Locked to everyone but you.
Caveau encrypts your photos and videos on your iPhone and keeps them there. No account to create. No server to trust. No subscription to keep paying. And no way for anyone — including us — to look inside.
No account·No server·No subscription
Never locked out. Never trapped. Never watched.
A vault is only worth trusting if it can't turn against you. Caveau is built around three guarantees, and each one is verifiable — not just promised.
Never locked out
Set up once and Caveau prints you a one-page recovery kit with your recovery key. Forget your password years from now — the key gets you back in. You can even split the key into shares for people you trust, so your family can recover your photos if you can't.
Never trapped
One tap exports everything, original quality, no strings — on the free tier too. Encrypted portable backups restore your whole vault onto a new iPhone. The file format is documented and the client is open source. You can always leave with everything.
Never watched
Encryption happens on your phone, with audited libsodium cryptography and your iPhone's Secure Enclave. Caveau has no servers, no accounts, no analytics, and no third-party code. There is nothing to breach, subpoena, or sell.
Everything a vault should do. Nothing it shouldn't.
Face ID unlock
Open your vault with a glance. Your password stays as the root of trust; Face ID is convenience, backed by the Secure Enclave.
Serious cryptography
XChaCha20-Poly1305 encryption and Argon2id key derivation via libsodium. No home-made crypto, anywhere.
Private AI search
Type "passport" or "red bike" and find it. Text and objects are recognized entirely on-device — the index is encrypted too.
People
Faces are grouped and nameable, so you can find everyone's photos fast. Face data never leaves your phone.
Albums & Collections
Organize by hand, or let automatic Collections gather documents, receipts, screenshots, and favorites for you.
Encrypted video
Videos stay encrypted at rest and play back inside the vault — no decrypted copies left behind.
Clean sharing
When you share a photo out of the vault, EXIF metadata and GPS location are stripped so you don't leak where it was taken.
Printable recovery kit
A one-page kit with your recovery key. Put it in a drawer, a safe, or a safety-deposit box — it's your master key.
Inheritance access
Split your recovery key into three shares for trusted people. Any two together can recover your vault; one alone can't.
Portable backups
Export an encrypted backup file and keep it anywhere — iCloud Drive, a computer, a USB stick. Restore it on a new iPhone.
One-tap export
Everything out, original quality, whenever you want. Leaving is a feature, not a support ticket.
Open source
The client is MIT-licensed on GitHub. Read the code, build it yourself, verify every claim on this page.
What we can and cannot see
Most privacy pages are written by lawyers to be vague. Ours is short because there is nothing to hide behind: Caveau has no servers, so the question "what do you do with my data?" has an unusually simple answer.
What we cannot see
- Your photos and videos. They are encrypted on your phone with keys we never have.
- Your password and recovery key. They exist only with you. We cannot reset them — that is the point.
- Your search index, face groups, and album names. All derived on-device, all encrypted.
- Whether you use the app at all. There are no analytics, crash uploaders, or third-party SDKs.
What ever leaves your phone
- Nothing first-party. The app's only network activity is Apple's StoreKit, for the one-time purchase (below).
- Your App Store purchase is processed by Apple. We never see your name, email, or payment details.
- Backup files you choose to export go wherever you put them — and they are encrypted, unreadable without your key.
Don't take our word for any of this. The Caveau client is open source under the MIT license — every claim above is checkable in code. Read the full privacy policy.
Pay once. Or don't pay at all.
Your photos live on your phone, so there are no server bills to pass on to you. That's why Caveau will never charge a subscription — it's proof, not a discount.
$0forever
- Up to 250 photos & videos
- Full encryption strength — identical to paid, never a weaker "free" cipher
- Face ID unlock
- Printable recovery kit
- Inheritance setup (2-of-3 key shares)
- Encrypted backups & restore
- Albums
- One-tap full export — always
$19.99once. Ever.
- Everything in Free
- Unlimited photos & videos
- Private on-device AI search
- People — face grouping & naming
- Automatic Collections
- Every future update included
One purchase on the App Store, restorable on any iPhone signed into your Apple Account. No subscription, no upsell, no "pro pro" tier. See the full pricing philosophy
Asked and answered, honestly
What if I forget my password?
Use your recovery key. When you set up Caveau, it generates a recovery key and walks you through printing a one-page recovery kit. Enter the key and you're back in — set a new password and carry on.
If you lose both your password and your recovery kit, your photos are unrecoverable. Not "unrecoverable unless you email support" — mathematically unrecoverable, by design. That is the price of a vault nobody else can open, and we would rather tell you now than in a support reply.
Can you see my photos?
No. Your photos are encrypted on your phone with keys derived from your password, and Caveau has no servers — its only network activity is Apple's StoreKit, for the one-time purchase. There is no copy anywhere for us, a hacker, or a government request to look at. The client is open source, so you can verify this rather than trust it.
What if I lose my phone?
Restore from a backup. Caveau exports encrypted, portable backup files that you can keep in iCloud Drive, on a computer, or on a USB stick. On a new iPhone, import the backup and unlock it with your password (or recovery key) — your whole vault comes back.
The backup file is safe to store anywhere because it's encrypted: whoever holds the file still can't open it.
What happens to my photos if I die?
Caveau has inheritance access built in. You can split your recovery key into three shares and give them to people you trust — any two shares together can reconstruct the key and open your vault, but one share alone reveals nothing. Your family gets your photos; no single person gets a master key.
Why is there no subscription?
Because a subscription would be evidence against us. Vault apps that charge monthly are usually paying for servers — which means your photos are on their servers. Caveau stores everything on your phone, so there is nothing recurring to pay for. $19.99 once, and the absence of a subscription is part of the proof that nothing leaves your device.
Is it really open source?
Yes — the client is MIT-licensed on GitHub. You can read exactly how encryption, recovery, and export work, build the app yourself, and confirm it never phones home. Security claims you can't check are just marketing; ours are code.
Does the AI search send anything to a server?
No. Text recognition, object recognition, and face grouping all run on your iPhone's own hardware, and the resulting search index is encrypted inside the vault like everything else. Nothing about your photos — not even a fingerprint of them — leaves the device.
What does the free version leave out?
Only capacity and conveniences: free is capped at 250 items and doesn't include AI search, People, or automatic Collections. Everything safety-critical — full-strength encryption, the recovery kit, inheritance setup, and complete export — is free forever. We will never hold your security or your ability to leave for ransom.
What if Caveau disappears?
You lose nothing. The app keeps working — it never needed a server. Your photos export in one tap at any time, your backups are portable files in a documented format, and the open-source client can be built by anyone, forever. A vault you could be trapped in isn't a vault; it's a hostage situation.
Your photos are yours. Keep it that way.
Free up to 250 items. $19.99 once for everything, forever.