How your data is protected
Encrypted on your iPhone
Everything you add — documents, photos, videos, notes, scans, and the names of your files and folders — is encrypted on this iPhone before it is saved. Each file gets its own random 256-bit key and is encrypted with AES-256-GCM, using Apple's CryptoKit. Names, folders and notes are kept in a database encrypted with SQLCipher.
Your pattern is never stored
When you draw your pattern, Vely turns it into a key using Argon2id, a deliberately slow function, combined with a secret that is kept in this iPhone's Keychain and never leaves it. The pattern itself is not saved anywhere, and it only works on this iPhone. You can open your vault with your pattern, your recovery phrase, or Face ID if you have turned it on.
Your recovery phrase
Your 12-word recovery phrase opens your vault if you forget your pattern, and you need it to restore your iCloud backup on a new iPhone. We show it once and never store it, so we can't show it to you again. Keep it somewhere safe and offline.
Your recovery phrase restores access to encrypted data that still exists. It does not back up your files.
If you lose both your pattern and your recovery phrase, we can't help you open your vault. We don't have your keys.
Face ID (optional)
Face ID is off unless you turn it on. When it's on, Vely keeps a separate key in this iPhone's Keychain that only Face ID can release. If a face is added or changed, or your iPhone passcode is turned off, Face ID unlock stops working. Your pattern and recovery phrase still work, and you can turn Face ID on again. Face ID can't restore a backup on another iPhone.
Encrypted iCloud backup (if you turn it on)
Vely encrypts your files on this iPhone before backing them up to your private iCloud storage, using Apple's CloudKit. Apple receives only encrypted data: not your files' contents, their names, your notes or your keys. To restore on a new iPhone, you need the same Apple Account and your recovery phrase, and then you draw a new pattern. The backup uses your iCloud storage. It is a backup, not sync: changes you make after a backup aren't in it until the next one. Vely backs up when you tap Back Up Now, and about once a day while you use the app, but only while your iPhone is unlocked. It keeps your two most recent backups.
No account, no Vely servers
There is no sign-up and no Vely server. The app connects to the internet only for purchases, through Apple's App Store and our payments provider, RevenueCat, and for iCloud backup if you turn it on. Apple and RevenueCat see your purchase, never your files.
When you leave the app
Vely locks your vault as soon as you leave the app, hides its contents in the app switcher, and blurs the screen during screen recording or mirroring. A backup that's in progress can keep uploading already-encrypted data for a while.
Wrong patterns
After several wrong patterns, you have to wait before trying again, up to 15 minutes. This slows down someone guessing on your screen. It is a deterrent, not an encryption feature, and it doesn't stop someone who has copied your iPhone's storage.
If you delete Vely or lose your iPhone
If a backup has completed: You can restore your last iCloud backup, from
If no backup has completed: Your vault will be gone. Your recovery phrase can't bring back files that no longer exist. Turn on iCloud backup to protect against this. Deleting Vely doesn't delete your iCloud backup. To delete it, go to Settings > iCloud Backup.
When you delete a file
It stays in Recently Deleted for 30 days. After that, or when you delete it there, Vely removes the file and its key from this iPhone. It stays in your iCloud backup until Vely replaces the backups that contain it, which takes up to two more backups. Copies you exported or shared earlier aren't affected.
What this doesn't protect against
- Someone who knows your pattern or watches you draw it. You can hide the pattern trail in Settings.
- Someone who has your iPhone while your vault is open.
- Malicious software, a jailbroken iPhone, or someone with full control of your unlocked iPhone.
- Someone who knows or gets past your iPhone's passcode and copies its storage. They could try to guess your pattern on their own computers, without the waits. A longer, less predictable pattern makes this much harder.
- Someone who has both your recovery phrase and access to your Apple Account. They could restore your backup.
- Files you export or share. Those copies leave the vault and are not encrypted by Vely. While a file is open in a preview or being shared, a temporary unencrypted copy exists on this iPhone. Vely deletes it when you close it, when the vault locks, and the next time the app opens.
- Screenshots or photos of your screen.
- Losing files that were never backed up.
What could still be seen
Someone with access to your iPhone's storage could see that Vely is installed, how many files you have, their sizes, and roughly when they were added. Apple, or someone with access to your iCloud data, could see that you use Vely's backup, how many encrypted files it holds and their sizes, and when backups happen. Neither can see names or contents, though a file's size can hint at what kind of file it is.