iOS · Private photo vault
Shoebox
Photos nobody else should see.
Hand someone your phone without thinking twice. Shoebox keeps photos behind a PIN, encrypted on the device, out of your camera roll — and there is no networking code in the app at all, so there is nothing to upload and nothing that phones home.
No account · No cloudNo networking code
The problem is usually a person, not a server
Someone borrows your phone to look at a photo and starts swiping. You hand it to a child to keep them busy. You pass it round the table. Most of the worry about private photos is about the next thirty seconds, not about a data breach.
Shoebox is built for that: a separate place, behind its own lock, that does not announce itself. The app on your home screen is called Shoebox and its icon says nothing about what is inside.
What makes it different is that you can check
Every app in this category says it is private. Most of them keep your pictures on a server and ask you to take their word for it. Shoebox has no server to take anyone's word about — and rather than asking you to believe that, it ships the two things that would catch a lie:
- A test suite that fails if a networking symbol appears anywhere in the source, which stops the release.
- A script that inspects the shipped binary for networking frameworks and symbols, so the claim is about the app you install rather than about the code.
The output of both checks will be published here with the release.
What it does
One place. One lock.
-
01 · In
Import or shoot
Import from Photos or Files, or shoot straight in with the built-in camera. What you shoot here never reaches your camera roll.
-
02 · Browse
A grid by the day taken
Grouped by when each photo was taken, not when you imported it. Pinch, pan, and double-tap zoom — for video as well as stills.
-
03 · Organize
Albums and favourites
Enough structure to find things. Not a second Photos app.
-
04 · Lock
Face ID, Touch ID, or a PIN
A six-digit PIN with auto-lock you set. A decoy PIN opens a separate, empty vault — for when you are asked to unlock.
-
05 · Undo
Recently Deleted
A mis-tap costs you thirty days instead of the photograph.
-
06 · Screen
Screenshots come out black
Media is drawn in a layer that screenshots and screen recordings capture as black, and the app tells you the moment one is taken.
What it refuses to do
- No account. No sign-in. Nothing to create and nothing to be locked out of.
- No cloud, no sync, no server. There is nowhere for it to send anything.
- No share sheet, no copy, no AirDrop, no save-to-Photos.
- No analytics. No ads. No third-party code of any kind.
Moving it to a new phone
This is the question the whole category fails, and it is worth being plain about. A vault with no cloud has no way to restore itself. So Shoebox has exactly one door, and it is one you open deliberately:
Transfer writes your whole vault to a single encrypted file, protected by a passphrase you choose. Move it to a new phone, or keep it as a backup. Your photos are never decrypted to make it — the already-encrypted files are copied across exactly as they are, so nothing is ever in the clear outside the app.
And the part most apps leave out
If you lose this phone and have not saved a Transfer archive, the photos are gone. There is no copy anywhere, because that is the whole point. Shoebox is a vault, not a backup. Save an archive. Keep anything irreplaceable somewhere else as well.
How the privacy actually works
- Every file is encrypted with AES-256-GCM. The key lives in the device keychain marked this-device-only, so it never syncs to iCloud.
- The vault is excluded from iCloud and iTunes backups and never appears in the Files app.
- A decoy vault protects you from a person holding your phone. It will not defeat someone who can inspect the phone's storage directly.
- The screenshot blackout is a strong deterrent rather than a guarantee. Nothing can stop somebody photographing your screen with another camera.
Price
$4.99, once.
No version of this app that starts charging you for what it already did.