	PIN by email	Yes
LockMyPix	AES CTR	Backup file. iCloud is paid	Email shows your password	Yes
Vaultaire	AES-256-GCM	Your iCloud, free, on by default	Recovery phrase	No
NQ Vault	“Space encryption”	Own cloud, Premium	Security email	Yes
SPV	None found	Google Drive, paid	Recovery email	Yes
Calculator Lock	None found	iCloud or Google Drive, tier not stated	Master code	Yes
Privault	“Encrypted storage”	None	Email pincode	Yes

Where each app does well

Each app does at least one thing right.

• Keepsafe shows a “not backed up” badge on each item and a filter that lists them. See the Keepsafe alternative page.
• Private Photo Vault encrypts Cloud Vault with a password the company does not keep. 13 reviews praise years of use or iPhone and iPad together. See the Private Photo Vault alternative page.
• LockMyPix has a Trash with restore, keeps Live Photos, and makes an encrypted backup file you can move yourself.
• Vaultaire backs up for free, needs no account, and ships no ad SDK.
• NQ Vault re-encrypts every file when you change the passcode and keeps its files out of the Files app.
• SPV has a fake passcode and a face-down switch to another app.
• Calculator Lock has a calculator that works, plus iCloud or Google Drive backup.
• Privault plays many video formats and has a code that erases the vault.

For scores across all criteria, see the best photo vault apps for iPhone. For how these apps work in general, see what is a photo vault.

Test an app before you trust it

Run this test with photos you also keep somewhere else.

1. Add 20 photos and 1 long video to the vault.
2. Turn on the app’s backup and wait until it shows every item backed up.
3. Delete the app, then install it again and restore.
4. Count what comes back, and play the video to the end.
5. Try the forgotten-code path, so you know who else can use it.

If any step fails, the app failed the test. Apple’s free Hidden album stays in your normal library and backup, so it may be the safer choice against loss.

How York Vault answers these checks

York Vault is our own app, so we did not score it with the other apps on this page. It is on the App Store for iPhone and iPad and on Google Play for Android. It encrypts each item on your phone, and on iPhone it keeps nothing in the Files app or Finder. On the Free plan, it backs up every item, encrypted, to your own iCloud, or your own Google Drive on Android. See encrypted backup. With Pro, York Cloud can hold the encrypted backup instead, and we hold no key to it. You get a 12-word recovery key, with no email reset and no master code. See recovery key. An optional recovery through your Apple Account or Google account lets you set a new code after a 72-hour wait. The right code cancels it on any of your devices. Viewing, export and restore of your items stay free on every plan, as the pricing page states. It shows no ads. It does measure its own ad campaigns. Its App Store privacy label and Google Play data safety section list that ad measurement data. Download York Vault on the App Store or Google Play.