Follow the photo through its lifecycle

Before import

The source app can see the original. Apple Photos, a cloud library, Files, a scanner, a messaging app, or a camera may already hold copies, thumbnails, metadata, or backups. A vault cannot retroactively control those locations.

During import

The operating system and vault app process plaintext long enough to read and encrypt it. A compromised device, malicious accessibility service, injected code, or untrusted screen recording could observe this stage. Use a current, trusted device and import away from other people and cameras.

While the vault is locked

The app-managed payload should be ciphertext. The device and storage provider may still observe that an app and files exist, approximate sizes, timestamps, account identifiers, or network activity. Encryption protects content, not every piece of operational metadata.

During encrypted backup

The backup provider can store and transmit encrypted records without necessarily having the application's decryption key. It still runs the account and infrastructure. Review how encrypted photo backups work for the difference between payload and service metadata.

While unlocked

The authorized app must decrypt enough content to display it. The person holding the unlocked device, the screen, and the running process can see plaintext. Automatic locking reduces the exposure window; it does not protect a photo that is currently visible.

After export or sharing

An export is a new plaintext copy unless a separate protected format is used. The receiving app, its cloud provider, the recipient, and any backups or previews it creates may see the content. A recipient can retain or photograph media even if access later expires.

Can photo vault developers see your photos?

That depends on the key design. If the provider holds or can reset a key that directly reveals content, it has a technical path to plaintext. If encryption and recovery depend on secrets that remain with the user, the provider may be unable to decrypt the application payload.

NullVault is designed so support does not know a vault pattern or recovery phrase and cannot bypass them. This privacy boundary creates a recovery consequence: support cannot restore access after the required secrets and usable backups are gone.

Can the platform provider see it?

The device platform controls the operating system, security services, software delivery, and parts of the account environment. NullVault keeps its managed vault content in encrypted private app storage, but this does not make a compromised platform trustworthy or remove store-account and device metadata.

Avoid absolute claims about what a platform vendor “can never” access. Your security also depends on the operating system, device integrity, account state, backup configuration, and absence of compelled or malicious software changes.

Can law enforcement, an employer, or a family member see it?

Their access depends on device possession, credentials, account control, installed management software, backups, legal authority, and whether the vault is unlocked. Encryption can make stored payloads unreadable without a key, but it is not legal advice, protection against coercion, or a guarantee against endpoint compromise.

Reduce the number of viewers

  • Remove unnecessary source and exported copies only after verification.
  • Use a strong, private vault pattern and short automatic lock.
  • Keep recovery secrets offline and separate.
  • Maintain device updates and review management profiles.
  • Unlock only in a trusted physical environment.
  • Share the minimum necessary item with the minimum necessary metadata.

For the underlying design, read how encrypted photo vaults work and security limitations.

Guide reviewed: 12 September 2026.