"We can't see your photos" is a claim, not a feeling
Every privacy app says some version of this. Most of the time it's marketing shorthand for "we try to be careful with your data," which isn't the same thing as "we structurally cannot access it." Those are different claims, and only one of them can actually be checked.
Here's what checking it looks like, in two parts: what happens on your iPhone before Privately is even involved, and what Privately adds on top of that.
Your photos are already encrypted before any app touches them
Since the iPhone 8, every file on the device, including every photo, is protected by a chip called the Secure Enclave, a separate processor that handles encryption keys independently of the main CPU. When a photo is written to storage, it gets its own encryption key. That key is itself wrapped by another key tied to your passcode and a hardware identifier burned into the Secure Enclave at the factory, one that can't be read out or extracted, not by a thief with the phone in hand and not by Apple.
Lock the phone, and the keys needed to decrypt that data become unavailable to the rest of the system. Face ID, Touch ID, or your passcode is what makes them available again. This is why a stolen, locked iPhone is, barring exotic hardware attacks, not a stack of readable photo files. It's encrypted noise until someone proves they're you.
None of this is specific to Privately. It's the baseline Apple gives every app on the platform, and it's already protecting your camera roll right now, hidden or not.
What "we don't see your photos" actually means for an app built on top of that
Given that baseline, an app can break the promise in exactly one way: by moving your photos somewhere the Secure Enclave's protection doesn't reach. A server, a cloud bucket, an analytics pipeline, a support ticket: anything with a network in the path counts.
That's the specific thing Privately doesn't do. There's no upload step anywhere in the app, no account to sign into that syncs your locked photos to a backend, no server that could be subpoenaed, breached, or simply misconfigured with your photos on it. If your library never leaves the device, there's no version of "we looked at it" that's physically possible, whether or not we'd want to.
You don't have to take that on faith from us specifically, either. The EXIF Remover and Photo Redactor tools on this site run the same way, except you can verify it yourself in about ten seconds: open your browser's dev tools, watch the Network tab, drop in a photo, and strip its metadata. Nothing goes out. It's the same architecture, just easier to point a debugger at than a native app.
Where Locked Albums add something the OS doesn't give you by default
If the whole device is already encrypted, what's left for an app to add? Separation. Regular Data Protection encrypts everything in your library equally, which is exactly the problem: your kid's birthday photos and the one photo you'd rather not have someone flip past sit behind the same unlock. Face ID once, and all of it is visible.
Locked Albums are a second, independent vault: photos moved in stop appearing in your Library, Camera Roll, and iCloud Photos sync, and unlocking your phone doesn't unlock them. They need their own Face ID, Touch ID, or PIN check. It's the difference between "encrypted along with everything else" and "encrypted, and also not sitting in the same room as everything else." We wrote a longer breakdown of that gap in how this compares to the iPhone's built-in Hidden album, which uses the same Data Protection this post describes but skips the separation part.
What this doesn't cover
To be precise about the limits of this: everything above is about the architecture, meaning where your data physically lives and who can technically reach it. It says nothing about legal process against Apple as the OS vendor, jailbroken or compromised devices, or someone standing behind you while your album is unlocked. Encryption solves the "can they reach it over a network" problem. It was never going to solve the "is your passcode also written on a sticky note" problem.
If you want the fuller picture of what a photo can expose even before it's locked away, we've written about the metadata every photo carries by default: GPS coordinates, device model, timestamps, none of which the Secure Enclave has any opinion about, since that's not what it protects.
Privately is free to download, with Locked Albums and the other Pro features available as a straightforward subscription: no trial, no upsell inside the vault itself.