Privacy principles

Your photographs should remain under your control.

The public website describes the product. It does not need personal photographs to do that. Local processing and any future online workflow are separate, visible choices.

• Local first: desktop processing is designed to remain on the user’s device.
• Explicit transfer: online processing must be chosen, never assumed.
• Immutable originals: source files are not silently replaced or deleted.
• Separated data: photographs, voice, face data and indexes stay outside the source-code repository.
• Honest capability labels: planned features are never presented as already available.