Who we are
App Force, LLC (“we”, “us”) publishes the PhotoBlad apps for iPhone and Android, and makes the PhotoBlad server software and this website. For questions about this policy or your information, write to privacy@photoblad.com.
The short version
PhotoBlad is a photo library that a family runs on a computer of its own: the PhotoBlad server. The apps talk only to the server you sign in to. We run no server that the apps talk to, and the apps send us nothing: no photos, no account details, no analytics, no crash reports and no advertising identifiers. There are no ads and no tracking.
What you back up stays on your family’s server, which its owner looks after, not us.
What the apps send to your server
The apps send these to the PhotoBlad server whose address you type in, and nowhere else. They use HTTPS, and the versions in the App Store and Google Play refuse an address without it, with one exception: your server’s address on your home network (below).
An app can be signed in to more than one PhotoBlad server. Each server gets only what you do with it: its own sign-in, and its own library. Only the one server you choose backs up the phone’s photos.
- Your sign-in. Your username, and your password once, to sign in. The app never stores your password. If you sign in with a passkey, through your phone’s own browser, the app never has a password at all. Your server then gives the phone a sign-in token of its own, which the phone keeps in its secure storage (the Keychain on an iPhone, the Android Keystore on Android) and the server keeps only as a hash.
- This phone’s name. The app suggests one, and you can change it. With whether it’s an iPhone or an Android phone, it tells your devices apart in Settings → Devices.
- Your photos and videos, if you turn backup on. Backup is off until you do. Then the app sends the original files, byte for byte, with their names and everything recorded inside them, such as when each was taken and, if the camera recorded it, where.
- How backup is going. Whether it’s running, waiting or stopped, and why; how many files are waiting, and since when; and the app’s version. Nothing about the photos themselves.
- At home, if you choose. If your server’s owner gives it an address on your home network and you turn on Prefer local network on Wi-Fi, the app talks to your server at that address while you’re on Wi-Fi, and only after checking that the server answering there is yours. That address can be plain http, without encryption: someone else on the same Wi-Fi who can intercept its traffic could read what’s sent, your sign-in token included. Leave the switch off if you don’t trust your Wi-Fi.
- What you choose in the app. Favourites, hiding a photo, moving one to the trash, and restoring or deleting what’s in your trash; and the words you search for, which your server never logs or keeps.
What the apps ask for
- Your photos. The app asks to read your photo library when you turn backup on, never before. Saving a photo from PhotoBlad to your phone only adds it, and on an iPhone that needs no more than permission to add photos. On Android the app also asks to read the places recorded in your photos, so that a backup keeps them.
- Your local network, on an iPhone, only when you turn on Prefer local network on Wi-Fi, to reach your own server at home.
- Face ID or your screen lock, only if you turn on App lock. Your phone checks it; the app never sees your face or your code.
- Notifications, to tell you when backup has stopped, and on Android how a long backup is going. The phone makes them itself: there’s no push service.
- Nothing else. The apps never ask for your phone’s location, your contacts, the camera or the microphone.
What stays on the phone
- A copy of your library’s list, and a cache of its thumbnails and previews, so the app opens quickly. A search’s results are kept under a fingerprint of its words, never the words. Clear cache, in the Account sheet, empties the cache.
- Backup’s record of what it has sent, and its settings.
- While a file is being backed up, saved or shared, a copy of it, deleted afterwards.
- Your server’s address and your username, for each server the app is signed in to, each kept apart from the others.
The apps never delete or change anything in your phone’s photo library.
Signing out, and deleting the app
Signing out tells your server to forget this phone, when it can reach the server, and then deletes from the phone your sign-in token, its copy of your library, its cached pictures, and backup’s record and settings. The phone keeps your server’s address and your username, to fill in the sign-in screen next time.
Deleting the app deletes what it kept on the phone, with one exception: an iPhone can keep the app’s sign-in token in its Keychain after the app is gone, and the app deletes it if you install it again. So sign out before you delete the app, or sign the phone out afterwards in Settings → Devices in PhotoBlad’s web app. A phone’s session also ends by itself after a year unused.
Your family’s PhotoBlad server
The server is software your family runs on a computer of its own. Its owner, whoever set it up, runs it and decides how, not us. What the apps and the web app send it stays on that computer, apart from the requests under What leaves the server.
- Your backups are yours. In PhotoBlad, what you back up is private to you until you share it with the family, in Settings → Sharing or in the app’s Account sheet. Until then nobody else sees those photos in PhotoBlad, the owner included. The photos in the folders an owner adds to PhotoBlad are the family library, which everyone signed in sees.
- What the owner sees of yours. Your username and display name, and whether you share your backups; your phones, with their names, when each was signed in, how its backup is going and when it last backed up, never when you last used it; how much you’ve backed up, as counts and sizes; and, when something needs looking at, the server’s logs and health checks, which can name a file you backed up but never show it.
- The computer itself. PhotoBlad keeps everyone’s backups apart, but it doesn’t encrypt them on the server’s disks: anyone who can open the files on that computer can see them.
- No email. An account has a username, not an email address, and PhotoBlad never sends email. Only an owner can add someone, with an invite link.
