The slides above are these answers, condensed. Everything below is the full version.
Contact: open an issue on GitHub — a real person reads these, and you can see the answers to everyone else's questions too.
There is nothing anyone can do, including us. This is not a policy we can make an exception to — your code is what derives the key your photos are encrypted with, and we never receive it or anything derived from it. Without the code the encrypted data is unreadable to everybody.
We say this loudly before you set a code, because it is the honest cost of nobody else being able to open your vault.
No. Downloading, exporting to your camera roll, and deleting your iCloud copy are all free and always will be. Only uploading is part of Pro. A subscription that ended cannot leave your own photos stranded.
No. Photos are encrypted on your iPhone before anything is uploaded, so what reaches iCloud is data that cannot be read without your code. Album names, dates and deletion state are encrypted too — the grouping of a vault is itself sensitive.
New photos stop uploading. Everything already in iCloud stays there and can still be downloaded. Nothing is deleted, and nothing is held hostage.
An optional feature for the situation a passcode cannot help with: someone standing over you demanding you open the app. A second code opens a separate vault with its own photos and its own encryption key. It cannot reach your real vault, and nothing inside it shows that a real vault exists.
Deleted photos stay recoverable for 30 days, then are erased for good. They still take up space on your phone until then.
The full security explainer — how the encryption works, what leaves your device and what never does, why we collect nothing, and the limits we state out loud: Why you can trust Veilbox.
iPhone or iPad running iOS 16 or later; runs on Apple Silicon Macs too. iCloud backup needs an iCloud account and Veilbox Pro.