Asoma Photo Privacy Policy
Last updated: 2026-09-26
This policy explains what data the Asoma Photo iOS app (“the App”) handles, where it is processed, where it is stored, and how to delete it.
Summary
- No server, no accounts. Your photos, faces, times, places and everything you type stay on your own device. The developer never sees a single photo or name.
- All analysis happens on the device. The face and scene models ship inside the App and run locally.
- Only three things go online: turning coordinates into place names and showing maps, both through Apple’s system services (only a location is sent, never a photo); and loading this policy or the Terms of Use when you open them in the App.
- No tracking, no ads, no analytics, no crash reporting.
1. What the App stores
All of the following lives in the App’s sandbox (a local database, image folders and the App’s preferences).
| Data | Where it comes from | Stored in | Leaves the device? |
|---|---|---|---|
| Thumbnails | One per imported photo, 768 pixels on the long edge | Sandbox image folder | No |
| Copies of originals | Only for photos imported through the system picker while the App has no Photos access | Sandbox image folder | No |
| Viewed originals | When you view a photo imported from Photos full screen, the original fetched from Photos is kept for next time | The App’s cache folder; deleted automatically after 30 days unused, or least-recently-used first when the total exceeds 2 GB | No |
| Library references | When importing from your Photos library, the photo’s Photos identifier and original file name; the original stays in Photos | Local database | No |
| Capture time, device model | The photo’s EXIF | Local database | No |
| Location | GPS coordinates from EXIF, and the country, city and district looked up from them | Local database; place names also in a local cache | Sent to Apple for place-name lookup, see §4 |
| Face boxes, five landmarks, face crops | Detected on the device | Local database; crops in a sandbox image folder | No |
| Face identity vectors | A list of numbers computed on the device by a face model, used to tell whether two faces are the same person | Local database | No |
| Upper-body appearance vectors | Computed on the device from the upper body (mainly clothing), to help recognise people whose faces are unclear | Local database | No |
| Image analysis | Scene labels, body pose, sharpness, exposure, image fingerprint and whole-image features, all computed on the device | Local database | No |
| People and relationships | The names, notes and categories you give, relationships between people, and your “not the same person” corrections | Local database | No |
| Who is “me”, your avatar | Chosen by you | Preferences; avatar in the sandbox | No |
| Home city | The App suggests candidates from your photos’ locations; you choose | Preferences | If you use “current location”, see §4 |
| Album titles, notes, favourites, pins, locks, hidden people, journeys | Set by you | Preferences | No |
| Performance log | How long each processing step took, photo counts, App and iOS version | A text file in the sandbox, capped at 1 MB | No |
Not collected: device identifiers, advertising identifiers, contacts, calendars, camera, microphone, health data, usage analytics, crash reports.
2. On-device analysis
The App analyses photos with the models and system features below. They all run on your device; the models are installed with the App and never downloaded at run time.
| Model / feature | Purpose | Runs on |
|---|---|---|
| RetinaFace | Finds faces and their five landmarks | Device (Core ML) |
| AuraFace | Turns a face into an identity vector so photos of the same person group together | Device (Core ML) |
| DINOv2 | Turns an upper body into an appearance vector, to help when a face is not clear enough | Device (Core ML) |
| Apple Vision | Face quality, scene classification, body pose, document detection, aesthetics and saliency, whole-image features | Device (iOS system framework) |
Not done: inferring age, gender, ethnicity, expression or emotion. Who “me” is, what people are called and how they relate to each other are set by you; the App does not guess them.