- Exports. Export your library writes a copy of what you may download into zip files you download, or, for an owner, into a folder on the server. PhotoBlad never deletes those copies: they’re yours to keep or delete.
- The web app your server serves sets only the cookies that keep you signed in, and loads nothing from other sites.
AI features
PhotoBlad’s AI features run on your family’s server, or on another computer on its private network: never on a service of ours, or of anyone else’s. None runs until an owner installs its model, in Settings → AI. Prompts, questions, answers, the words of a search and people’s names never go into the server’s logs.
- Search by what’s in a photo, faces and removing objects run inside PhotoBlad, on the server. Search looks at every photo there, and finds only what you could already see. The software these run on, ONNX Runtime, would send reports to Microsoft, and PhotoBlad turns that off.
- Faces stay off until an owner turns them on, after a screen that says what is found and kept. Your own backups are looked at for faces only if you turn on Find faces in my backups, in Settings → Sharing. Turning it off deletes the faces found in them, except the prints PhotoBlad keeps of faces someone hid from everyone, so that new photos of them stay hidden. An owner can delete all face data at once.
- Descriptions and Ask run in Ollama, a separate program that an owner installs, on the server or another computer on its private network. PhotoBlad won’t use an Ollama on the public internet, or a cloud model. Ollama gets only the photo’s pixels, at most 1,024 across, with nothing that was recorded in the file, and PhotoBlad’s own question or yours: never names, captions, places or dates. Your backups are described only if you turn on Describe my backups, also in Settings → Sharing. A description is kept with its photo, for everyone who sees the photo to read; questions and their answers aren’t kept.
What leaves the server
Your server sends us nothing about your photos or the people who use it. It makes only these requests of its own:
- The update check. If an owner allows it, at setup or in Settings → Updates, the server downloads PhotoBlad’s list of releases from photoblad.com once a day, and whenever an owner asks. The request carries no cookies, says only that it’s PhotoBlad, not even which version, and carries nothing about your photos or your family. Like any visit to a website, it comes from your server’s internet address, which the website’s host sees (see This website).
- Downloads an owner asks for. When an owner installs FFmpeg or an AI model, the server downloads it from where it’s published, such as GitHub or Hugging Face, and Ollama downloads its models from Ollama’s own library. These carry nothing about your photos or your family either.
- Add from Google Photos. If you connect your own Google account, the server asks Google for the photos and videos you pick in Google’s own picker, and downloads them. Google sees those requests, from your server’s internet address. The server keeps your Google sign-in sealed, uses it for nothing else, and forgets it when you disconnect.
- Other PhotoBlad servers. If an owner connects your server to another family’s, in Settings → Connections, after both owners compared six words, the server sends that server only what the owner chose: backups, which can be sealed so that only your own server can read them, and albums the owner shares with them. Your own backups go only if you turn that on yourself, in Settings → Sharing. What reaches the other server is in its owner’s care, not ours.
- The way in. If your server is reached through Caddy or Tailscale, those talk to their own services, as Privacy & security explains.
Deleting your photos and your account
We hold none of your information, so we can’t delete any of it for you. It’s on your family’s server, where you and its owner can.
- Your photos. Move them to the trash, in the app or the web app. They’re deleted for good after 30 days, or the period an owner sets, or at once with Delete now, or Empty trash in the web app. If someone else also backed up the same photo, it stays backed up for them. A photo in a folder an owner added to PhotoBlad is never deleted by PhotoBlad: it can only be hidden.
- What remains. The server remembers a fingerprint of what you deleted (a hash, from which the photo can’t be rebuilt), so that it isn’t backed up again. Its own copies of its database, made each night and before an upgrade, can hold a deleted photo’s details, never the photo, until they’re replaced in turn.
- Your account. An owner can remove your account, which signs out all your devices and deletes your sign-in details. The photos you backed up stay stored on the server, hidden from everyone in PhotoBlad, and so does what’s in your trash. To have them deleted, delete them before your account is removed.
- Your phone. Sign out, as above.
Changing your mind
- Backup. Turn it off in the app, or take away the app’s access to your photos in your phone’s settings.
- Sharing. Stop sharing your backups in Settings → Sharing, and they’re hidden from the family again at once.
- AI. Turn off Find faces in my backups or Describe my backups in Settings → Sharing.
- This phone. Sign it out, in the app or in Settings → Devices.
This website
photoblad.com has no analytics, no cookies and no ads, and loads nothing from other sites. Nothing here tracks you, so a browser’s Do Not Track or Global Privacy Control setting has nothing to stop. The site is served by Firebase Hosting, a Google service, which receives each request, with the internet address it comes from, in order to answer it, under Google’s own terms.
What the app stores tell us
Apple and Google tell every publisher how many people download its apps. If you agreed, in your phone’s settings, to share analytics or crash reports with app developers, they may also pass us crash reports and usage figures. Those come from Apple and Google, under their own privacy policies: the apps add nothing to them.
Children
The apps are for families, children included, using their family’s own server. We collect nothing from anyone, children included: everything goes to the server the family runs, where only an owner can add an account.
Changes to this policy
When this policy changes, this page changes too, with a new date at its top.
Contact
App Force, LLC: privacy@photoblad.com.