A private photo app that doesn’t need an account

Plenty of photo vault apps start with a sign-up screen. It feels normal, because almost every app does it. But a vault is a special case: the whole point is that the photos inside are nobody else’s business. An account ties those photos to an identity and, often, to a server you don’t control.

What an account changes

An account isn’t automatically bad. It is how many apps offer cloud backup and password resets. But it brings trade-offs you should choose knowingly:

• Your identity is linked to the vault. An email address or phone number connects a real person to the fact that they keep private photos in that app.
• Someone else can reset access. If a company can reset your password by email, then whoever gets into your email can get into your vault, and so can the company.
• Your data may live on their servers. Cloud storage run by the app maker is another place your photos exist, protected by their security and their policies.
• More data to collect. Account apps usually also run analytics, so your usage gets logged against your account.

What "no account" should actually mean

"No account" is a claim worth checking, because an app can skip the sign-up screen and still identify you in other ways. A genuinely account-free vault looks like this:

1. No sign-up, email or phone number to start, or to unlock anything later.
2. Keys made on your phone. Your passcode or pattern turns into the encryption key on the device itself, instead of being checked against a server.
3. Recovery that doesn’t go through the company. If you forget your passcode, you recover with something only you hold, like a recovery phrase. Nobody can reset it for you.
4. No analytics or advertising code. Otherwise the app can still build a profile of your device and habits, account or not.
5. Backups encrypted before they leave. If the app backs up to a cloud, the cloud should only ever receive data it can’t read.

How to check any app in two minutes

You don’t have to take an app’s word for it.

• Read the App Privacy section on the App Store, or Data safety on Google Play. Look for "Data not collected" or "Data not linked to you". If you see contact info, identifiers or usage data linked to you, there is tracking.
• Read the privacy policy for the words analytics, advertising, third parties and servers. Note who they share data with.
• Look at the first screen. If it asks for an email before you can do anything, the account is part of the design.
• Check the recovery story. Search the help pages for "forgot password". "We’ll email you a reset link" means the company can get in. "Use your recovery phrase" means only you can.

How Umbra does it

Umbra was designed around having nothing to hand over.

• No account at all. Open the app, draw a pattern, save your 12 recovery words. No email, no phone number, no login.
• Your pattern is the key. It is stretched with Argon2id and mixed with a secret that never leaves your phone, then used to open the vault. It isn’t checked against a server.
• Every file is encrypted with AES-256-GCM and its own random key.
• Recovery without us. A 12-word phrase, or one you choose, restores your vault. We never see it, so nobody can ask us to reset it.
• No analytics, no ads. The only outside code is the purchase library that checks whether you have Pro. It gets an anonymous ID and your purchase history, never your vault.
• Backups we can’t read. On iPhone and iPad, iCloud backups are encrypted before they leave the device. On any phone you can export an encrypted backup file and keep it wherever you like.

Our privacy policy spells out the details, including what the purchase library and Apple Ads attribution receive.

The trade-off you accept

No account means no "forgot password" email. If you lose both your pattern and your recovery phrase, the vault can’t be opened by anyone, including us. That is the price of a vault nobody else can open. Write the phrase down and keep it somewhere safe and off the phone.

Questions