Photo privacy checklist: access, copies, sharing and recovery

What this checklist is for

Use this review before lending a phone, moving files into a vault or cleaning up a photo library. It separates four questions: who can open a file, where copies exist, what happens when you share it and whether you can recover it. You do not need to upload any image to use this page.

The checklist is a suggested self-review, not a security certification. Print it using your browser if useful. Do not write passcodes, recovery phrases or sensitive filenames on a copy you intend to share.

First, choose the situation you are trying to prevent

Write a short goal such as “keep personal documents out of casual browsing” or “move to a new phone without losing my archive.” Avoid a vague goal such as “make everything safe.” Different threats call for different controls, and unnecessary changes can make your files harder to recover.

For a brief phone handoff, review showing one photo without swiping. For stored documents, follow the document workflow. Work through one situation first rather than changing every account at once.

Access: who can actually open the content?

• Identify who knows the device passcode or has an enrolled biometric.
• Check the lock used by the album or vault, including fallback access.
• Close the vault before lending the phone and verify its ordinary locked state.
• Review other signed-in devices that may have access to synchronized copies.

A different icon or an obscure folder name is not evidence of a separate access secret. Conversely, a built-in locked album may be sufficient for an ordinary accidental-display problem. Choose the boundary you need rather than assuming a paid app is always necessary.

Copies: where else does the file exist?

List the gallery original, vault import, cloud library, edited version, message attachment and exported file. Include shared locations and other devices. You do not need a spreadsheet of private filenames; a list of locations and responsibility is enough.

Decide which copy is authoritative and which are temporary. If iCloud Photos is involved, read how synchronized deletion works. Removing the visible phone copy is not automatically a local-only action, and keeping an old signed-in device is not automatically an independent archive.

Sharing: what will another person receive?

Inspect the selected items, visible content and recipient. Check location information when relevant. Decide whether the person needs to see a picture temporarily or keep a file. Review location-sharing controls when sending from Photos.

Assume an exported or received file can remain outside your control. Do not claim that a local vault can revoke every screenshot, download or forwarded copy. A clearer decision before sending is more reliable than attempting to recover control afterwards.

Recovery: what if this phone disappears?

Locate a surviving data copy and the required access secrets. Confirm that those secrets are available without the lost phone. A recovery phrase protects a route to keys; it does not store the photos themselves. If you cannot explain the restoration route, keep an independent copy of irreplaceable originals.

For Kofrix, distinguish the current iPhone iCloud backup from Android, which has no equivalent vault backup yet. Neither platform has live vault sync. Before replacing a device, use the migration checklist, and do not remove the old installation until the new one opens real files.

Finish with one useful action

Choose the most important unresolved issue: verify a backup, remove an unnecessary shared copy, fix an access setting or test a sample export. Record what you checked and what remains uncertain. Repeat after a device change, a new sharing arrangement or a major app update rather than changing dates just to appear current.

This page is published by Kofrix, a vault-app developer. The method deliberately includes built-in options and recovery limits so you can make a decision even if you never install Kofrix.