I have a few doubts about GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos, notes. etc., then do we have to get user consent or anything related to GDPR?

Example: a vault app.

Also, if the user is storing the data in our app, but the data is not encrypted, then do I need to encrypt data even if are aren't subject to GDPR?

The data is stored locally on the user's phone and it's not uploaded to server.
It's like a private gallery application which is password-protected. The user can move photos.