A browser is not a VPN. App Lock keeps the session closed on the phone. It does not hide your IP address from sites you visit or from your network operator. Tracking protection is list-based and not absolute: known ads, analytics, and social trackers from bundled lists are blocked on the device, but no blocker catches everything. Private Browser Incognito is rated 17+ for unrestricted web access and is intended for adults.
A private browser still lives on a phone that other people can pick up. No history file, on-device blocking, and one-tap erase answer what the app stores and what extra requests a page tries to fire. They do not answer a roommate, a colleague, or a child who opens the icon. App Lock is that answer: a six-digit passcode and Face ID that keep the real session closed until you open it.
In Private Browser Incognito that lock is free for everyone in the shipping default. It is not a trial of three unlocks and it is not a paywall in front of the basics. Stealth Suite is a separate, optional kit for a decoy, a panic code, a break-in log, self-destruct, and a vault. The lock is the door. The paid kit changes what happens at the door. If you are still choosing a browser on architecture, start with The Best Private Browser for iPhone: What Actually Matters.
What App Lock actually does
App Lock sits in front of the real browser. Enter the six-digit passcode, or use Face ID if you enabled it, and the session you were in is there. Fail, and the app stays closed. There is no browsing history feature behind that door and no history file to clear. Every tab is a private session held in memory. Cookies and caches still exist for the life of the session. The lock does not erase them. It keeps other people from seeing them.
That is a different job from Safari’s device passcode, which protects the whole phone, and from a website login, which protects an account on a server. This lock is local. There are no accounts and no sign-in. There is no app server for browsing. The App Store privacy label is Data Not Collected: no analytics SDK, no ads in the app, no third-party SDKs. Your traffic still goes to the sites you visit, to a search engine if you search, and to Apple if you buy Stealth Suite. Locking the icon does not reroute those requests.
Face ID is a convenience on top of the code, not a second identity we store. You turn it on in the app. When the sensor matches, the real session opens. When it does not, you type the six digits. Wrong attempts are a lock problem. In Stealth Suite they can also become a timestamped log, an optional photo, or a wipe, depending on what you turned on. None of that is required to use the free lock.
The passcode is the key, not a password we store
Most apps that ask for a PIN keep a verifier so they can tell you that you typed it wrong, and so they can offer a reset. That design needs a stored secret, or a hash of one, or a server that will email a link. App Lock in this browser does not work that way. The passcode is never stored. It becomes the key. The six digits derive the encryption that seals data the lock is meant to protect. We cannot show you the code. We cannot hash-compare our way to a reset.
Forgotten passcodes cannot be recovered. If you forget it, data sealed under it is permanently inaccessible. That is not a support article we can reverse later. It is how the key works. There is no recovery email because there is no account. If Face ID is still enabled you can unlock with it and then change the code while you still remember a path in. If Face ID is off and the code is gone, reinstalling lets you start a new app. It does not restore sealed tabs or vault files. The longer version of that irreversibility is If You Forget the Passcode There Is No Recovery.
Choose a code you can remember without writing it on a note that lives in the same pocket as the phone. Do not pick a birthday that everyone in the house already knows. Do not pick six identical digits because they are easy to type in a hurry. The lock is only as strong as the number you will actually keep, and as honest as the fact that we cannot fish it out of a database that does not exist.
What stays free versus Stealth Suite
The free product already includes private tabs with no history file, on-device ad and tracker blocking powered by the open Disconnect lists that ship inside the app, one-tap erase, HTTPS-Only Mode on by default, search with Google, Bing, DuckDuckGo, Wikipedia, or a custom engine, and App Lock. Search suggestions are off by default. The app asks before sharing a keystroke. Lists are not downloaded at runtime. The app does not sit in the middle of your traffic as a proxy, and it is not a VPN.
Stealth Suite is optional Apple IAP: monthly $4.99, yearly $19.99 with a 7-day trial, or lifetime $49.99. The subscription group display name is Stealth Suite. It adds a decoy passcode, a panic code, a break-in log with optional Intruder Photo, self-destruct, the encrypted vault (AES-256, no plain copy on disk, excluded from backups), and icon colors. Icon colors recolor the shield: Midnight, Ocean, or Ember. Same mark, your color. There are no calculator, notes, or weather disguise icons in the shipping app.
If a subscription lapses, protections you already enabled keep working and the vault stays accessible. New downloads that require an active unlock follow the lapse policy in the terms. We do not hold the vault hostage. We also do not invent other price points. Purchases go through Apple. Subscriptions auto-renew until cancelled.
