Assume the device passcode is not private
On a genuinely shared phone, the screen lock is a convenience rather than a boundary between the people sharing it. Everyone who uses the device legitimately knows the code, and often the cloud account too.
That shared credential weakens controls that accept it, while biometric-only policies, separate accounts, and other platform controls can still matter. Evaluate the authentication policy of each control rather than assuming every device-level protection behaves the same way.
Separate profiles where the platform supports them
Some devices support multiple user profiles, which is the cleanest separation available because it partitions storage and accounts at the operating-system level rather than inside one app.
Where suitable profiles exist, they can separate storage and accounts. Platform and manufacturer support varies; ordinary personal iPad use does not provide general multi-user profiles. Where profiles are unavailable, use an app-level credential that is not the shared one.
Notifications defeat quiet arrangements
A carefully separated vault is undone by a notification preview showing its name, or an app-switcher snapshot showing its contents, on a device sitting on a shared table.
Review what appears on the lock screen and in previews, since these render without any unlock and are easy to forget when testing.
Setting it up
- List who legitimately knows the device passcode and the account credentials.
- Use separate operating-system profiles where the device supports them.
- Choose vault credentials unrelated to any shared code.
- Turn off notification previews for anything private.
- Keep backup recovery material under the control of whoever owns the content.
Arrangements that fail on a shared device
- Reusing the family device PIN as the vault credential.
- Syncing private exports into a shared photo account.
- Letting vault or album names appear in notifications.
When sharing is not voluntary
If the shared arrangement involves someone monitoring you rather than simply sharing a device, the technical advice above is insufficient and can be counterproductive — changed settings are themselves visible.
In that situation, prioritise a device the other person does not control, and consider seeking advice from a domestic-abuse support service familiar with technology-facilitated monitoring before changing anything.
A fictional example
Sofia starts with a non-sensitive test: “List who knows the device and account credentials.” Next, Sofia follows the second check: “Use separate operating-system profiles where the device supports them.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Reusing the family device PIN
- Syncing private exports into a shared photo account
- Showing vault names in notifications
What this workflow does not change
- Reusing the family device PIN
- Syncing private exports into a shared photo account
- Showing vault names in notifications
Questions people ask
Can iPhone create separate user profiles?
Ordinary personal iPhones do not offer general multi-user profiles like some Android devices.
Will one NullVault pattern reveal every vault?
On Android, each secure pattern opens its own vault and there is no visible master list.