A browser is not a VPN. App Lock keeps the session closed on the phone. It does not hide your IP address from sites you visit or from your network operator. Tracking protection is list-based and not absolute: known ads, analytics, and social trackers from bundled lists are blocked on the device, but no blocker catches everything. Private Browser Incognito is rated 17+ for unrestricted web access and is intended for adults.
App Lock asks two questions that sound like one. How do you open the browser quickly? What actually seals the session if the secret is lost? Face ID answers the first. A six-digit passcode answers the second. Mixing them is how people expect a face match to restore a forgotten code, or expect the iPhone passcode to open this app. Those expectations fail on purpose. This page keeps the two unlocks apart.
Both are free in the shipping default. App Lock is not a Stealth Suite trial and it is not a paywall in front of the basics. The broader walkthrough of the lock as a door is App Lock With Passcode and Face ID. This article is the narrower split: key versus convenience, this code versus the device code, and why we cannot reset either from a help desk.
The passcode is the key
The six-digit passcode is the secret that seals data the lock is meant to protect. It is never stored. It becomes the key. We cannot show it to you later. We cannot email a reset. We cannot hash-compare our way to a new number because we did not keep a verifier on a server. There is no account that would receive that email anyway. There is no app server for browsing.
That design is the opposite of most PIN screens. A typical app stores enough to tell you that you typed it wrong, and enough to offer a forgot-password path. Convenience for the vendor is a stored secret, or a hash of one, or a cloud identity. Convenience here is the opposite: if the number leaves your head, the sealed data leaves with it. Forgotten passcodes cannot be recovered. Data sealed under the passcode is permanently inaccessible, by you or by us.
Choose a code you can remember without a note in the same pocket as the phone. Do not pick a birthday the household already uses. Do not pick six identical digits because they are fast in a hallway. The lock is only as strong as the number you will actually keep, and as honest as the fact that support cannot fish it out of a database that does not exist. The irreversible version of that sentence is If You Forget the Passcode There Is No Recovery.
Face ID is convenience, not a second key
Face ID is how you skip typing the six digits when the sensor matches. You turn it on in the app. When it matches, the real session opens. When it does not, you type the passcode. That is the whole relationship. Face ID is not a backup key we hold. It is not a second identity stored on a Private Browser server. It is not something we can reset for you if the passcode is gone.
We will not invent biometry APIs, sensor internals, or a claim that the face lives in our cloud. Unlocking with Face ID uses the device’s existing biometrics, with permission you grant in the app. If Face ID is off, the passcode is the only path. If Face ID is on and you still remember the code, you can change the code after you open the app. If Face ID is on and the code is already forgotten, you may still open the app while the face match works, which is the moment to set a code you can keep. That window is luck and device behavior, not a recovery product we sell.
If Face ID is off and the passcode is gone, reinstalling lets you start a new app. It does not restore sealed tabs or vault files. There is no support article that reverses the key. Treat Face ID as faster unlocking for a key you still own. Treat the passcode as the key. Do not treat the camera as a spare copy of the number.
This lock is not your iPhone passcode
The device passcode (or device Face ID) unlocks the phone. App Lock is a six-digit code that opens this browser or keeps the session closed. Unlocking the iPhone does not open Private Browser Incognito if App Lock is on. Someone who knows the phone code and does not know the app code should meet a closed browser. That is the point on a shared device: the home screen is not the session.
The two secrets should not be the same number if you can help it. A borrowed phone is often unlocked already. Reusing the device code turns App Lock into a delay, not a door. We cannot force you to pick a different six digits. We can say the jobs are distinct. Apple’s lock is for the device. Ours is for this app. We do not receive either one.
App Lock does not erase the session by itself. Every tab is still a private session in memory. There is no history file. Cookies and cache live for the life of the session. The lock keeps other people from seeing that session. One-tap erase is the control that destroys it. Lock and erase are different verbs. Use lock when the phone might be picked up. Use erase when the working state should die.
App Lock is free. Stealth Suite is a different kit.
App Lock with a six-digit passcode and Face ID is free for everyone in the shipping default. It is not metered as a trial of unlocks in that default. You should not have to pay to close the real session. Stealth Suite is optional Apple IAP: monthly $4.99, yearly $19.99 with a 7-day trial, or lifetime $49.99. It adds a decoy passcode, a panic code, a break-in log with optional Intruder Photo, self-destruct, the encrypted vault, and icon colors (Midnight, Ocean, Ember). The split is What Stealth Suite Adds (and What Stays Free).
