Security FAQ

How is my media encrypted?

Media is encrypted on your device with AES-256; SQLCipher protects vault metadata. Authorized operations may temporarily hold decrypted data in memory or caches. Automatic lock gates the UI; Quick Lock cancels work and starts hard-lock cleanup. Neither guarantees forensic erasure or zeroing every managed-memory copy.

How does my passcode unlock the vault?

StealthVault uses a two-key design. A random data key protects your media. Your passcode derives a separate key that wraps that data key; changing the passcode does not require re-encrypting every media file. Optional recovery credentials and device transfers follow their own explicit authorization flows.

When you unlock, your passcode reconstructs the wrapping key, which unlocks the data key, which decrypts your media. Your passcode itself is never stored anywhere — not on the device, not in the cloud.

Does changing my passcode re-encrypt all my files?

No. Changing the PIN re-wraps the vault key rather than re-encrypting every media file. The operation still needs to complete successfully; keep a separate recovery secret and backup.

What happens if I forget my passcode?

A separately enrolled and confirmed recovery phrase or legacy recovery key can replace a forgotten PIN. We cannot recover the vault for you: there is no developer-held secret or backdoor. Losing both PIN and recovery secret makes that vault unrecoverable. Restoring a subscription does not restore your files.

Is biometric unlock (Face ID / fingerprint) safe?

Biometric unlocking uses an operating-system check and OS-protected credential storage. The protection available depends on the device and its configuration. StealthVault does not receive biometric templates; biometrics are not a substitute for keeping your recovery secret safe.

Is anything sent to the cloud?

The app has no hosted vault service, but it is not network-free. Websites receive browsing requests; advertising, subscription, and crash-reporting SDKs process their respective data. An encrypted backup provider you choose may be cloud-backed. Paired sync and the optional local HTTP portal are separate features; HTTP portal traffic is not encrypted transport and needs a trusted network.

Do the ads track me?

The free tier uses banner and optional rewarded ads configured as non-personalized. Advertising/device identifiers and related data may still be processed; this is not a promise of anonymity. SDK consent permission gates ad requests, with privacy options when required. A paid subscription removes ads. See the Privacy Policy for advertising, diagnostic, and subscription processing.

What is the decoy vault?

A decoy vault has its own PIN, independent keys, and content. Entering its PIN opens that vault rather than the real vault. It is not a guarantee against coercion or forensic inspection. If you explicitly enable security video/audio recording, recording in decoy mode has a visible active indicator.

Does the browser save my history or login?

No automatic browsing history is saved. Deliberate bookmarks stay encrypted. Keep me logged in optionally retains only listed websites' cookies and their subdomains in the current encrypted vault across Quick Lock, not other site data. Saved cookies are excluded from backup and device sync; remove a site or clear cookies to delete them. Login retention is best-effort, including conservative iOS SameSite handling.

What can an attacker see if they steal my phone?

Vault files are encrypted at rest and failed unlock attempts are rate-limited. An unlocked vault, previously authorized background work, temporary caches, and managed memory have different exposure than encrypted files. Device lock and a strong, separate vault PIN add protection, but the app does not promise forensic erasure.

For the strongest protection against someone who can compel you to open the phone, we recommend:

Use a different passcode for your real vault than the one that unlocks your device — so device access never reveals the vault.
Set up a decoy vault with its own "easy" PIN. When you enable a decoy you choose which vault biometrics open — for the strongest protection, point Face ID / fingerprint at the decoy (you can change this later in settings).
Keep your real vault on a passcode you only enter manually — don't point biometrics at it — so it can't be opened by a glance at your face or a forced fingerprint.

Do you have access to my files?

We have no hosted vault copy or developer-held recovery key. Websites, providers, and third-party SDKs still process their respective data as described in the Privacy Policy. Keep your recovery secret private and retain an external encrypted backup if you need recovery after uninstall.

See our Privacy Policy and Terms. Questions? Email [email protected].