Manifesto
A phone can be taken. What's on it stays yours
sigil. exists for one moment: when your phone is no longer only in your hands. Someone has stolen it. Or someone is standing over you, telling you to unlock it. Even then, the photos, documents and pieces of your life you keep on it should still belong to you.
This is what we believe, and what we hold ourselves to.
Ten principles
Nobody has the key. Not even us
Your key is born from your sign, on your phone, each time you unlock, and it's gone when you lock. It never reaches us, so we can't lose it, sell it or hand it over. That isn't a promise we keep. It's how the app is built.
No account. No server. No back door
We don't know your name, your email or your number. There's no server where your photos could end up, and no master key for special cases. If someone asks us for your data, the honest answer is the only one we have: we don't have it.
A sign only you know. Not your face
Face and fingerprint are convenient, and that's the problem: someone can hold the phone up to your face, or press your finger to the sensor. A sign lives only in your memory. That's why sigil. opens with nothing else.
They force you. You choose what they see
With the decoy pattern, a harmless decoy vault opens and nothing is erased: your real vault stays hidden, because there's no list. It's for the moments when saying no isn't an option: a robbery, a threat, someone who won't stop. It's free, like everything that protects you.
Hidden from whoever snoops. Never from you
sigil. doesn't say how many vaults exist, and it can wear a neutral icon. But every feature has a name and an explanation in Settings, and every one is described to Apple's App Review. Nothing in the app is a secret from the person who owns it.
It lives on your phone. With its limits
Everything stays on your device. That is the protection, and it's also the limit: there's no cloud backup. If you forget your sign and lose your recovery phrase, nobody can open your vaults. Not us, not anyone. We'd rather tell you now than apologise later.
No absolutes. Only what's true
You won't read “unbreakable”, “military grade” or “100% secure” from us. Strong encryption is strong, not magic: someone with forensic tools and a short sign can get further than we'd like. We tell you what sigil. does, what it doesn't, and how to choose a better sign.
Privacy is the default. Not a setting
The app sends nothing to anyone and has nothing to switch off: no usage statistics, no photos, no names, not your sign, not how many vaults you have. This website has no cookies and no analytics.
Pay once. Or don't pay at all
Every feature is free, with 100 photos and documents and 10 videos per vault, for as long as you like. If you need more space, you can pay once and own it: €39.99, no subscription required. The yearly plan is there for people who prefer it, never as a trap. We don't make money by watching you, so we never need to.
A tool for protection. Never for harm
sigil. protects what is legitimately yours: from theft, from prying eyes, from someone who forces you. It is not a place for anything illegal, and never for material that hurts others, children above all. We can't see what you keep, and that is exactly why we ask you to respect this. The rules are written plainly in our Terms.
Yours. Only yours
Version 1.0 · 31 October 2026