Shared phones, decoys, and the rest of the kit
Lock without a decoy is the right default for most people. Closed is an acceptable answer when the threat is casual: someone picks up the phone, the icon does not open, they put it down. Shared iPhones are a different audience. Someone asks you to unlock the browser. Refusing is itself a signal. A second code that opens a clean, empty browser is how that request is handled without mixing the two worlds. That decoy is Stealth Suite, not part of the free lock. Details live in Decoy Passcode: A Second Browser That Shows Nothing and in Private Browsing on a Shared iPhone.
A panic code is another number at the same lock screen. It silently wipes tabs, the entire vault, and the break-in log, then opens what looks like a fresh start. That wipe is irreversible. Self-destruct fires after too many wrong codes: saved tabs are destroyed, and optionally the vault with them. Intruder Photo is off until you enable it. Camera permission is asked when you turn that feature on, never at the lock screen. Photos may depict other people. You are responsible for local law.
Session erase is still the everyday control. The trash action closes every tab and destroys cookies, cache, and site data. There is a home-screen quick action so you do not have to open the app first. Session erase does not empty the encrypted download vault. Lock, erase, decoy, and panic are four different verbs. Use the one that matches the room you are in.
Honest limits that a lock does not cancel
A locked browser is still a browser. Websites you visit see your IP address, the usual headers, and whatever you type into their forms. Your network operator sees destinations. None of that is solved by a six-digit code. We do not claim fingerprint spoofing as a product, Tor, a proxy, or IP hiding. Private Browser Incognito is iOS only. It is not Android, not desktop, and not a password manager.
List-based blocking is not absolute. New trackers appear. Some requests will never match a rule. You can add per-site exceptions when a page needs a blocked resource to function. HTTPS-Only Mode asks before falling back to insecure HTTP. That does not hide who you are talking to. The 17+ rating is not decoration. This is a real web browser with unrestricted access. You are responsible for what you visit and for using the app lawfully.
If you are comparing apps, the lock question is simple: is it free, is the secret stored, and can anyone recover it. A compact table is more useful than adjectives.
| Control | What it does | Cost |
|---|---|---|
| App Lock | Six-digit passcode and Face ID open the real session or keep it closed | Free |
| Decoy passcode | A second code opens a clean, empty browser. Real tabs stay hidden | Stealth Suite |
| Panic code | Wipes tabs, vault, and break-in log, then looks like a fresh start | Stealth Suite |
| Passcode storage | Never stored. It is the key. No recovery | Same for free lock and paid kit |
Use that table on this app and on anything else you install. If a product can email you a new PIN, it stored something we refuse to store. If a lock is bundled only with a subscription, it is doing a different job from a free door in front of a forgetful engine. Private Browser Incognito is built so there is nothing to trust us with: no accounts, no browsing server, lists on device, passcode as the key. Sites still see requests. Phones still get borrowed. The lock is for the person holding the phone, not for the network behind it.
Private Browser IncognitoFree on the App Store. No history, on-device blocking, one-tap erase.
Get the app
Frequently asked questions
Is App Lock with Face ID free?
Yes. App Lock with a six-digit passcode and Face ID is free for everyone in the shipping default. There are no accounts and no sign-in. Stealth Suite is optional if you want a decoy passcode, panic code, break-in log with optional Intruder Photo, self-destruct, an encrypted download vault, and icon colors (Midnight, Ocean, Ember).
What happens if I forget the App Lock passcode?
The passcode is never stored. It becomes the key. Forgotten passcodes cannot be recovered. If you forget it, data sealed under it is permanently inaccessible, by you or by us. There is no reset email and no support article that reverses the key. If Face ID is enabled you can still unlock with it. Reinstalling starts a new app. It does not restore sealed data.
Does App Lock hide my IP address?
No. A browser is not a VPN and App Lock does not hide your IP address. Sites you visit and your network operator can still see it. The lock is about who can open the app on the phone. It does not change page loads, search, or the public IP. Private browsing on iPhone is about residue on the device, not anonymity on the network.
What is the difference between App Lock and a decoy passcode?
App Lock is one six-digit code, with Face ID if you enable it, that opens the real session or keeps it closed. A decoy passcode is a second code in Stealth Suite that opens a clean, empty browser while real tabs stay hidden. Lock is free and is enough when refusing to open the app is acceptable. The decoy is for when you must unlock something that looks unused.
Does locking the app need an account?
No. Private Browser Incognito has no accounts, no sign-in, and no app server for browsing. The App Store privacy label reads Data Not Collected. There is no analytics SDK, no ads in the app, and no third-party SDKs. The passcode stays on the device as the key. We cannot reset it because we never received it.