Hidlet vs Vaulty: Where Do Your Private Photos Actually Live?

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

Vaulty has been on the App Store since 2022 and promises a private space for the photos and videos you don’t want in your camera roll. It unlocks with a PIN or Face ID, backs up to the cloud and syncs across your devices. This page is about “Vaulty: Hidden Photos Vault” by Mappvate on iPhone.

The question that matters most here is where your photos end up, and who can reach them there. This comparison uses only what Vaulty’s own App Store listing, website and privacy policy say. Where the developer doesn’t say something, we say that too.

Checked on 25 October 2026, against Vaulty 5.5.5 on the US App Store.

The short version

Where your photos are kept

This is the biggest difference between the two apps.

Vaulty’s listing says your private space “is backed up in your personal cloud”. In a reply on its App Store page, the developer goes further: “Your images are securely stored in the cloud, not on your local device.” Its website adds that your gallery stays protected “even if you delete the app”, and that it syncs across all your iOS devices.

The listing doesn’t say whose cloud that is. iCloud isn’t mentioned anywhere. The privacy policy lists Google’s Firebase Cloud Storage and Firestore among the services the app uses, and the App Store privacy label lists “Photos or Videos” as data linked to you. The developer doesn’t say whether your photos are encrypted there, or who holds the key.

Hidlet works the other way round. Your photos stay on your iPhone, encrypted, and only an encrypted copy leaves the phone:

• Each vault has its own random key.
• Every photo and video is encrypted with AES-256 before it’s saved.
• Your pattern unlocks the vault’s key on the phone and is never stored anywhere.
• The encrypted backup is encrypted on the phone first, then saved to your own iCloud. Neither Apple nor we can open it.

If you’re curious what Apple can and can’t see in iCloud, read Can Apple See Your Hidden Photos?

Accounts and getting back in

Vaulty uses an account. Its privacy policy lists sign-in with an email address and password through Firebase Authentication, and Sign in with Apple. Its privacy label lists your email address as linked to you. The developer says you can reach your images from any device “by logging into your account”. We couldn’t confirm whether you must create one before using the app.

The developer doesn’t say what happens if you forget your PIN. For account trouble, its reply on the listing points users to its support email.

Hidlet has no account and no email. Getting back in depends only on what you hold:

• New phone: install Hidlet and draw your pattern. This works when iCloud Keychain is on; if it’s off, your recovery phrase restores the vault instead.
• Forgot your pattern: enter the 9-word recovery phrase and set a new pattern, free.

The trade-off is real: lose both the pattern and the phrase, and nobody can open the vault, including us. That’s the cost of a key only you hold.

When someone makes you unlock it

Vaulty has a decoy PIN that “opens a completely empty gallery”. It can also disguise itself as a Notes or Passwords app, so the app itself is less likely to draw attention. Hidlet Pro can do something similar with its icon, which can look like Notes, a calculator or another everyday tool; opening it still shows Hidlet’s lock screen.

In Hidlet, every pattern opens its own vault, and the app never shows a list of them. Instead of an empty gallery, you can open a vault of ordinary photos (screenshots, receipts, a few holiday pictures). An empty vault can raise questions; a vault with everyday photos usually doesn’t. That’s the decoy vault, and it’s in the free plan. Pro adds a duress pattern that also removes this phone’s access to your other vaults, while the encrypted backup stays in your iCloud.

Ads and your data

Vaulty’s listing shows Contains: Advertising. Its privacy policy names Google’s AdMob for ads, the Meta pixel for ad conversion tracking, and Google Analytics for Firebase and Mixpanel for analytics. It also says it collects device identifiers for advertising, such as the IDFA.

Its App Store privacy label tells a different story. It lists no data used to track you, but does link your email, photos, user ID, device ID, purchases and how you use the app to you. Its privacy policy and its privacy label don’t fully match.

Hidlet has no ads, and it includes no analytics or tracking code. There’s no account, so nothing ties your vaults to your name.

Where Vaulty is better

Vaulty has real strengths:

• Sync across devices: the developer says it syncs across all your iOS devices, and the app runs on iPad too. Hidlet runs on iPhone and iPad, and syncs between them with Pro.
• A disguise: it can pose as a Notes or Passwords app.
• Face ID unlock, if you’d rather not draw a pattern.
• It survives deleting the app: the developer says your gallery stays protected even then.

Hidlet’s limits are worth knowing too. There’s no Face ID, disguise icons need Pro, and the free plan holds 3 vaults with up to 100 photos and 10 videos in each.

The bottom line

Vaulty is a simple PIN vault that keeps your photos in the cloud and syncs them across your devices, paid for with ads or a subscription. But its pages don’t say whether your photos are encrypted there, or who holds the key. If you want photos encrypted on your iPhone with a key only you hold, with no account and no ads, Hidlet is built for exactly that.

Hidlet is available on the App Store.