The decoy is a second code that opens a clean, empty browser. Real tabs stay hidden. No sign Stealth Suite exists in the decoy. That is not Face ID doing a trick. That is a second passcode performing a different scene. Panic is another number at the same lock screen. It silently wipes tabs, the entire vault, and the break-in log, then opens what looks like a fresh start. Self-destruct fires after too many wrong codes. None of that is required to use the free lock. None of that is a Face ID feature we invent.
If a subscription lapses, protections you already enabled keep working and the vault stays accessible. The free lock does not lapse, because it was never paid. There are no accounts and no sign-in. The App Store privacy label is Data Not Collected: no analytics SDK, no ads in the app, no third-party SDKs. Purchases, if you buy the kit, go through Apple.
What a lock does not cancel
A locked browser is still a browser. Websites you visit see your IP address, the usual headers, and whatever you type. Your network operator sees destinations. Face ID does not hide an IP. A six-digit code does not either. We do not claim fingerprint spoofing, Tor, a proxy, or anonymity. List-based blocking from bundled Disconnect lists is not 100 percent. HTTPS-Only Mode asks before falling back to insecure HTTP. It does not hide who you are talking to.
Intruder Photo, if you enable it in Stealth Suite, is off until you turn it on. Camera permission is asked when you enable that feature, never at the lock screen. Photos may depict other people. You are responsible for local law. Rated 17+ means unrestricted web access. You are responsible for what you visit and for using the app lawfully.
If you are comparing apps, the Face ID question is not whether the screenshot shows a smile frame. The questions are: is the lock free, is the passcode stored, can anyone recover it, and is biometry a convenience on top of a key you still have to remember.
| Unlock | What it is | What it is not |
|---|---|---|
| Six-digit passcode | The key. Never stored. No recovery | Not your iPhone passcode |
| Face ID | Convenience unlocking while enabled | Not a second key we can reset |
| Device passcode | Unlocks the phone | Does not open this app by itself |
| Decoy passcode | Stealth Suite. Opens an empty browser | Not part of the free lock |
| Forgot the code | Sealed data is inaccessible | Not a support reset |
Use the table on this app and on anything else you install. If a product can email you a new PIN, it stored something we refuse to store. If Face ID is marketed as a recovery path, it is doing a different job from convenience on top of a key. Private Browser Incognito is iOS only. The lock is for the person holding the phone, not for the network behind it. Keep the passcode. Treat Face ID as faster unlocking. Do not wait for us to remember a number we never received.
Private Browser IncognitoFree on the App Store. No history, on-device blocking, one-tap erase.
Get the app
Frequently asked questions
Is Face ID or the passcode the real App Lock key?
The six-digit passcode is the key. It is never stored. Face ID is convenience unlocking so you do not have to type the six digits every time. Face ID is not a second key we can reset. If you forget the passcode, we cannot recover it from Face ID or from support.
Is App Lock with Face ID free?
Yes. App Lock with a six-digit passcode and Face ID is free for everyone in the shipping default. Stealth Suite is a separate optional kit for a decoy passcode, panic code, break-in log, self-destruct, an encrypted vault, and icon colors. Paying does not unlock the lock. The lock already ships free.
What happens if I forget the App Lock passcode?
Forgotten passcodes cannot be recovered. The passcode is never stored. It becomes the key. Data sealed under it is permanently inaccessible, by you or by us. There is no reset email. If Face ID is still enabled you can unlock with it and change the code while you still have a path in. Reinstalling starts a new app. It does not restore sealed data.
Is App Lock the same as my iPhone passcode?
No. Your device passcode unlocks the phone. App Lock is a six-digit code that opens this browser or keeps the session closed. They are distinct. Unlocking the iPhone does not open Private Browser Incognito if App Lock is on. We cannot reset the app code because we never received it.
Does Face ID replace the passcode if I forget it?
No. Face ID is convenience, not a backup key we hold. It can open the app while it is enabled, which is useful if you still remember enough to change the code after unlocking. It is not a recovery channel. We cannot reconstruct a forgotten passcode from a face match or from any server, because there is no such server.