How Tuckaway protects your photos

If you want to hide photos on your iPhone, there are two kinds of tools: the Hidden album built into Photos, and vault apps such as Tuckaway. They protect against different people. This page explains what each one does, how Tuckaway is built, and what it can't protect against — plain terms first, details further down.

The short version

• Encrypted on your device

  Photos, videos, thumbnails, file names, dates and locations are stored encrypted. There is no account and no server that receives them.

• A passphrase only you know

  Hidden vaults open with a passphrase that's separate from your iPhone passcode. Tuckaway doesn't store it, so it can't be reset.

• Locked folders need their PIN

  A folder's photos are encrypted under the folder's own key, so they stay closed without its PIN even while the app is open.

• A neutral vault access screen

  The access screen does not list hidden vaults or confirm whether a particular vault exists. A wrong passphrase and a missing vault give the same result.

The Hidden album or a vault app?

Photos has a Hidden album. Hide a photo (tap ⋯, then Hide) and it no longer appears in your library or other albums. The album is locked with Face ID, Touch ID or your passcode by default, and in Settings › Apps › Photos you can stop it appearing at all. For many people that's enough. What it doesn't do:

• It has no separate password. Anyone who knows your iPhone passcode — someone you live with, say — can usually open it.
• It's one album. You can't put different photos behind different locks.
• The photos stay in your library. Hiding takes them out of view. With iCloud Photos on, they're hidden on your other devices too, not removed.

You can also lock the Photos app itself (Require Face ID). With Stolen Device Protection on, away from familiar locations such as home or work, it then opens only with Face ID or Touch ID, not the passcode.

If someone around you knows your passcode, or you want separate locks for different photos, you need protection that doesn't depend on the passcode. In Tuckaway, that's hidden vaults and locked folders.

Three ways to protect your photos

• Private gallery

  Opens with Face ID, Touch ID or your passcode

  For everyday use. Because it opens with your device passcode, anyone who knows the passcode can open it. Its key is kept in iCloud Keychain; restoring the gallery on another iPhone also requires its encrypted data.

• Hidden vaults

  Opens with A passphrase

  For what must stay private. A vault's keys are kept in an encrypted header that only your passphrase opens. It locks the moment you leave Tuckaway, and a forgotten passphrase can't be recovered.

• Locked folders

  Opens with A 6-digit PIN

  One folder at a time, in the gallery or in a hidden vault. The folder has its own key, sealed with a key made from the PIN. A forgotten PIN can't be reset; the folder can only be deleted.

How it's built

Passphrases are slow to guess

Before any vault is tried, your passphrase goes through Argon2id, a password-hashing function, with 256 MB of memory. Every guess costs real time and memory — for someone working from a copy of the files, too. On the device, failed attempts are counted across the whole app, survive restarting it, and apply to folder PINs as well:

The wait only applies on the device; someone with a copy of the files skips it. Argon2id makes each of their guesses expensive, but it can't make a short passphrase safe — so choose a long one. Tuckaway recommends that rather than enforcing a minimum.

A neutral vault access screen

• Each attempt derives a key once, then tries the vaults until one opens or none match, so the slow step happens once however many hidden vaults exist.
• Vault files have random names, and the way into a hidden vault looks the same on every install.
• Before unlock, Tuckaway shows no vault list, item count or storage figure. (iOS Settings still shows the app's total storage.)
• A wrong passphrase and a missing vault give the same result, and the attempt limit is app-wide, not per vault.

A folder PIN is a key, not a screen lock

Each locked folder has its own key, sealed with a key derived from the 6-digit PIN (Argon2id with 64 MB and a separate salt for each folder). The folder's photos are encrypted under that key, so they can't be decrypted without the PIN, even while the rest of the app is open. The key is discarded when you leave the folder or Tuckaway goes to the background, and a locked folder shows no thumbnails or item count. A 6-digit PIN is meant to stop someone holding your unlocked phone; for stronger protection, use a hidden vault.

What is encrypted

Photos and videos are encrypted in chunks, each sealed separately with ChaCha20-Poly1305, which also lets a long video start and skip ahead without decrypting the whole file. Thumbnails, file names, dates, camera details, locations, folder names and the on-device search index — including text recognized in your images — are encrypted too.

Where decrypted copies exist

Viewing photos, Live Photos and videos writes no decrypted copy to disk: images are decoded in memory, and videos are decrypted piece by piece as they play. When iOS needs an actual file — importing from Photos, opening a large PDF, sharing a video or Live Photo, dragging a large file to another app — Tuckaway writes a temporary file with iOS file protection, deletes it when that step ends, and clears any leftovers at the next launch.

When you leave the app

Hidden vaults lock the moment Tuckaway goes to the background, and locked folders lock again. The private gallery locks after a delay you choose, from immediately to 15 minutes (10 seconds unless you change it). The app switcher shows a cover instead of your photos, and a drag to another app in progress is cancelled.

