About Vaultaire
An encrypted photo vault for iPhone, built and run by one person.
Vaultaire is an iPhone and iPad app that keeps photos, videos and documents in vaults encrypted on the device with AES-256-GCM. A pattern you draw opens each vault. There is no Vaultaire account to create, and the free version holds up to 3 vaults with 100 photos and 10 videos in total. The app is published by Wraxle LLC and distributed only through the App Store.
This page covers who makes it, why it exists, and how it is built. The security architecture page covers what the encryption does and does not protect.
Who makes it
My name is Rasty Turek and I'm the person behind Vaultaire. No team, no investors, no advisory board.
One engineer, one codebase, one set of architectural decisions that answer to nobody except the people who use this app. That's the whole org chart.
Why one person matters
When you build a privacy tool with a team, you create a surface area problem. Every engineer who touches the codebase has access to the architecture. Every investor who funds the company has an opinion about monetization. Every board member has a fiduciary duty that might conflict with your right to keep your files private.
Vaultaire is built and operated by one person. The app has no Vaultaire account service and no provider-held vault decryption key. Its security architecture uses AES-256-GCM, PBKDF2-HMAC-SHA512, iOS Keychain, and client-side encrypted CloudKit records. That provider boundary limits what the company can disclose, while the shipped client, iOS, the device, and the implementation remain part of the trust model.
Background
I started my career as an engineer at Google. After that, I built a few companies — each one focused on scale, data infrastructure, and systems that handle millions of users. Security was always a thread running through that work. When you operate at scale, you learn fast that the architecture either protects people by default or it doesn't protect them at all.
Along the way I built companies in the security and content-attribution space, working on problems where data integrity and access control aren't features — they're the product. That background shaped how I think about encryption, key management, and what it means for software to be genuinely zero-knowledge.
More recently I've been focused on AI tooling — agents, eval systems, and developer workflows across iOS, macOS, and the web. The common thread is the same: build things that ship real value without requiring people to hand over their data to use them.
Why I built it
Vaultaire is where my security background and my interest in cryptographic design meet. I wanted to build an encrypted vault that does what most vault apps only pretend to do — actually encrypt your files, not just hide them behind a PIN screen. A pattern you draw derives the vault key that authenticates the encrypted index and unwraps a separate random master key for AES-256-GCM file encryption. I do not operate a service that receives your readable vault contents or decryption keys, so I cannot retrieve them for you or disclose a provider-held copy.
The duress vault — where drawing a specific pattern under coercion silently removes the indexes, storage files and recovery mappings of your other vaults — exists because I thought about the people who need this most. Journalists, activists, abuse survivors, travelers crossing hostile borders. These aren't theoretical users. They're why Vaultaire separates what the ordinary interface reveals from what encrypted app-container storage may still expose to a forensic examiner.
How I build
I obsess over the details most people skip. Binary size, because bloat is a signal of carelessness. Typography, because visual precision reflects engineering precision. Context efficiency, because building with AI means every wasted token is a wasted decision.
I'm wrong a lot, and I prefer it that way — being wrong quickly is how you converge on something worth shipping.
Vaultaire has no advertising SDK and requires no identity account. App analytics, crash diagnostics, and Apple Ads attribution are enabled by default and can be turned off with “Share errors anonymously” in Settings. When enabled, these flows use pseudonymous identifiers and coarse product events. They exclude vault contents, patterns, recovery phrases, share IDs, and raw vault IDs. Crash reports can include file names, and each vault carries a stable hashed reference.
If something is broken, use the support form. I read everything.