Privacy Policy

Short version

Neither app has accounts, analytics or telemetry. Your photos and videos go only where you send them: on the Mac, into the folder you chose; on the iPhone, to the computer, folder or app you chose. Nothing about you or your photos is sent to us. A purchase is handled by the App Store, except for the Mac version sold on this website, which checks its license key with our service. Place names for folders, and the map in the Mac app's transfer history, come from Apple's services. Each of these is described below.

Data the apps collect Both apps

No usage data. There is no registration, no login, no usage tracking, no crash reporting and no advertising SDK in either application. In App Store terms, the apps collect no data.

Buying in the App Store Both apps

The App Store versions unlock through an in-app purchase. The purchase, the receipt and any refund are handled entirely by Apple under Apple's own terms and privacy policy. The app receives only the signed purchase record from the system and stores nothing about you.

Your photo library iPhone app

The iPhone app asks for access to your photo library and reads it to show your photos, group them into folders and transfer them. It never deletes, edits or writes anything in the library. With limited access it sees only the photos you selected. When a photo's original is kept in iCloud and the phone holds a smaller copy, the app asks the system for the original, which downloads it from your iCloud account through Apple; the app itself talks to no server.

The page on your Wi‑Fi iPhone app

While the "To Computer" screen is open, the iPhone serves a small web page on your local network so that a computer on the same Wi‑Fi can download the photos. The phone only answers the computer that opens this address. It does not search the network or contact other devices on it.

• The page is reachable only on the network the phone is on, at the address shown on the screen, and only while the screen is open. It is never reachable from the internet, and nothing about it is registered anywhere.
• Every session is guarded by the four-digit PIN shown on the phone. Without the PIN the page shows nothing.
• The phone shows which browser is connected and what it has downloaded; it keeps no record of it after the screen is closed.
• The connection is plain HTTP over your Wi‑Fi: browsers refuse a phone's self-signed certificate, so it cannot be encrypted. Use it on a network you trust, as you would any transfer between your own devices.

Folders, archives and sharing iPhone app

When you choose a folder in Files, the system grants the app access to that folder for the current launch only; the app writes the files there and, if "New Files Only" is on, checks whether each file it is about to write is already there. The app does not keep the folder between launches. When you send an archive, the app packs it in its own storage and hands it to the app you pick in the share sheet; what that app does with it is covered by its own policy. Temporary files are removed when the transfer ends.

Data stored on the iPhone iPhone app

• A local index of your library — file names, sizes, dates and locations of the photos — so that the app opens instantly the next time. It is rebuilt from the library and never leaves the phone.
• Settings: the grouping, the folder-name presets, the language of the names, the transfer options, the names you gave folders and the folders you merged.
• Place names already found for your photos' coordinates, so they are not asked for twice.
• How many of the free photos you have used. This is stored in the phone's keychain so that reinstalling the app does not reset it.

Nothing in this list is uploaded anywhere. Deleting the app removes it, except the free-tier count, which the keychain keeps.

Buying on this website: the license key Mac app

The Mac version downloaded from this website unlocks with a license key. Checkout, payment, invoices and refunds are handled by our merchant of record, Paddle (Paddle.com Market Ltd, or Paddle.com Inc. for buyers in the United States), under its own privacy policy. We do not see your card details. Paddle passes us the order: a transaction identifier, the product bought and the email address you entered at checkout. Our license service issues the key and emails it to that address.

When you enter the key, the app sends to our license service:

• The license key itself, which identifies your purchase.
• An anonymous machine identifier: a keyed hash (HMAC-SHA256) of your Mac's hardware identifier. The hardware identifier itself never leaves your Mac, and the hash cannot be matched against any other app's. It lets the license count the Macs it is active on (a personal license covers up to three at a time).
• Your Mac's name as set in System Settings, so that you can tell your Macs apart when freeing a slot with support. You may rename the Mac before activating if you prefer.

Afterwards the app confirms the key with the same service about once a day, sending the key and the machine identifier again. Without a connection the license keeps working for 30 days from the last confirmation, then the app returns to the free tier until the next successful check. Nothing else is sent: no photos, no file names, no usage data. Requests carry your IP address as any network request does; the service does not keep it beyond short-lived rate-limiting counters.

On your Mac, the key and the activation record are stored in the keychain. Deactivating the Mac in the app's settings removes them and frees the slot. On our side, the key, the order identifier, your email address, the hashed machine identifiers and the Mac names are kept for as long as the license exists, and as long as tax and accounting law requires for the order; you can ask us to delete them once the license is closed. Paddle keeps the payment record under its own retention rules.

The legal basis for this processing is the contract of sale: the data is what is needed to deliver, check and support the license. You have the right to access, correct and delete your data and to complain to your data protection authority; see Contact below.

The App Store copy on the same Mac. If you bought the unlock in the App Store version and later install the website version on the same Mac, the website version reads the App Store copy's receipt locally to unlock itself for free. This happens entirely on your Mac; nothing is sent anywhere.

Updates (website version) Mac app

The website version checks for updates with the open source Sparkle framework. The check downloads a small update feed from this website over HTTPS about once a day, and the update itself when you accept it. The request carries your IP address and the app's version. Sparkle's optional system profile reporting is switched off. You can turn automatic checks off in the app's settings. The App Store version updates through the App Store only.

Data stored on your Mac Mac app

• No record of what has been transferred. To offer only new files on the next run, the app compares what a transfer would write with the files already in the destination folder; nothing about past transfers is kept.
• Settings and caches. Grouping preferences, folder naming presets, thumbnails and geocoding results are cached locally to avoid repeated work.

Nothing in this list is uploaded anywhere. Deleting the application data removes it.

Your connected device Mac app

The iPhone or iPad connected to the Mac is accessed strictly read only. The Mac app never deletes, edits or writes anything on the device.

The map in the transfer history Mac app

When you click a place in the transfer history, the map of that spot is drawn by Apple Maps (MapKit), which loads its map tiles from Apple at that moment. Nothing else is sent.

Place names Both apps

While this feature is on, both apps turn the coordinates already stored in your photos into city and country names, so that folders can be named after places. This reverse geocoding is performed by Apple's system geocoding service (CoreLocation), so the request is handled by Apple under Apple's own privacy policy. Coordinates are sent, photos are not. The names found are cached on the device.

It can be switched off in the settings of either app ("Cities in Folder Names" on the iPhone, "Geocode place names" on the Mac). With it off, folder names simply omit places. The iPhone app then makes no network requests of its own, and the Mac's App Store version makes none unless you open the map in its transfer history.

This website and email

This site is a set of static pages served by Cloudflare. It sets no cookies and runs no analytics or tracking scripts. As with any web host, Cloudflare receives standard request data such as your IP address and user agent in order to serve the pages and the downloads. The checkout page is Paddle's and is covered by Paddle's privacy policy.

Email to support@phototransfer.app is routed by Cloudflare to our mailbox, and our replies and license emails are sent through Resend. Both providers process the messages only to deliver them. Support correspondence is kept for as long as it is needed to resolve your request and for a reasonable period afterwards.

Children

The applications are general purpose utilities and are not directed at children. Since no data is collected, none is collected from children either.

Changes

If this policy changes, the updated version is published on this page with a new date at the top.

Contact

Questions about this policy, and requests to access or delete your data: support@phototransfer.app. Security reports go to the same address with "Security" in the subject.