Ironbox — private photo vault

The problem with photo vaults

Most photo vaults hide your files inside private app storage. That sounds secure, and it is — right up until you uninstall the app, clear its data, or change phone. Then the files are gone. Some vaults will sell you cloud recovery to get them back.

Ironbox is built the other way around.

How it works

Your folder, not ours. You choose a real folder on your own storage. The encrypted vault lives there, so it survives uninstalling the app.
No permission needed to use it. Importing goes through the system photo picker, which needs none. One optional extra — deleting the originals from your gallery after an import — does need access to your photos, and Android asks you at the moment you tap it. Say no and everything else still works.
AES-256-GCM encryption, per file, with the key derived from your PIN using Argon2id. Thumbnails are encrypted too — a plaintext thumbnail cache is a classic vault leak.
A 6-word recovery phrase that only you hold. We have no copy and cannot reset it.
No account, no network, no analytics. This version does not hold the INTERNET permission at all, so it cannot open a connection even if it wanted to — you can check that yourself on the Play listing rather than taking our word for it.
Export is free forever — at every tier, with no cap. Getting your photos back out is never something you pay for.

The trade-off, stated plainly: because the key is derived from your PIN and the recovery phrase never leaves your hands, nobody can recover your vault if you lose both — not us, not Google, not a support ticket. That is what makes it private. Write the phrase down on paper before you put anything important in.

What it costs

Ironbox is free. There is nothing to buy in this version — no purchase screen, no advertising, no subscription, and no billing code inside the app at all.

Install it during the launch period and you keep a 200-item vault, permanently. That is a founding-installer promise, decided by when you first ran the app and never revoked afterwards. Installs after the launch period get 30 items.

A later version will offer a one-time purchase to remove the cap entirely — no subscription, ever. If you are already a founding installer, your 200 items stay free whether you buy it or not.

Two things that are free forever, at every tier: getting your own files back out, and opening a vault you already made. A cap limits only how many new items you can add. Nothing you have already stored is ever locked away from you.

Requires Android 11 or later.