You keep some photos apart from your camera roll: a surprise gift, a medical record, a document scan, a personal moment that is not for whoever borrows your phone. You do not want another account, a cloud service that holds your files, or an app that announces what it is. You want a private place on your iPhone that behaves the way it says it does, and you want to know the mechanism rather than take a promise.
What is hard right now
- I hid photos in the Hidden album, but anyone who opens Photos and knows where to look can find it.
- Every 'private' app wants an email address and an account before it will store a single picture. I do not want my photos tied to an identity.
- I cannot tell what the app does with my files. I want to know where they are stored, what encrypts them and whether anything leaves the phone.
- If someone makes me open the app, I do not want it to show a list of vaults that proves more exists than they have seen.
- I am afraid of locking myself out and having no way back in.
Scenarios
A gift you are hiding for a few weeks
You photograph a surprise gift or a planned trip itinerary. You do not want it surfacing on a shared family iPad or in Photos suggestions.
You capture with the in-app secure camera, so the image goes straight into the vault instead of passing through the camera roll first. Each file is sealed with AES-256-GCM, using a fresh random nonce and its own authentication tag.
To open the vault, you draw your pattern. The pattern is never written to disk, not to a file and not to the Keychain. There is no separate passphrase. The pattern is the only credential.
Keeping personal documents apart from the camera roll
You scan a medical letter, an ID or a contract. You keep these in one vault and your personal photos in another.
The free tier gives you up to 3 vaults and up to 50 files per vault. More vaults and folders are part of Pro.
Each vault has its own 12-word recovery phrase. Write it down. If both the pattern and the phrase are lost, the vault cannot be opened: we do not hold a copy, and there is no support process that can override this.
Someone borrows your phone
A friend or relative asks to see your photos and picks up your unlocked phone.
An unrecognised pattern opens a fresh empty vault rather than showing an error. The app keeps no vault list, no switcher and no count, so there is nothing on screen that points to a second vault.
One limit, stated plainly: We make no claim about what an examiner with the physical device could or could not determine.
Backing up without handing over your files
You want a copy in case the phone is lost. There is no Weave Vault storage server. Encrypted backup copies the vault's ciphertext to your own iCloud. No vault key and no plaintext leaves the device.
Enabling backup requires Pro. Restoring never does. Browsing and exporting your own files also work without a subscription, including if Pro lapses.
Nothing is uploaded by default. Weave Vault is excluded from the phone's ordinary device backup by design, so a routine iCloud or Finder backup of the phone never contains the app's data.
Features that make this work
Pattern unlock
The pattern is the only credential. It goes through Argon2id (t=3, m=64 MiB, p=1, 128-bit salt) to a key-encryption key that wraps a random 256-bit per-vault content key. There is no separate passphrase, and the pattern is never written to disk.
Multiple vaults
Keep personal photos, documents and surprises in separate vaults, each with its own pattern and 12-word recovery phrase. Free covers up to 3 vaults and 50 files per vault. An unrecognised pattern opens a fresh empty vault, and the app keeps no vault list.
Secure camera
Capture directly into the vault so the photo never has to pass through the camera roll first.
Encrypted backup
A copy of the vault's ciphertext goes to your own iCloud, with no account on our side. Enabling backup requires Pro. Restoring never does, and browsing and exporting your own files work without a subscription, including if Pro lapses.