What happens at import
You pick photos from the library. The app copies them into its own storage, a space iOS gives each app that other apps cannot browse. The app then asks to delete the originals, or you do it yourself. Until you empty Recently Deleted, the originals are still on the phone.
What happens to the copy
Hiding. The file sits in the app's storage as an ordinary JPEG or video. Other apps cannot see it through normal means, but it is readable to anything that can read the app's storage: a device backup, a computer with the right access, or a forensic tool.
Encrypting. The app runs the file through a cipher such as AES-256-GCM with a key derived from your passcode, and stores the result. What sits in storage is noise. Without the key, a backup or a forensic copy contains nothing readable.
You can tell which kind an app is from its listing. If the algorithm is named and the listing says encryption happens on the device, it is the second kind. If the listing says hide, lock, protect or military-grade with no algorithm, assume the first. What to check.
What the lock screen does
The lock screen decides whether the app will show you the files. With a hidden file, that is the entire protection. With an encrypted file, the lock screen is where the passcode is turned into the key; without the passcode there is no key, and the files stay unreadable whether or not the app is open.
What a backup contains
App data is normally part of an iCloud or computer backup. For a hiding vault, that means the photos are in the backup as readable files. For an encrypting vault, the backup contains encrypted files and nothing that opens them.
What happens when you forget the code
For a hiding vault, the developer can often reset the code, because the files were never locked to it. For an encrypting vault, a reset is only possible if there is a second key: a recovery phrase you hold, or a copy the developer keeps. Kryptis uses a twelve-word recovery phrase and keeps no copy. The honest options.
Where the cloud fits
Some vaults upload the copy to the developer's servers for backup or sync. If the file was not encrypted on the phone first, the developer holds a readable copy. Kryptis has no server; its backup is an encrypted file you place in your own iCloud Drive. Do photo vault apps upload your photos?
How Kryptis does it
Import copies the file, encrypts it with AES-256-GCM on the device along with its metadata, and can delete the original for you. The key is derived from your vault passcode and never leaves the phone. A second passcode opens a decoy vault, a third erases everything, and failed unlocks are recorded.
