An encrypted photo vault stores your photos as scrambled data that only turns back into photos with a key. No key, no photos. Not for Apple, not for the app maker, not for someone with the phone in hand.
Where the key comes from
In Vaultpod the key is derived from your pattern. The pattern is never stored; it is recomputed from what you draw. Every vault also has a recovery phrase, ten random words, which derives a second key that opens the same vault. Either one works; nothing else does.
What “on device” means
Encryption happens on the phone, before anything is written to disk or sent anywhere. When a backup goes to iCloud, it is the scrambled files that go. Apple stores them but cannot read them.
What is not hidden
Honest vaults say what they cannot hide. The total storage the app uses shows in iOS Settings. The number and sizes of encrypted files are visible to anyone who copies them. File names, dates and folders are inside the encrypted index, so those are hidden.
The trade
Strong encryption means no reset button. Lose the pattern and the phrase and the files are gone. A good vault makes you write the phrase down and lets you test the backup.