The short version. Everything you put in Vaultie stays on your phone, and it is encrypted before it is saved. There is no account and there are no servers. Vaultie has no analytics, ads, tracking or crash reporting, and the app makes no network requests. We (Workaholic Developers) never receive your files or any data about you, and we can’t open your vault.
Who we are
Vaultie: Private Photo Vault (“Vaultie”, “the app”) is made by Workaholic Developers (“we”, “us”). For any privacy question, email info@workaholicdevelopers.com.
What we collect: nothing
- We don’t collect, store, sell or share personal data. Vaultie has no servers, so there is nothing to collect it with.
- There is no sign-up and no account.
- The app contains no analytics, advertising, tracking or crash-reporting code, and release builds don’t write logs about you or your files.
- The app makes no network requests. The Android app doesn’t even hold the Internet permission.
Your vault stays on your phone, encrypted
- Everything you add (photos, videos, documents, notes and 2-step login accounts) is encrypted on your phone before it is written to storage, and so are file names, dates, thumbnails and albums. Each file is encrypted with AES-256-GCM under its own random key.
- Opening the vault needs your PIN or passphrase together with a secret held by your phone’s secure hardware (the Secure Enclave on iPhone, the Android Keystore on Android). That secret never leaves the phone, so a copy of the vault’s files can’t be opened anywhere else.
- Your recovery key is created on your phone and shown to you once, when you set up the vault. We never see it and nobody keeps a copy.
- Nobody else holds your keys, including us. If you lose both your PIN and your recovery key, we can’t recover your vault, and nobody else can either.
- While you add or view an item, Vaultie briefly keeps an unencrypted working copy in memory or in its own private temporary folder (for example while a video plays). These copies never leave the app’s private storage, and they are deleted as soon as they’re no longer needed, whenever the vault locks and every time the app starts.
- Vault files are excluded from device backups (iCloud Backup, Google backups and computer backups) on purpose: those copies couldn’t be opened without your phone’s secure hardware anyway. To move to a new phone, use an encrypted Vaultie backup (see “Backups” below).
Permissions and why Vaultie asks for them
Vaultie asks for a permission only when you first use the feature that needs it, and everything else keeps working if you say no.
| Permission | Why Vaultie uses it |
|---|---|
| Camera | The private camera, which saves photos and videos straight into the vault and never to your gallery. Scanning the QR code when you add a 2-step login account: the picture is read on your phone and never saved. Break-in photos, only if you turn on break-in alerts. |
| Microphone | Sound for videos you record with the private camera. |
| Photos | Importing uses your phone’s photo picker, which needs no access: Vaultie only receives the items you pick. Full photo library access is requested only if you choose to delete the originals from your gallery after importing them. On iPhone, add-only access is requested when you save an item back to Photos. On Android 8 and 9, saving an item to your gallery uses the storage permission. |
| Face ID, Touch ID or fingerprint | Optional unlock. Your phone’s operating system checks your face or fingerprint and only tells Vaultie whether it matched. Vaultie never receives biometric data. |
| Files | Vaultie opens only the files you choose in your phone’s file picker, and saves backups and exports only where you choose. |
| Motion sensor | Only if you turn on quick lock: to notice that the phone is lying face-down, so the vault can lock. The readings are used on the spot and never stored. |
You can change or withdraw any of these at any time in your phone’s Settings.
Break-in alerts
Break-in alerts are off until you turn them on. When they’re on, after the number of wrong PIN attempts you choose, the front camera takes one photo (your phone shows its usual camera indicator). The photo and the time are encrypted straight away and stored on your phone only. You see them the next time you unlock with your real PIN. They are never uploaded or sent anywhere, and they never appear in a decoy vault.
2-step login codes
From version 1.1, Vaultie can make the one-time codes that sites ask for when you sign in with 2-step login (also called two-factor authentication).
- The secret key of each account is kept inside your encrypted vault, like your notes, and is included in your encrypted backups. It never leaves your phone otherwise.
- Codes are made on your phone, without any network connection. Vaultie doesn’t contact the sites the codes are for, and it doesn’t download their logos (accounts show a letter instead).
- QR codes are read on your phone, from the camera or from a photo you pick. The picture is not saved.
- When you copy a code, it is removed from the clipboard after a minute. On iPhone the copy stays on this phone and isn’t passed to your other Apple devices.
- Showing an account’s QR code or key, to move it to another phone, needs your Face ID, fingerprint or PIN.
Backups
Encrypted backups (.vaultie files) are made only when you ask for one. Each backup is encrypted with a backup password that you choose, and it goes only where you save it through your phone’s own save sheet (for example Files, iCloud Drive, Google Drive or a computer). Vaultie never uploads a backup itself. If you save one to a cloud service, that service stores the encrypted file under its own terms and can’t read it without your backup password. We can’t recover a forgotten backup password.
Sharing into Vaultie
On iPhone, the “Save to Vaultie” share extension encrypts what you share right away, on your phone, even while the vault is locked; it joins your vault the next time you unlock. On Android, sharing to Vaultie opens the app, and the items are imported after you unlock.
Taking things out of Vaultie
When you export or share an item, Vaultie warns you first: the copy you send to Photos, Files or another app leaves the vault and is no longer protected by Vaultie. When you choose to delete originals from your gallery after importing them, your phone asks you to confirm, and deleted items may stay in your gallery’s Recently Deleted or trash for up to 30 days, where you can remove them for good.
Widgets and controls
Widgets and controls never show your photos, videos, notes or file names. At most they show how many items your vault holds (you can hide this, and it is always hidden when a decoy PIN exists) and the date of your last backup. Their buttons open Vaultie, which asks you to unlock first.
Deleting your data
Deleting the app, or using “Erase vault” in Vaultie’s settings, permanently deletes your vault and everything in it from your phone. Backups you saved elsewhere stay where you put them until you delete them.
Links
Links to our website, the app stores, email or other Workaholic Developers apps open in your browser or mail app. Those sites and services have their own privacy policies.
This website
vaultie.wdlab.app has no cookies, no scripts, no analytics and no ads, and loads nothing from other sites. Like any web server, it keeps standard access logs (IP address, browser user agent, page requested and time) for security and troubleshooting. They are deleted automatically after about 14 days.
Children
Vaultie is not directed at children under 13. Because the app collects no personal data from anyone, it collects none from children.
Your choices
- You can change or withdraw Camera, Microphone, Photos and Face ID or fingerprint access at any time in your phone’s Settings.
- To remove everything Vaultie stored, use “Erase vault” or delete the app.
- We hold no personal data about you, so there is nothing for us to access, correct, export or delete. You are still welcome to ask us anything.
Changes to this policy
If this policy changes, we will update this page and the effective date above. If the app ever handles data differently (which would need an app update), we will explain it here before that update is released.
Contact
Workaholic Developers · info@workaholicdevelopers.com