1. Your key never exists outside your phone
When you set a master password, Hushfold derives a key from it with PBKDF2-SHA256, 600,000 rounds, salted per vault. That key wraps a random 256-bit vault key. Every photo, video, file and note is sealed with AES-256-GCM under that vault key, in 4 MiB chunks, using Apple’s CryptoKit — no third-party crypto library.
The password is never stored. The derived key lives in memory only while the vault is open. Face ID and your 6-digit PIN are conveniences that unlock a cached copy protected by the Secure Enclave and iOS Keychain; the master password is always the root.
Consequence: there is no “forgot password” email. If you lose the password and your 12-word Recovery Kit, the data is gone — for everyone, including us. That is not a limitation we could remove without adding a back door.
2. What leaves your phone
| Thing | Goes where | Readable by |
|---|---|---|
| Photos, videos, files, notes | Nowhere, by default | You |
| iCloud backup (optional, off by default) | Your private CloudKit database, inside your Apple ID | You. Apple stores ciphertext; we have no access path |
| Purchase status | Verified on-device by StoreKit | Apple, as with any app |
| Usage analytics, device identifiers, crash logs to us | Nowhere. There is no server of ours | Nobody |
| A website’s icon when you save a link | Requested directly from that site | That site sees your IP, as a browser would |
Apple’s privacy label for Hushfold is Data Not Collected. The app contains no analytics SDK, no ad SDK, no push-notification framework — a build-time check fails the build if any of those are ever imported.
3. Recovery without an account
Your vault key is also wrapped under a second key derived from a 12-word Recovery Kit (128 bits of entropy plus a checksum, BIP-39 word list). You see it once, at setup, and are asked to store it outside the phone. On a new iPhone, the same Apple ID plus your master password is enough to restore from iCloud; the Recovery Kit is the second route if the password is gone.
The backup keeps the last 5 versions of your vault index. A bad sync cannot overwrite the only copy.
4. Decoy vault, disguise screens, face-down lock
A second PIN opens a separate vault with its own contents. Nothing on the lock screen reveals how many vaults exist. Five optional disguise covers (calculator, notes, audio player, currency converter, an error screen) are real, working screens; the PIN is typed into them. Both features are off by default, named in Settings, and described in the App Store listing — Apple reviews them as documented functionality, not hidden behaviour.
Optional lock when face down uses the motion sensor; the permission prompt appears only when you switch it on. Emergency erase is off by default and needs two confirmations plus your PIN to enable.
5. What we cannot do, said plainly
- Block a screenshot. No iOS app can. Hushfold detects one and tells you immediately. Screen recording and mirroring are blocked: a shield covers the app while either is active.
- Protect you from a compromised Apple ID. If you turn on iCloud backup, someone who controls your Apple ID gets the encrypted blob and can attempt to guess your master password offline. That is why the key derivation is slow (600,000 rounds) and why a 12+ character password is required.
- Hide that the app exists. The default icon is a neutral folded sheet and the name stays “Hushfold”; the alternate icons are plain geometric marks. The listing itself is public.
6. Things you can verify yourself
- Settings → About → Diagnostics shows every counter the app keeps; none of it is transmitted.
- Export the whole vault to one encrypted
.hushfoldfile and open it on another device with your password — free, whether or not you ever pay. - Turn iCloud backup off and the app asks whether to erase the cloud copy. Do it, then check iOS Settings → Apple Account → iCloud → Manage Storage.
This page reflects Hushfold 1.0. Changes will be listed here with a date.