Vaultine for Activists — Protecting Photos and Contacts During a Search

Situations this covers

—Police or security personnel ask to unlock your phone during a stop, search, or arrest.

—Photos or videos from an event could identify people who'd be put at risk if they were found.

—Contacts and planning details for an event or campaign shouldn't be readable by whoever ends up holding the device.

—A phone taken during an arrest and later returned isn't one you should trust with sensitive files afterward.

What does the work

Duress Vault

A third code opens an empty vault and wipes the real ones as it does — for when you have to unlock and the files must not survive intact. Afterwards that vault simply becomes your main one, with no empty shell left behind.

Decoy Vault

A second code opens a separate vault stocked with files you chose, so a forced unlock shows something ordinary instead of an empty screen or a refusal.

Zero-knowledge design

Encryption keys are derived on your device and never leave it. There's no server holding anything that could be subpoenaed, breached or handed over.

No account or email to sign up

Nothing links the vault back to your identity.

Multiple separate vaults

Keep event photos, contacts and planning material apart from your personal files and from each other.

Works on Windows, macOS, iOS and Android

The same vault on the phone you carry and the laptop you organize from.

Two codes, two different jobs

A Decoy Vault and a Duress Vault solve different problems, and it's worth being precise about which one does what before you're relying on either.

The Decoy Vault opens on a second code and shows exactly what you stocked it with in advance — a set of ordinary files you chose. It's for the situation where you need to unlock something, and an empty vault would itself be suspicious.

The Duress Vault is a third code that opens an empty vault and wipes your real ones as it does. And it isn't left as a conspicuous empty shell afterwards: that vault becomes your main vault, as though nothing else had ever been on the device. It's for the situation where the files genuinely cannot survive the unlock — event photos that would identify someone, contacts that shouldn't be traced, planning notes that shouldn't exist to whoever is holding the phone. Both are configured by you ahead of time, not improvised in the moment.

Nothing to compel

Vaultine has no account system and no server that holds your files or your encryption key. The key is derived from your code, on your device, and it never leaves. That's a design decision with a practical consequence: there is no vendor-side copy of anything for anyone to request, subpoena or breach — because it was never there to begin with.

Separate vaults for separate things

Photos from an event, contacts for a campaign, and your own unrelated personal files don't have to share one vault. Vaultine supports as many separate vaults as you need, so organizing material can be kept apart from your personal life and from any other campaign you're involved in — on the same phone you already carry, or on a laptop, since Vaultine runs on Windows, macOS, iOS and Android alike.

The bottom line

None of this replaces the judgment calls that actually keep people safe — what you photograph, who you tell, what you carry to an event at all. What it does is make sure that if your phone is the thing being searched, what's on it is a decision you already made ahead of time, not one someone else gets to make for you in the moment.

Frequently asked questions

Can I make sensitive files disappear if my phone is searched or confiscated?

That's what the Duress Vault is for: a separate code that opens an empty vault and wipes your real ones as it does. Once it has, that vault becomes your main vault, so there is no empty shell left sitting there to explain. It's a different mechanism from the Decoy Vault, which shows a separate stocked vault rather than deleting anything.

What does someone see if I'm forced to unlock my phone?

Whatever you put in the Decoy Vault ahead of time — a second code opens a vault stocked with files you chose, so the unlock produces something ordinary rather than nothing at all.

Is there anything Vaultine could be asked to hand over about what's in my vault?

No. The encryption key is derived from your code on your device and never leaves it. There's no account and no server holding your files or your key, so there's nothing on our end to compel.

Does Vaultine need an internet connection to work?

No — opening, viewing and locking the vault all happen on the device. An optional encrypted backup to your own Dropbox needs a connection when you choose to run it, but the vault itself works with no signal at all.

The wrong person unlocking your phone shouldn't put anyone else at risk.