Effective September 30, 2026
Privacy Policy
This policy covers Hideout: Secret Photo Vault for iPhone ("Hideout", "the app"), published on the App Store by Buck Toh ("we").
The short version. There is no account, no sign-up and no server of ours. Your photos and videos are encrypted on your own device. We never receive them, and we could not read them if we did — the key never leaves your Apple ID's keychain.
What we collect
Nothing that identifies you. We operate no server and no database. The app contains no analytics SDK, no advertising SDK and no crash reporter.
Your photos and videos
Files you add are encrypted on the device with AES-256 before they are written anywhere. The encrypted files are stored in your own private iCloud container, under your Apple ID. The encryption key is generated on the device and kept in your iCloud Keychain, which Apple protects with end-to-end encryption. If you turn iCloud storage off, the encrypted files stay on the device only.
We have no access to your iCloud container and no way to request it.
Permissions, and why
- Picking photos. Selection happens in Apple's system picker, which hands the app only what you chose. The app never reads the rest of your library.
- Photos. Requested only if you choose to delete the originals after importing, and only for the items you picked.
- Saving back out. Exporting writes the file back to your photo library.
- Face ID. Used to unlock the vault and to reset a forgotten passcode. Biometric data never leaves the device's Secure Enclave and is never seen by the app.
- Camera. Off by default. If you switch on the break-in photo (a Premium feature), the front camera takes one still after repeated wrong passcodes. The picture is encrypted with the same key as your files and stored beside them. It never reaches us, and clearing the log deletes it.
Purchases
Subscriptions and the lifetime purchase are processed by Apple. We use RevenueCat, Inc. to verify receipts and to tell the app whether your purchase is active. RevenueCat receives a random identifier generated for your installation and the transaction details Apple provides. It does not receive your name, your email or anything about your files. See RevenueCat's privacy policy. This is the only external service the app contacts.
Your rights
Because we hold no personal data, there is nothing for us to access, correct or delete. Your files are under your control at all times: export them, delete them in the app, or delete the app's data from iCloud in Settings → [your name] → iCloud → Manage Storage.
Children
The app is not directed to children under 13 and collects no personal information from anyone.
Changes
If this policy changes, the new version appears on this page with a new effective date.