Getting photos in and out

• Sharing to Tuckaway from another app. The share extension holds no vault keys. It encrypts incoming photos and videos with a public key into a holding area, and they enter a vault only when you open Tuckaway and choose where.
• Dragging to another app. Nothing is decrypted until the receiving app asks for the item.
• Sharing from Tuckaway. The other app receives the original file as you imported it, including metadata stored in it, such as location. Tuckaway doesn't remove it.

The one exception: Lock Screen capture

The Lock Screen camera can't reach your vault keys, so a photo or video taken there isn't encrypted by Tuckaway until you next open the app. Until then it stays out of your camera roll, iOS Data Protection keeps the finished shot from being opened while your iPhone is locked, and it's marked to be excluded from device backups. Opening Tuckaway encrypts it into your library and deletes the original file.

No account, no analytics

There is no sign-in, no analytics or advertising SDK, and no server that receives vault data. The only request that involves your photos' details is the optional map in a photo's info sheet: opening it sends that photo's coordinates to Apple Maps. This website has no cookies or analytics either.

What Tuckaway doesn't protect against

• A jailbroken iPhone, or one whose iOS security has been broken by a software vulnerability.
• Someone who knows your passcode, for the private gallery: it opens with Face ID, Touch ID or your device passcode by design. Keep what must stay private in a hidden vault.
• A weak passphrase guessed from a copy of the files.
• A determined attacker with a copy of the files and a 6-digit folder PIN.
• Originals left in Photos. Tuckaway offers to delete them after import; deleted items stay in Photos' Recently Deleted album for up to 30 days unless you permanently delete those items sooner.
• The total storage Tuckaway uses, which iOS Settings shows and Tuckaway can't hide.
• Copies you share or export, which leave as the original files with their metadata.

Questions to ask any photo vault app

Whichever app you choose, these answers tell you a lot. Here are Tuckaway's.

Does it need an account?

No. There is no sign-in and no server that receives your photos or vault data.

Is the PIN encryption, or only a lock screen?

Encryption. A locked folder's photos are encrypted under the folder's own key, which only the PIN unlocks.

Can the passphrase be reset?

No. Tuckaway offers no passphrase reset or recovery. If you forget it, you cannot reopen that hidden vault. Choose a long, unique passphrase you can remember.

Does it keep the originals?

When Photos access is available and original loading succeeds, Tuckaway preserves the original files and their embedded metadata. If it falls back to the photo picker, Live Photos are imported as still images.

What happens if you stop paying?

Nothing is held back. Plus is a one-time purchase, not a subscription, and everything you saved stays viewable and exportable on any plan.

Does it show ads or track you?

No ads on any plan, and no analytics or advertising SDK in the app.

Does it tell you what it can't protect against?

A jailbroken iPhone, someone who knows your passcode (for the private gallery), a weak passphrase, originals left in Photos, and copies you share. The full list is above.

Moving photos into Tuckaway

1. Download Tuckaway from the App Store and open your private gallery.
2. Import photos and videos from Photos — into the gallery, a folder or a hidden vault.
3. Tuckaway encrypts them on the device, then offers to delete the originals from Photos (iOS asks you to confirm).
4. Deleted originals stay in Recently Deleted for 30 days. First check that the imported items open in Tuckaway. To remove those originals right away, select only those items in Recently Deleted and delete them permanently. This can't be undone.

If you use iCloud Photos, deleting the originals also removes them from your other devices.

On the free plan the private gallery has no limit, and each hidden vault holds up to 3 items. A one-time Plus purchase removes that limit and adds the built-in camera and document scanner.

Reporting a security problem

If you find a security problem in Tuckaway, email [email protected]. We read every report. Please include the app version and iOS version, what you saw and what you expected, steps to reproduce, and whether you believe the problem is being exploited.

Never send your passphrase, a folder PIN, keys, or your photos and videos — not even to show the problem. We can't decrypt your vault and don't want anything from it; reproduce the problem with test photos you made for the purpose. If a report arrives with such material, we delete that material without examining it, keep the rest of your message, and ask you to resend with test data.

What happens next:

1. We record when your report arrived, then assess whether it affects the security of Tuckaway.
2. Where required, we notify the competent authorities under the EU Cyber Resilience Act (Regulation (EU) 2024/2847).
3. We fix the problem and ship an update through the App Store, and tell affected users what to do.

Tuckaway is made by a one-person company, so we can't promise a fixed response time, and there is no bug bounty. Please give us a reasonable chance to ship a fix before publishing details. We won't take legal action over good-faith research that respects people's privacy and doesn't access anyone else's data.

In scope: the Tuckaway iOS app and its extensions (sharing to Tuckaway and the Lock Screen camera). Out of scope: Apple's operating system and services, and the cases listed under What Tuckaway doesn't protect against.

Reviewed against Tuckaway 1.0.4, the App Store version in November 2026. The Hidden album description applies to iOS 18 and later, based on Apple's iPhone User Guide.