A decoy vault is a separate private space containing selected material that can be opened without displaying the contents of another vault.
An ordinary space with a deliberate purpose
A decoy can contain harmless photos or documents you are comfortable showing. Its usefulness comes from compartmentalization: opening one space need not reveal the contents of another. The material is still real content, and access to it should be treated as access to that particular vault.
Do not assume that the existence of a decoy prevents suspicion. Someone may know that other files existed, have access to a cloud copy, or inspect storage outside the normal interface. A decoy does not control those sources of information.
Decoy does not mean duress
An ordinary decoy is not, by definition, a deletion trigger. A duress vault adds separate behavior with potentially irreversible consequences. When assessing an app, read the exact configuration and verify whether opening a chosen pattern merely opens content or also affects other vaults.
In NullVault
NullVault supports independently addressed spaces and documents decoy vault behavior separately from duress. Learn with non-sensitive test content and keep recovery and backup arrangements outside the device before depending on multiple vaults.
A useful personal check is to lock the app, reopen only the intended space, and verify which items are visible. That verifies the interface you used; it does not establish what a forensic examination could discover. The security limitations and private-photo threat model explain the remaining risks.