Android apps

The same principle as our browser tools, on your phone: your data stays on your device, and we never see it.

Last updated: August 22, 2026

How the encryption actually works

"Encrypted" is a word every gallery-locker app uses, and most of them mean a PIN screen drawn over files that are still sitting in plain view on the filesystem. Anyone who plugs the phone into a computer, or pulls a backup off it, gets the pictures. That is a lock on a door with no walls around it.

SysFenix Vault encrypts the media itself with AES-256. The key is derived from your password using Argon2id, a deliberately slow, memory-hard function designed so that guessing passwords in bulk is expensive even for someone with the encrypted files in hand and a lot of hardware. The password never leaves the device and is not stored anywhere — not on the phone, and certainly not with us. We run no server, hold no key, and receive no copy of anything.

The practical consequence is the one worth understanding before you install it:there is no password recovery. Not "we make you jump through hoops to reset it" — there is no mechanism, because a mechanism would mean somebody other than you could open the vault. That is the trade a real encrypted vault makes, and it is the honest reason to write your password down somewhere safe.

Backup without handing anything over

Encrypting your photos properly creates a new problem: lose the phone and you lose the photos. The usual fix is to upload them to somebody's cloud, which undoes the point.

Instead, the vault can back up to your Google Drive or Dropbox, and what it uploads is the ciphertext — byte for byte the same unreadable data that sits on the device. Your password and keys are never uploaded, so the backup is exactly as unreadable to Google, to Dropbox and to us as it would be to somebody who stole the phone. It restores only on a device where you type the password.

Why this exists

It is the same idea as the browser tools on the rest of this site, moved onto the phone. Those tools convert and edit files without uploading them, because the moment a file leaves your device you are trusting a stranger's server with it. A photo vault is the same problem with higher stakes: the pictures people most want to keep private are exactly the ones they should be least willing to hand to a third party for safekeeping.

So the app collects nothing. No accounts, no analytics, no telemetry, no crash reporting, no advertising, no tracking. It makes no network connections at all except the optional backup you set up yourself. The privacy policy spells out each of those claims, and Google Play's Data safety section says the same thing.

Common questions

What happens if I forget my password?

The vault cannot be opened, by you or by anyone. There is no reset link and no support process that can help, because none can exist without a second key — and a second key is the thing this design refuses to create.

What is the decoy vault for?

A second password opens a separate, ordinary-looking vault. It exists for the situation where somebody is standing over you asking you to unlock the app, which is a more common threat than a stranger attacking the encryption.

Why can the app disguise itself?

An app icon that says "vault" advertises that there is something worth looking at. The app can present itself as a calculator, a notes app, a weather app or a retro game instead, which is a plainer kind of protection than cryptography and works on a different sort of snooping.

Do the browser tools and the app share anything?

No. They are separate programs that happen to share a principle and a name. The browser tools run entirely in a web page and store nothing; the app runs on your phone and stores its vault there.

Questions about our apps? Email javi@moralesf.com.