Privacy Policy

Your photos and videos are processed on your device. We do not upload your photo library or recognition results to our servers or to a cloud AI service. Optional rewards and feedback services process the limited information explained below.

English edition updated: 8 October 2026.

Service policy effective date: 2026-09-24

1. Who we are

This policy covers the PhotoFold iOS app, this website, and our feedback and rewards services. The operator named below is responsible for those services. Its registered Chinese name is retained to identify the legal operator accurately.

You can use local photo management without an account. Opening a policy page does not authorize optional data collection. We do not obtain your Apple Account password or payment-card details.

2. Your library stays on your device

With your Photos permission, PhotoFold accesses authorized photos, videos, Live Photos, animations, thumbnails, and metadata such as file size, duration, resolution, date, location, albums and media type. This supports browsing, sorting, duplicate and similar-photo checks, Best Picks, chat and sensitive-content recognition, editing, sharing, and compression. Limited access restricts processing to the items you authorize. Saving, deleting, hiding and album changes use Apple's Photos interfaces.

Recognition runs locally and can make mistakes. A recommendation does not automatically delete, hide or share an item. Media, filenames, capture locations and dates, album names, original Photos identifiers, recognized text and sensitive-content results are not included in our feedback diagnostics or analytics.

Local records keep your review decisions, protected items, scan progress and compression results. Previews, edits, sharing and compression can create temporary files; completed videos awaiting your decision can remain in app storage. These files use device space. Deleting the app can remove its local records and unfinished work; it does not delete your system photo library.

If city labels are available, the app uses cached locations first. After you initiate networking, it may ask Apple's geographic service to translate visible photos' coordinates into city names. This does not request your device's live location or send those coordinates to our servers. If unavailable, the app shows the date instead.

3. iCloud and sharing

Scanning the main list does not download iCloud originals simply to count them. Bulk compression normally skips media whose required originals are unavailable locally. When you request an operation that needs an original, the app follows your download setting or asks you first. Downloads are between your device and Apple. You may change the original-download setting in the app and cellular access in iOS.

The system share sheet sends content to the recipient or app you select, under that service's rules. We do not collect your share recipients.

4. Optional achievements and rewards

Local achievements can remain on your device without signing in. To use online rewards, first allow rewards networking, then use Sign in with Apple. We do not request your name or email address from Apple. You can stop networking or sign out without affecting local photo management. After consent and sign-in, opening rewards, completing eligible tasks, returning to the foreground or manual synchronization may sync or retry queued progress.

We verify Apple's authorization, keep a keyed digest of your sign-in identity, a random rewards account and invitation code, and an encrypted authorization refresh token. Session credentials are stored in the device Keychain. Apple App Attest verifies app requests using installation public keys, counters and short-lived challenges; it is not an advertising identifier.

Rewards records include eligible feature types, event identifiers, completed counts, completion dates in UTC, server receipt times, and irreversible account-salted item digests used to prevent duplicate credit. Original Photos identifiers, media and recognized content are not sent. Invitation relationships, balances and redemption records determine eligibility and prevent repeated claims. These records are linked to your rewards account and are not described as anonymous.

For reward redemption, we verify Apple-signed app and purchase transactions, product and offer identifiers, transaction ownership, expiry, revocation and environment. Purchase-account associations prevent the same purchase account being used to claim rewards through multiple rewards accounts. Offer codes are encrypted at rest and reserved for a specific account. Apple also processes information under its own privacy policy.

Necessary rewards records remain while the account is active so you can restore synchronized progress. Deleting the rewards account revokes Sign in with Apple authorization and removes credentials, sessions, item digests, detailed activity and unused rewards. Minimal identity digests, transaction deduplication and invitation-abuse records are retained for one year; rejoining rewards using the same identity is restricted during that period. Afterward, expired identity/transaction/code associations are removed, while other users' earned invitation counts can remain without your identifiable account relationship. Rate-limit IP digests are retained for up to one day, unused challenges expire after five minutes, and notification deduplication records are retained for up to one year.

5. Feedback you choose to send

In-app feedback sends your text and the diagnostics described before submission: app/build version, system version, device model, interface language, Photos and original-download permission status, low-power and thermal state, and recent fixed diagnostic events. Events contain feature state, coarse counts/durations and fixed error categories or codes. The local buffer holds at most 80 events for 24 hours. It is sent only when you submit feedback.

We do not attach library media, media paths, device names, Apple Accounts, advertising identifiers, sensitive recognition results, full system logs or crash dumps. In-app feedback does not automatically include your rewards account. The server assigns a feedback reference and timestamp. A random request identifier prevents duplicate submissions on retry.

