Vaultaire vs Secret Photo Album

Feature Comparison

Secret Photo Album by Wai Lun Kit has 39K ratings and a 4.5-star average. Here is how it compares to Vaultaire across 17 security and privacy features.

Pricing Comparison

Passcode vs Encryption

Secret Photo Album protects your files with a passcode screen. Enter the correct code and the app displays your photos. This is access control, not encryption. The distinction matters: access control decides who can use the app, while encryption transforms the data itself into an unreadable format. If someone bypasses the app -- through a backup, file browser, or forensic tool -- access control is irrelevant because the files were never transformed.

Vaultaire encrypts each file using AES-256-GCM. The pattern is input to PBKDF2-HMAC-SHA512, which derives a vault key from the pattern and a device-wide salt. That key authenticates the encrypted index and unwraps a random master key used for file content and metadata. Copied app storage contains ciphertext, while an unlocked or compromised device remains inside the trust boundary.

File Accessibility Concerns

Because Secret Photo Album stores files in their original format, they are accessible through multiple vectors outside the app. Connect the device to a computer and browse the file system. Create an iTunes or Finder backup and examine the app's container. Use any third-party file management tool. In each scenario, the "hidden" photos are sitting there in JPEG, PNG, or MOV format, readable by any image viewer.

Vaultaire's container holds encrypted index and blob files rather than readable originals. AES-256-GCM authentication detects an incorrect candidate key or modified ciphertext. The pattern-derived vault key opens the index and unwraps the random master key required for file content. Filenames, file counts, sizes, and other storage artifacts may still reveal structure without revealing plaintext.

Data Migration Risks

Moving to a new device is where passcode-based vault apps consistently fail their users. Secret Photo Album stores files in the iOS sandbox, which may or may not transfer correctly during device migration, iCloud restore, or manual backup. Users report losing entire collections during phone upgrades because the sandbox data did not survive the transfer.

Vaultaire separates encrypted data from its access envelopes. The recovery phrase derives a recovery key; it does not regenerate the vault's random keys from nothing. With encrypted iCloud backup enabled, that recovery key opens a CloudKit manifest containing the existing vault and backup keys, and those keys open the matching encrypted backup records.

Privacy Architecture

Secret Photo Album's ad-supported free tier means the app includes advertising SDKs that collect device information, track user behavior, and transmit data to third-party servers. The app you trust with your most private photos is simultaneously reporting your usage patterns to advertising networks. This is a fundamental architectural contradiction.

Vaultaire contains no advertising SDK and requires no identity account. App analytics, crash diagnostics, and Apple Ads attribution are enabled by default and can be turned off with “Share errors anonymously” in Settings. iCloud backup (on by default), sync, sharing, and purchases use Apple or documented service endpoints. The privacy policy names these flows and excludes vault contents, patterns, recovery phrases, share IDs, and raw vault IDs from analytics. Crash reports can include file names.