We don't ask you to trust us. We give you a tool that doesn't need to be trusted, because it can't betray you. There is no server. There is no account. There is no outbound traffic. Verify it yourself.
Every cloud photo service has a privacy policy. They all say roughly the same things. They all reserve roughly the same rights.
Each of these is a property of the architecture, not a clause in a contract.
Run Wireshark or Little Snitch. The app makes one DNS query for update checks (opt-out) and that's it. No "anonymous usage statistics," no crash reporter that uploads photos, no embedded analytics SDK.
There is no "PhotoSphere ID." Install, launch, you're in. License keys validate offline via SHA-256. Pair codes are local-only and expire in 5 minutes.
SQLite database. JPEGs. Sidecar XMP. Open the folder in Finder. Drag a photo out. Nothing proprietary. Drop PhotoSphere tomorrow and every original sits exactly where you put it.
Sync between devices uses authenticated encryption with per-peer keys derived during pairing. A Wi-Fi sniffer sees ciphertext. The PhotoSphere protocol is documented and auditable.
Argon2-hashed PIN. Hidden photos never appear in Memories, Search, or the timeline thumbnails until you authenticate. Optional encrypted vault with separate AES-256 key.
If we ever stop maintaining PhotoSphere — acquisition, bankruptcy, anything — the full Rust + React source releases under MIT. Your tool, forever, regardless of what happens to us.
Don't take our word for it. Here are the exact commands.
sudo tcpdump -i any 'host not 192.168.0.0/16 and port not 5353' # 0 packets captured. (mDNS on .local is the only outbound.)
netstat -an | findstr "ESTABLISHED" | findstr "photosphere" # (no rows)
sqlite3 ~/Library/Application\ Support/PhotoSphere/photosphere.db sqlite> .tables # settings photos faces detections exif albums # sync_devices sync_state ... # every byte: yours.
Every headline feature of Apple Photos and Google Photos — and how each app stacks up on the things that actually matter for privacy and ownership.
No NDA required. No "trust us" required. Run the app, watch the network, read the source. The privacy is in the design.