Which apps can see your iPhone photos? Check the route, not just the permission

An iPhone app can receive a picture you deliberately select without receiving access to your whole photo library. It can also ask separately for limited or full library access. Those are different routes, and they explain why an app may have a copy even when its Photos permission looks restricted.

Start with the action: did you pick an attachment, give continuing library access, take a picture inside the app, or share a file into it? Then inspect the permission that applies to that route. One switch cannot account for every copy you have already made.

The system picker is a selection window

Apple's Photos picker documentation explains that the picker runs separately from the requesting app and can provide selected assets without general library permission. You browse in a system-controlled interface and choose what to pass across.

For a profile picture, message attachment or a few imports, that is often all an app needs. The selected photo becomes available for the requested task. It does not follow that the app can quietly browse everything else you saw in the picker.

Vault Max uses that system picker for Photos imports. Its current source does not request general library permission just to select and import pictures. The app separately asks for the access needed when you choose operations such as deleting Photos originals or saving exports back to Photos.

A closer look

Actual sizeClose ×

Vault Max Add to vault menu with its import choices

A closer look

Actual sizeClose ×

Sample photos selected in the system import flow for Vault Max

Sample Vault Max library. Select a screen for a closer look.

Limited access is a library permission

An app that browses or edits a photo library through PhotoKit may request continuing access. Apple supports a limited selection so an app can work with a subset you allow. This is different from choosing one attachment for a single picker result.

Apple's limited-library explanation describes that selected subset and how people can update it. An app may behave differently with a limited selection because it cannot see every album or item it could see under broader permission.

If an editor cannot find a newly taken picture, inspect its permitted selection before concluding that the file is missing. If the app offers an updated selection interface, add only the item needed for the task. A broad permission grant should be a deliberate choice about the app's ongoing function.

Do not use Hidden as an app-permission filter

Full library permission gives an app broader PhotoKit access. It is useful for jobs that genuinely depend on a whole library, such as organizing it. It also deserves more scrutiny than selecting a single picture.

Apple's current Photos privacy notice says that Full Access can include hidden photos even when the album is locked. That is reason enough to avoid granting Full Access to an app that should receive only selected items.

Apple's PHAsset documentation describes a narrower API behavior: authenticated hidden assets are excluded from that fetch, and a person can still select hidden items through PhotosPicker. The two documents describe the boundary differently. We have not resolved that difference with a device test, so we do not promise that a locked Hidden album withholds items from every app with Full Access.

Keep Hidden authentication enabled for its Photos access controls. For another app, choose the permission or picker selection that matches what it should receive. A visibility label inside Photos is not a substitute for that choice.

The Hidden album comparison explains its access model beside a separate vault credential. Hiding an item and choosing a distinct encrypted collection remain different decisions.

Review the apps that already have permission

Open Settings → Privacy & Security → Photos and inspect the apps shown. The choices available depend on the app's request and your iOS version. Prefer the access that supports the job you actually use, and revisit apps that no longer need your library.

Apple's permission-management guide explains how to review categories and change an app's access. A permission screen describes a current authorization. It is not a history of every attachment you have ever given that app.

For a practical check, choose a harmless picture, select it in the intended app and see whether the task works without expanding access. If the app needs a different permission for a later action, read the explanation at that point. This is a trial you can perform on your device, rather than a claim that we tested every app/version combination.

A denied permission is not a delete command

Once an app has received a file, it may hold an independent copy. A service may already have an uploaded copy. Taking a photograph inside an app can also create content without reading the Photos library at all.

Changing Photos permission does not reach into those other storage locations and recall the file. To remove a service copy, use the service's own deletion controls and understand its retention policy. To remove a local app copy, follow that app's own storage and recovery rules. Keep your usable backup before deleting anything you need.

Vault Max's imported collection is separate from Photos. Disabling a Photos permission does not erase that collection, and importing does not remove the source by itself. Exporting later creates another copy outside the vault boundary.

Use the report as a clue, not a verdict

Apple's App Privacy Report shows permission use and contacted domains over its reporting window after you enable it. If activity surprises you, use the app's policy and developer explanation to investigate the specific action.

A domain entry does not tell you which readable photos, if any, were sent. Conversely, a file held locally can be accessible to an app without being collected by its developer. Keep permissions, on-device storage and provider collection as three separate questions.