Frequently asked questions

Use your recovery key. During setup, Caveau generates a recovery key and walks you through printing a one-page recovery kit. Enter the key, set a new password, and you're back in.

If you lose both your password and your recovery kit (and have no inheritance shares in circulation), your photos are permanently unrecoverable. Not "unrecoverable unless you email support" — mathematically unrecoverable, by design. A vault that someone else can open for you is a vault someone else can open without you.

Restore from a backup. Caveau exports encrypted, portable backup files you can keep in iCloud Drive, on a computer, or on a USB stick. On a new iPhone, import the backup, unlock it with your password or recovery key, and your whole vault comes back — photos, albums, People names, everything.

No backup means no restore: your vault lives on your phone, so a lost phone with no backup is a lost vault. Make a backup. Caveau reminds you, but it can't do it for you.

No. The vault is encrypted with keys derived from your password via Argon2id and protected by the Secure Enclave. Without your password, Face ID, or recovery key, the contents are ciphertext — to a thief, to forensic tooling, and to us.

That's what inheritance access is for. You can split your recovery key into three shares and hand them to people you trust — printed pages, like small recovery kits. Any two shares together reconstruct the key and can open your vault (or a backup of it); a single share reveals nothing at all.

Practical setup: give shares to two family members and leave a third with your will or in a safe. No lawyer, no company, and no single person can open your photos alone — but the people you chose, together, always can.

Treat it like the spare key to a safe: anyone who holds the kit can open your vault, so keep it somewhere physically secure — a locked drawer, a home safe, a safety-deposit box. Don't photograph it back into your phone, and don't store it unencrypted in cloud notes. Paper in a safe place beats a screenshot anywhere.

No, and be suspicious of any vault whose support can. We hold no copies, no keys, and no backdoor. Support can help you use your recovery key or restore a backup — that's the honest limit of what anyone can do. It's spelled out on our support page.

No. Your photos are encrypted on your phone with keys we never have, and Caveau has no servers — its only network activity is Apple's StoreKit, for the one-time purchase. There is no copy anywhere for us, a hacker, an advertiser, or a subpoena to reach. Because the client is open source, this is a claim you can check, not one you have to believe.

XChaCha20-Poly1305 authenticated encryption for your files, Argon2id for deriving keys from your password, and the iPhone's Secure Enclave for hardware-backed key protection — all via libsodium, the widely audited cryptography library. Caveau contains no hand-rolled cryptography anywhere; every primitive is a standard, reviewed one, and the implementation is public.

Yes. The client is MIT-licensed on GitHub, including the encryption core and the vault file format documentation. You can read how encryption, recovery, and export work, build the app yourself, and confirm it never phones home. Security claims you can't verify are just marketing.

No. Recognizing text and objects in your photos, and grouping faces for People, all run on your iPhone's own hardware. The resulting search index is encrypted inside the vault like everything else. Nothing about your photos — not even a mathematical fingerprint — ever leaves the device.

No analytics, no crash uploaders, no third-party SDKs, no tracking of any kind — the App Store privacy label reads "Data Not Collected." We genuinely do not know how many photos you store, how often you open the app, or that you use it at all. This website is static and analytics-free too.

Face ID is the convenient way in; your password remains the root of trust. Biometrics are handled entirely by iOS and the Secure Enclave — Caveau never sees or stores face data, and disabling Face ID never weakens the encryption. If Face ID fails or is disabled, your password still opens the vault.

Because a subscription would be evidence against us. Recurring fees usually pay for servers, and if there are servers, your photos or metadata are probably on them. Caveau keeps everything on your phone, so there's nothing recurring to pay for — the missing subscription is part of the proof. $19.99 once, and we've put the no-subscription promise in writing.

Free gives you 250 photos and videos with the identical encryption as paid — there is no "lite" cipher. The printable recovery kit, inheritance setup, encrypted backups, and one-tap full export are all free forever, because your safety and your ability to leave are never for sale. The $19.99 lifetime unlock adds unlimited items, AI search, People, and automatic Collections.

No. The unlock is tied to your Apple Account. On the new phone, tap "Restore Purchases" and it's back. (Your photos come back separately, from your encrypted backup — the purchase and the data travel by different roads, both yours.)

The one-time price may change over time, but two things won't: existing purchases are lifetime, and Caveau will never convert to a subscription. That promise is core to the product, and it's written into our pricing page and terms where you can hold us to it.

One tap: Settings → Export everything. Your photos and videos come out at original quality, on the free tier and paid alike, with no waiting period and no exit interview. A vault you can't leave isn't a vault — it's a trap with a nicer icon.

Caveau produces a single portable backup file, encrypted before it leaves the app. Store it anywhere — iCloud Drive, a computer, a USB stick — and whoever holds the file still can't open it without your password or recovery key. Restoring on a new iPhone brings back your entire vault. The file format is publicly documented, so backups remain readable by the open-source client even decades from now.

No — when you share out of the vault, Caveau strips EXIF metadata and GPS location by default, so the copy you send carries the picture and nothing else.

You lose nothing. The app has no server to switch off, so it keeps working exactly as before. Your export button keeps working, your backups are portable files in a documented format, and the MIT-licensed source means anyone can keep building the client forever. We designed Caveau so that trusting us is never a requirement — including trusting us to stay in business.