Hidlet vs Secret Photo Album: Which Vault Keeps Photos Private?

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

Several apps on the App Store are called Secret Photo Album. This page is about the one by BPMobile, listed as “Secret Photo Album - SA”, with more than 38,000 US ratings. It locks photos behind a PIN or Face ID, has a decoy PIN and takes photos of intruders, and sells cloud sync as part of Premium.

If you’re choosing between it and Hidlet, the questions that matter are how your photos are protected, who can reach them in the cloud, and what the app shares about you. This comparison uses only what Secret Photo Album’s own App Store listing, privacy policy, terms and support page say. Where we couldn’t confirm something, we say so.

Checked on 25 October 2026, against Secret Photo Album 2.18 on the US App Store.

The short version

How each one protects your photos

Secret Photo Album’s listing says your files sit in “the encrypted, PIN-protected storage”, and that its cloud is “encrypted cloud storage”. That’s as far as the developer goes. It doesn’t name an encryption method, say how keys are made or kept, or say whether the cloud copy is end-to-end encrypted. The privacy policy talks about encrypting personal data only in general terms.

That doesn’t mean the photos are poorly protected. It means you can’t check what “encrypted” covers.

Hidlet is built so the answer is written down:

• Each vault has its own random key.
• Every photo and video is encrypted with AES-256 before it’s saved.
• Your pattern unlocks the vault’s key on the phone and is never stored anywhere.
• Guessing patterns is slowed down on purpose, and after three wrong guesses each one adds a growing wait.

More on what AES-256 really protects in Is the iPhone Hidden Album Encrypted?

Accounts, the cloud and forgotten PINs

The developer describes an account only for Premium cloud sync and restore: you “register your email in the app Settings”, and the privacy policy says Sign in with Apple works too. The privacy policy says that paid users’ data may be stored with “Amazon Web Services, Inc.”, and that free users’ files are “stored locally on your device and/or in your iCloud storage”. It also says that if you delete your account, “all your data within the App will be lost”.

We found no way to recover a forgotten PIN on the listing, the support page, the terms or the privacy policy. The developer doesn’t say what happens.

Hidlet takes a different route:

• No account: no email, no sign-in, nothing tied to your name.
• Backup: each vault is encrypted on the phone, then saved to your own iCloud. Neither Apple nor we can open it. It’s free.
• New phone: install Hidlet and draw your pattern. This works when iCloud Keychain is on; if it’s off, your recovery phrase restores the vault instead.
• Forgot your pattern: enter the 9-word recovery phrase and set a new pattern, free.

The trade-off is real: lose both the pattern and the phrase, and the vault can’t be opened by anyone, including us. More on that in encrypted backup.

When someone makes you unlock it

Secret Photo Album has a decoy PIN to hide your real photos, and break-in alerts that include photos of whoever tried to get in. It locks after 3 wrong PINs, and it covers its content in the app switcher. That’s a thoughtful set.

In Hidlet, every pattern opens its own vault, and the app never shows a list of them. You can keep a vault of ordinary photos and open that one when pressed. Nothing on screen hints that another vault exists. That’s the decoy vault, and it’s in the free plan. Pro adds a duress pattern that also deletes your other vaults from this phone, while the encrypted backup stays in your iCloud.

Hidlet doesn’t take intruder photos. It does blank the screen in screenshots and screen recordings, and it locks the moment you leave the app.

Ads and your data

The App Store listing doesn’t carry a “Contains Advertising” label. The privacy policy, though, names Appodeal, Google Mobile Ads and Meta as partners and describes “interest-based (behavioral) advertising”. We couldn’t confirm whether free users see ads. The policy also names Amplitude, AppsFlyer, Firebase and Qonversion.

The App Store privacy label lists purchases, location, identifiers, usage data, diagnostics and other data as “Data Used to Track You”. Under data linked to you, it includes user content: photos or videos.

Hidlet has no accounts, no email and no ads, and it includes no analytics or tracking code.

Where Secret Photo Album is better

Secret Photo Album has features Hidlet doesn’t:

• Face ID and Touch ID, if you’d rather not draw a pattern.
• Break-in alerts with intruder photos.
• A private browser with a built-in ad blocker.
• More devices: it runs on iPad, on Macs with Apple silicon and on Apple Vision.

Hidlet’s limits are worth knowing too. It runs on iPhone and iPad (sync between them needs Pro), and the free plan holds 3 vaults with up to 100 photos and 10 videos in each. Like Secret Photo Album, it has an in-app camera that saves straight into the vault.

The bottom line

Secret Photo Album is a feature-rich vault, with a decoy PIN, intruder photos and Face ID. But it doesn’t say how its encryption works, it names no way back if you forget your PIN, and its privacy label lists a long range of data used to track you. If you want photos encrypted with a key only you hold, no account and a free encrypted backup to your own iCloud, Hidlet is built for exactly that.

Hidlet is available on the App Store.