Identify which devices and people can reach the cloud library; moving one local copy into a vault does not automatically revoke their access to a synchronized copy.
Determine whether the account or only an album is shared
Sharing an account can expose more than participating in a particular shared album. Review signed-in devices, recovery channels and library-sharing settings using the platform's current account tools. Do not assume that a private-looking folder is protected by a secret separate from the device or account authentication.
Google's Locked Folder documentation explains its device-lock boundary and optional backup. This is a useful example of why local hiding, authentication and remote availability should be checked separately.
Choose the desired destination
If you want a file to remain in a synchronized library, review that library's permissions. If you want a separate archive, plan an import and verify the retained copy before changing the original. Account for devices that may already have downloaded it. Your later deletion cannot guarantee recall of another person's saved copy.
If access changes could create a personal safety risk, consider their timing and obtain support before changing them. Technical access and safe timing are separate questions.
NullVault's relevant distinction
Account-free local use avoids a NullVault account for ordinary vault access, while encrypted backup has platform-specific requirements. Neither changes an unrelated cloud library by itself.
Read shared-library privacy risks, cloud sync versus backup, and the copy audit to decide what must change outside the vault.