Vaultumi

Privacy labels and permissions: how to vet a photo vault app

By Vaultumi. Published .

Before an app holds your private photos, two free checks are one tap away: the privacy label on its App Store page, and the permissions it asks for when it runs. Neither proves an app is safe, but together they catch many of the worst offenders in a couple of minutes.

Privacy labels and permissions: how to vet a photo vault app

Quick answer

Read the label for what the developer says it collects, then watch the permission prompts for what the app actually asks for. A vault that needs no account, collects no data and asks only for the permissions its features need is a good sign. A vault that wants your contacts, location, tracking permission or a full copy of your library is a reason to stop.

  • The privacy label is the developer’s own statement, so it is a claim to compare with the privacy policy, not a certificate.
  • For a vault, “Data Not Collected” is the answer you want, and “Data Used to Track You” should not appear at all.
  • You can change photo access at any time in iOS Settings.

Key takeaways

  • Apple asks developers to describe the data their app and its third-party partners collect. Developers fill it in themselves and must keep it up to date, so check it against the privacy policy.
  • The label groups data into whether it is used to track you, linked to you or not linked to you, and some apps say they collect none.
  • iOS can limit an app to selected photos instead of the whole library, and asks before an app uses the camera or notifications.
  • Labels and permissions say nothing about whether the encryption is any good. That needs the checklist.

What does the privacy label tell you?

Each App Store listing has an App Privacy section. It sums up, in categories, which data the developer says the app collects and what it is used for. Apple built it so that you can see an app’s privacy practices before you download. The three groups to know are:

  • Data Used to Track You. Data that is linked with other companies’ data about you, for advertising or measurement.
  • Data Linked to You. Data tied to your identity, such as an account, an email address or purchase history.
  • Data Not Linked to You. Data collected without being tied to who you are.

The best entry is a single line, “Data Not Collected”. Because developers write the label, treat a clean one as the start of the check, not the end.

Which entries matter most for a photo vault?

If you seeIt may mean
Photos or Videos collectedYour media leaves the phone, so the vault is not only local
Contact info, user ID or device IDAn account or a way to identify you exists
Usage data, diagnostics or advertising dataAnalytics or ad code runs inside the app
Data Used to Track YouYour behaviour is shared across other companies’ services
PurchasesNormal for a paid plan, handled by Apple
Data Not CollectedThe developer says nothing is sent off the phone

The right-hand column is a lead to investigate. The privacy policy should explain each entry in plain words. If a vault collects a lot and the policy is thin, move on.

Which permissions should a vault ask for?

iOS shows a prompt the first time an app wants something sensitive. For a photo vault, the sensible list is short.

  • Photos. Needed to import. On recent versions of iOS, choosing selected photos gives the app only what you pick, which suits a vault. Full library access is a bigger grant, so give it only if you need it.
  • Face ID. Needed for biometric unlock. Face ID results stay with iOS, and the app learns only “yes” or “no”.
  • Camera. Only for a feature that uses it, such as a built-in camera or scanning.
  • Notifications. Optional. Check the wording, because a banner is readable on a lock screen.

Be suspicious of requests that do not fit the job, such as contacts, precise location, microphone, or “allow tracking”. You can review and change grants under Settings, Privacy & Security, and Apple explains the controls in the iPhone User Guide. In Vaultumi, the camera is asked for only when you use a camera feature, and notifications only if you turn on backup reminders.

What else on the listing is worth reading?

  • The privacy policy link. It should work, say who the developer is and match the label.
  • In-app purchases. They are listed on the page, so you can see the pricing model before you install. The free versus paid guide explains what to look for.
  • Update history. An app that has not been touched in years may not run well on current iOS.
  • Specific claims. “Encrypted on your device, no account, no cloud” is checkable. “Military-grade” is not.

How do you run the check in two minutes?

  1. Open the App Store page and scroll to App Privacy. Note the groups listed.
  2. Open the privacy policy. Does it explain every entry in the label?
  3. Look for an account requirement, ads or a subscription that locks your own files.
  4. Install, then watch the first permission prompts. Decline anything that does not fit a photo vault.
  5. Read how it handles recovery and backup before you import anything you cannot replace.

Vaultumi’s planned answer is “Data Not Collected”, because it has no server, no analytics, no advertising and no third-party SDKs, and purchases are processed by Apple. The privacy policy sets that out, and the security page lists the limits.

Honest limits

  • A label is self-reported. It can be wrong or out of date, and you cannot verify it from the listing alone.
  • Permissions show what an app may touch, not what it does with it. Network behaviour and code quality need other checks.
  • A clean label is not a security audit. Vaultumi has not been independently audited, and says so.
  • Labels and iOS settings change over time. Apple’s pages are the reference for the current wording.

Sources

Primary sources behind the statements about iOS and cryptography on this page. The linked pages are in English.

All guides