A failed in-app submission keeps a local draft for up to seven days. It does not retry automatically in the background. Drafts and diagnostic buffers are excluded from device cloud backup; successful submission clears the draft. The website form allows optional version/device information and an optional email for a reply. It has no media attachment field. Do not paste private media, passwords or identity documents.

Feedback and associated diagnostics are deleted 730 days after their last update. Contact email is removed 365 days after a feedback case is closed. Administrative audit records are kept for 365 days without the feedback text, email or passwords. You can request earlier deletion using your feedback reference.

You may email us directly. Alibaba Mail processes the sender address, message, attachments you choose to send and communication information to deliver and store support correspondence. App media is never automatically attached. Support emails are retained only as needed to handle requests, necessary records and legal obligations; contact us to request access or deletion. Email is separate from in-app records. See Alibaba Mail's privacy information (Chinese). No Alibaba Mail SDK is embedded in the app.

6. Analytics, hosting and recipients

Current versions have removed the separate voluntary product-analytics feature. They do not generate its installation identifier or send its analytics events. We may use Apple's aggregated App Store Connect download, usage and stability reports, subject to Apple's settings and privacy protections.

Older versions offered optional, default-off analytics. Their data comprised random event/installation identifiers, event hour, app/build version, major iOS version, device-performance tier, environment, consent version, and coarse feature-result ranges. They did not include media or recognition contents. The server replaced installation identifiers with keyed digests; those digests could still distinguish installations. Raw events are retained for 90 days and identifier-free daily totals for 730 days. Local queues were limited to 500 events and 30 days. Closing the old toggle stopped recording and cleared the queue; server deletion required a separate request. In current versions, contact support for historical data requests. Removing analytics in the app does not itself erase older server records.

Hosting provider: Alibaba Cloud ECS. Server-side service data location: Hong Kong, China.

Our feedback and rewards services and any historical analytics are hosted in Hong Kong, China. If you use those optional services from another region, the described account, activity, transaction or feedback information is transmitted there. Library photos, videos and recognition contents are not uploaded. Our service providers include Alibaba Cloud for hosting, Alibaba Mail for email, and Apple for authentication, app/device verification, purchases and system services. You may contact us about relevant processing and safeguards; this notice does not replace any separate procedure required by applicable law.

Network providers necessarily handle IP addresses to deliver and secure requests. Feedback and analytics databases do not retain request IPs or browser identifiers, and access logging for those interfaces is disabled. Infrastructure and error logs may still process connection information for security. Public pages have no advertising or analytics cookies or third-party analytics scripts. Administrative login uses a necessary session cookie.

We do not sell personal information, use it for cross-app advertising, or embed advertising, tracking or cloud AI recognition SDKs. We share only as needed with the service providers described here, recipients you choose, or where law requires. See Apple's Privacy Policy and Alibaba Cloud's privacy information.

7. Your choices and rights

Use iOS Settings to change Photos access. In Achievements & Redeem, open the account/network settings to stop synchronization, sign out or delete your rewards account; wording can vary by app version. Deleting a rewards account does not cancel an Apple subscription or delete your library. Deleting the app does not automatically delete server feedback or rewards records, or cancel subscriptions.

Contact us to request information, access, a copy, correction, deletion, withdrawal of optional consent, or an explanation of processing. Where applicable, you can also request restriction or portability, object to processing, and complain to your local privacy regulator, including the UK Information Commissioner's Office. We verify only what is necessary to protect your records; you do not need Pro to exercise these rights. We explain lawful retention exceptions or delayed removal from backups. Withdrawing consent does not undo lawful processing already performed.

Where UK data-protection law applies, we process information necessary to deliver requested rewards and support services to perform that service, rely on consent for optional consent-based processing, and use limited security/anti-abuse records for legitimate interests in protecting accounts and preventing duplicate claims, subject to your rights. Legal requirements may require specific retention. Online services require the necessary information to function; you may decline them and continue local photo management. We do not use your media for decisions with legal or similarly significant effects; automated reward eligibility can be queried with support.

8. Children, security and updates

Children should use the app with appropriate parental or guardian guidance and obtain any consent required for purchases or online services. Do not submit a child's unnecessary personal information. Contact us if it has been submitted so we can review and remove it as appropriate.

We use HTTPS, access controls, encryption for offer codes and authorization refresh tokens, and limited records to protect information. No storage or transmission system is risk-free. Material changes will be explained on this page or in the app; additional consent will be requested when required. Local mandatory privacy rights are not limited by this policy.