3. Permissions
| Permission | When it is requested | What it is used for |
|---|---|---|
| Photos | On first launch, and when you import photos | Reading the photos you choose to make thumbnails and analyse them, and asking the system for the original when you view one full screen. Nothing in your Photos library is modified or deleted |
| Location (while using) | Only when you tap “Use current location” | One kilometre-accuracy reading to set your home city. No background location, no tracking |
| Face ID / Touch ID / passcode | When you open, unlock, or delete an album, person, relationship, or journey you locked | Confirming it is you. Biometrics stay with the system; the App never receives them |
| Notifications | On first launch | Local notifications only: analysis progress and completion. No push server |
| Live Activities | While photos are being analysed | Progress on the Lock Screen and Dynamic Island: photos done and the date being processed |
You can turn off any permission at any time in the system Settings app.
4. Network access
The App does not connect to any server of its own. Only the following go online:
- Place names: to show a photo’s GPS coordinates as a place name, the App rounds the coordinates to a grid cell about 1 km across and sends the centre of that cell to Apple’s geocoding service (CLGeocoder), which returns a place name. Only that point is sent, with no photo and nothing that identifies you. Place names are cached locally so the same area is not requested again. When you use “Use current location”, that reading is turned into a city name the same way.
- Maps: when you open a screen with a map, the system map (MapKit) downloads the area you are viewing from Apple, so Apple can see which area is shown, which is near where the photos were taken.
- Viewing this policy and the Terms of Use: both documents are hosted on Craft (craft.do). When you open them in the App, it loads the corresponding Craft web page, so Craft’s servers receive an ordinary web request (for example your IP address). No photos or App data are sent.
Apple’s privacy policy applies to place names and maps; Craft’s privacy policy applies to the document pages.
Also, if iCloud Photos has “Optimise iPhone Storage” turned on, the system may download a photo from iCloud when the App asks for its original. That happens between iOS and your iCloud; the App is not involved.
Apart from this the App makes no network requests: no analytics, no ads, no crash reporting, no sync.
5. Storage and backups
- All data is kept in the App’s sandbox, protected by iOS; other apps cannot read it.
- Apart from viewed originals (kept in the cache folder, which is not backed up and which iOS may clear when storage is low), the App’s data is backed up with the device: if you use iCloud Backup or back up this device to a computer, the App’s data is included in the device backup. Backups are managed by Apple or your computer; the developer cannot access them.
- The originals in your Photos library stay under your control; the App never modifies or deletes them.
6. Deletion
The App offers the kinds of deletion below, and viewed originals are also cleaned up automatically (after 30 days unused, or when they exceed 2 GB). Everything else stays until you delete the App.
| Action | What is deleted | What is kept |
|---|---|---|
| Deleting a Day Album | All of the App’s data for that day’s photos: thumbnails, copies of originals, viewed originals, face crops, library references, and those photos’ analysis (capture time, location, face boxes, face and upper-body vectors, which person they belong to, image analysis) | The originals in your Photos library; people’s names, notes and relationships |
| Settings › Storage › deleting originals by album | Only the App’s copies of originals, to free up space | Thumbnails and all analysis. When you later view such a photo full screen, the App asks Photos for the original to display it (the fetched original is kept as a viewed original); if Photos does not have it, or the App has no Photos access, only the thumbnail is shown |
| Settings › Storage › Clear cache | Thumbnails that can be rebuilt, and viewed originals | The photos themselves (the thumbnails of photos imported from Photos), face crops and all analysis; viewing full screen fetches the original from Photos again |
| Deleting the App | Everything in the sandbox | The originals in your Photos library; existing device backups (see §5) |
Hiding a person, removing a person’s identity and dissolving a relationship are not deletion: they change what is shown and how photos are grouped, and the related data stays until you delete the corresponding Day Album or the App.
7. Sharing and export
The App has no sharing, export or upload features, and does not expose your data to Spotlight, Siri or other apps.
8. Third parties
- The App contains no third-party SDK that collects data, no ad network, and shares no data with any third party.
- The open-source components it uses (an animation runtime, the models above, Rust libraries) are bundled with the App, run on the device and do not go online. The full list and licenses are in the App: Settings › Open source licenses.
9. Changes
Updates to this policy change the date at the top of this page. If an update materially changes how data is handled, the App will say so prominently.