Vault Pure is live, and four permissions lighter than planned

17 August 2026:

On 10 August this blog said Vault Pure was in internal testing with no date set. The date is now in the past. The app is in production on Google Play, and 1.0.1 followed a day later.

What the test found

The internal test ran for ten days and had three questions to answer. Is the data still readable after every update? Does fingerprint unlocking fail cleanly on devices that cannot do it? Does anything end up in the Android backup by accident?

All three were answered (yes, yes and no) across several builds. That was the condition. In an app that promises encryption, a bug is not an inconvenience.

Two things nobody asked for

Going through the permissions, it turned out four of them were never needed. They sat in the manifest because they had once been intended for an idea that did not make it into the product. They are gone.

And then there was the plaintext export. A function that writes files out unencrypted, in an app whose only purpose is to keep them encrypted. On paper a convenience. In substance a hole. Also gone.

The store images were drawings

Until 18 August the store gallery showed painted tiles: rectangles meant to stand in for photos. That was honestly meant, putting real photos into an app that keeps private things felt wrong. Except that a vault full of drawn rectangles does not look like a vault full of photos. It looks like an unfinished product.

There are real images in it now. Freely licensed, none of them private. The difference is starker than it should be.

What the app does

Photos, videos and files sit on the device encrypted with AES-256-GCM. No account, no cloud, no sync. A second password opens an innocuous-looking decoy vault, and the app nowhere indicates whether one exists at all: if it could be read off, anyone else could read it off too. On a wrong entry, the front camera takes a picture.