Umbra vs Secret Photo Album

Search the App Store for "secret photo album" and you’ll get a dozen apps with nearly the same name. This page is about one of the most rated ones: Secret Photo Album - SA from BPMobile (seller BP Mobile LLC), with about 39,000 ratings and a 4.6 average on the US store. If the app on your phone is from a different developer, the details below don’t apply to it.

Everything we say about SA comes from its App Store listing and its privacy policy, both checked in November 2026. We haven’t tested its internals, and we won’t guess at them.

At a glance

What SA does well

Credit where it’s due. SA has been on the App Store for years, it’s actively updated (version 2.18 shipped in October), and its feature list is long:

• A decoy PIN that opens a fake album.
• Break-in alerts with photos of whoever entered the wrong PIN.
• An app lock after 3 incorrect PINs.
• A separate PIN for selected albums, an in-app camera, a private browser with an ad blocker, slideshows and custom album covers.
• Recovery of removed photos and videos, which helps if you delete something by mistake.
• Twelve languages, where Umbra is English only today.

If your goal is to keep a few photos out of your camera roll when someone borrows your phone, SA does that, and plenty of people are happy with it.

Accounts and the cloud

This is the biggest difference between the two apps.

SA’s listing says the Premium version offers unlimited cloud storage, and that to sync between devices or restore after a broken or lost phone "you’ll register your email in the app Settings". Its privacy policy says free users' files are stored "locally on your device and/or in your iCloud storage", and that for paid subscribers it "may engage a third party - Amazon Web Services, Inc." to store that data. On encryption, the policy says the company encrypts personal data "if possible" before sending it to hosting providers. It doesn’t say whether BPMobile can decrypt your photos.

The policy also says that if you delete your account, "all your data within the App will be lost", and that deleting the account doesn’t cancel an active subscription.

Umbra works the other way round. There’s no account and no Umbra server holding your photos. On iPhone and iPad, vaults back up automatically to your own iCloud, encrypted on the device first, and restore only with your recovery phrase. On any phone, including Android, you can export an encrypted .umbra backup file and keep it wherever you like. Backups move between iPhone and Android in both directions.

The trade-off is real. With SA Premium, your registered email restores your album on a new device. With Umbra, your recovery phrase (12 words, or one you choose) is the only way back if you forget your pattern, and nobody can reset it, including us. More on that in private photo apps without an account.

Tracking and data collection

App Store privacy labels are written by the developer, and SA’s is detailed. Under Data Used to Track You, meaning data that may be used to track you across other companies' apps and websites, it lists purchases, location, identifiers, usage data, diagnostics and other data. Under Data Linked to You it lists, among others, coarse location, user ID, device ID, advertising data and, for app functionality, photos or videos.

The privacy policy names the companies involved: Amplitude, Appodeal, AppsFlyer, Facebook (Meta), Firebase, Google Mobile Ads and Qonversion, alongside Apple and Amazon Web Services. Several are described as analytics or ad management providers. If you’d rather not be tracked, iOS lets you turn off Allow Apps to Request to Track in Settings, which the policy itself points to.

Umbra has no analytics and no advertising SDKs. The only third-party code is RevenueCat, which handles purchases and never sees anything in your vault. On iPhone, ad attribution uses Apple’s AdServices token through RevenueCat, so there’s no tracking prompt and no advertising identifier.

For a vault app, this matters more than usual. The app knows when you open your private photos and how often. It’s worth knowing who else might.

Encryption: what each side tells you

SA’s listing says it keeps files "in the encrypted, PIN-protected storage that only you can access", and mentions "encrypted cloud storage". It doesn’t say which cipher, how the PIN becomes a key, or whether the cloud copy is encrypted with a key BPMobile doesn’t hold. That doesn’t mean it’s weak. It means you can’t tell from the outside.

Umbra publishes the details. Your pattern is stretched with Argon2id (64 MiB of memory, 3 passes) and mixed with a secret that never leaves the device, held in the iOS Keychain or Android Keystore. So files copied off the phone can’t be guessed at on another computer. Every photo, video and document is encrypted with AES-256-GCM under its own random key, and videos stream from the encrypted file without being written to storage in the clear.

A PIN is also a smaller space to guess than a long pattern on a 5x5 grid, which is why the way it’s stretched into a key matters.

Decoy PIN vs duress pattern

Both apps give you a fake to show. SA’s decoy PIN opens a fake album with its own contents. That handles the "show me what’s in there" moment.

Umbra’s duress pattern (Pro) opens a decoy vault and, at the same moment, removes the patterns for every other vault from the phone. Even if you’re then asked for "the other" pattern, it no longer opens anything on that device. You can also choose to destroy their data on the device. Your real vaults come back later with their recovery phrases, and iCloud backups are never touched. With Pro, nothing on the phone records how many vaults exist.

The honest limit: neither app protects you from someone watching you enter your code, from a compromised phone, or from a vault you’ve left open.

Price

SA is a free download. Its listing shows ten in-app purchases from $2.99 to $23.99, most labelled "Premium" or "Subscribe to Premium", including a "Special offer - 50% off" at $5.99. The listing doesn’t say which are weekly, yearly or one-time, so check the in-app paywall before you pay.

Umbra’s free plan holds up to 3 vaults, 100 photos and 10 videos in total, with unlimited notes and documents and every security feature except the Pro ones. Umbra Pro is $1.99 a week, $14.99 a year with a 7-day free trial, or $39.99 once. On the App Store there are also family plans: $42.49 a year or $84.99 once, for up to 6 people through Family Sharing.

Which one fits you

• Choose Secret Photo Album if you want an email-based cloud that restores your album when you sign in on a new device, more languages, or a private browser in the same app.
• Choose Umbra if you don’t want an account, don’t want analytics or ad SDKs in the app that holds your private photos, want to know exactly how your files are encrypted, or need the vault on Android too.

If you only want to keep photos off your main grid from people who don’t know your passcode, Apple’s built-in Hidden album may be all you need. See Umbra vs the Hidden album.

Switching from Secret Photo Album to Umbra

1. Install Umbra, draw a pattern and save your recovery phrase.
2. Get your photos out of SA. Save them back to Photos or Files from inside SA. We haven’t verified its export steps, so check them in the app before you rely on them.
3. Import into Umbra from Photos or Files. Umbra encrypts each item and offers to delete the originals.
4. Empty Recently Deleted in Photos, or the originals stay there for 30 days.
5. Check that everything opens in Umbra before you delete SA or its cloud account. SA’s policy says deleting the account loses the data in the app, and that it doesn’t cancel your subscription, so cancel that in your Apple Account settings too.

Questions

Checked against public pages on 6 November 2026. Details change, so check the linked pages before you decide. Spotted something out of date? Tell us.