Privacy Policy - Photo Organizer AI

Effective Date

August 2026 (Last Updated: September 2026)

Introduction

This Privacy Policy explains how Photo Organizer AI handles user photos, identity recognition, metadata, and local system information.

No Cloud Telemetry or Media Retention

Photo Organizer AI is architected from the ground up as a pure offline desktop application.

Specifically:

We do not upload, retain, transfer, or store your photos, thumbnails, or videos on any remote server.
All machine learning inference (Face Detection, ArcFace clustering, Multimodal Embeddings, Scene Classification, Blur Scoring) runs 100% locally on your PC via DirectML.
We do not collect usage analytics, telemetry events, device identifiers, or user tracking logs.
We do not sell, share, or monetize user data.

Optional Cloud Sync & DPAPI Protection

If you choose to link Google Photos, Microsoft OneDrive, or Contacts:

Authentication is negotiated directly with Microsoft / Google OAuth 2.0 endpoints.
Authentication tokens are encrypted locally on your machine using the Windows Data Protection API (DPAPI) and never transmitted to our servers.
You can disconnect and revoke profile linkages at any time from the app Settings.

Offline / Local Processing Disclosure

All AI/ML processing (such as face recognition, face detection, ArcFace feature extraction, clustering, semantic multimodal embeddings, and scene classification) operates locally or offline on the user's device via Windows DirectML.

We explicitly affirm that Google user data is never transmitted externally or stored on remote servers, and is never used to train generalized models for third party or any external systems.

Google User Data: What Raw and Aggregated/Anonymized Data is Accessed

Photo Organizer AI provides optional cloud integration with Google services to allow users to sign in, synchronize their contacts to recognize friends and family in photos, and synchronize app preferences across their personal devices. We clearly state below exactly what raw and aggregated/anonymized Google user data is accessed by the application:

1. Raw Google User Data Accessed by the App

When you explicitly choose to connect your Google account, Photo Organizer AI requests scoped access via Google OAuth 2.0. The application accesses only the following specific items of raw Google user data:

Google Account Profile & Identity (email, profile scopes): When you sign in with Google, the app accesses your raw Google user account identifier (id), primary email address (email), full display name (name), given name / first name (given_name), family name / last name (family_name), and profile avatar picture URL (picture), as well as the image bytes of your profile avatar downloaded directly to display your user badge.
Google Contacts Information (https://www.googleapis.com/auth/contacts.readonly scope via Google People API): When you initiate contact synchronization, the app accesses raw contact identifiers (resourceName), contact display names, first and last names, email addresses, telephone/mobile numbers, job titles, organization/company names, and contact profile photo URLs, as well as the full-resolution contact photo image bytes downloaded directly for facial matching. This raw data is accessed from your personal Google Contacts (people/me/connections), personal user profile (people/me), and other frequent contacts (otherContacts).
Google Drive Application Data Folder (https://www.googleapis.com/auth/drive.appdata scope via Google Drive API v3): The app requests restricted access strictly sandboxed to the application's private, hidden Application Data folder (spaces=appDataFolder). It accesses raw content solely for the application's own configuration file (settings.json), which contains local UI preferences, category rules, and AI sensitivity thresholds. Crucially, the app does NOT access, list, search, view, read, modify, or download any personal files, documents, photos, videos, or folders stored in your personal Google Drive or Google Photos library.

2. Aggregated or Anonymized Google User Data Accessed by the App

Zero Aggregated or Anonymized Data Accessed: Photo Organizer AI does NOT access, collect, query, calculate, receive, or compile any aggregated, anonymized, de-identified, or pseudonymized Google user data. All data access is strictly limited to the direct, raw user data points explicitly listed above for the active user's local session. No demographic aggregates, population statistics, or anonymized usage datasets are accessed from Google or any intermediary.

Google Service & Scope	Exactly What Raw Data is Accessed	Aggregated / Anonymized Data Accessed	How the Data is Used by the App
Google Account / Sign-In `email` `profile`	Google Account ID, primary email address, full display name, given name, family name, profile picture URL, and profile picture avatar image bytes.	None. No aggregated or anonymized account data is accessed or collected.	Used strictly on-device to authenticate your identity, display your account avatar and name in the application UI, and maintain your local active session.
Google Contacts `contacts.readonly` (Google People API)	Contact resource IDs, display names, given/family names, email addresses, phone numbers, job titles, companies, contact photo URLs, and downloaded contact photo image bytes.	None. No aggregated or anonymized contact data is accessed or collected.	Loaded temporarily into local memory to match contact photos against unlabelled face clusters in your local photos using local DirectML ArcFace AI. Confirmed matches auto-label the person cluster with the contact's name, email, and phone number in your local SQLite database.
Google Drive AppData `drive.appdata` (Google Drive API v3)	Restricted sandboxed content of the app's own configuration file (`settings.json`) inside the hidden `appDataFolder`. No access to personal Drive files.	None. No aggregated or anonymized Drive data is accessed or collected.	Used solely to sync your personal app preferences, custom tagging rules, and AI sensitivity thresholds across your own Windows devices running Photo Organizer AI.

Google User Data: How Raw and Aggregated/Anonymized Data is Used

Photo Organizer AI enforces strict purpose limitation, on-device local execution, and zero data monetization. Below is clearly how raw and aggregated/anonymized Google user data is used by the application:

1. How Raw Google User Data is Used by the App

Local Account Identity & Session Management: Raw profile information (name, email address, avatar photo) is used on-device to personalize your interface, display your active account card in the application header and Account Settings, and maintain your authenticated session. OAuth 2.0 access and refresh tokens are encrypted on your local PC using the Windows Data Protection API (DPAPI) and stored in local application data. Tokens are never transmitted to developer servers or external third parties.
On-Device Facial Matching & Auto-Labelling of Contacts: Raw Google Contacts data (contact names, email addresses, phone numbers, and profile photos) is fetched temporarily into local device memory. The contact's photo is processed 100% locally on your PC via Windows DirectML using ArcFace deep neural network embeddings to generate facial feature vectors. These vectors are matched against unlabelled face clusters identified in your personal photo collection. If a match is found with high confidence, the contact's name, email, and phone number are automatically assigned to that face identity in your local SQLite database (photos.db). This empowers you to search, filter, and organize photos by person without manual tagging. Existing manually labelled identities are never overwritten. Raw contact data is processed in memory and never transmitted to developer servers or third parties.
Cross-Device Application Preferences Synchronization: Raw data in the settings.json file located in Google Drive's isolated appDataFolder is read and written solely to keep your personal application configurations (such as custom album rules, categorization preferences, and AI sensitivity thresholds) synchronized across your own Windows computers.

2. How Aggregated or Anonymized Google User Data is Used by the App

No Use of Aggregated or Anonymized Data: Because Photo Organizer AI does NOT access, compile, generate, or receive any aggregated or anonymized Google user data, no aggregated or anonymized Google user data is used for any purpose whatsoever. The application does not perform telemetry analytics, user behavior analysis, trend aggregation, demographic profiling, market research, or advertising using Google user data.

3. Prohibitions on AI Model Training, External Transmission, and Sale

Zero Generalized AI/ML Model Training: Raw or derived Google user data is never used to train, retrain, fine-tune, or improve generalized, commercial, or third-party artificial intelligence, machine learning, or computer vision models. All AI inference is strictly on-device, pre-trained, and runs offline via Windows DirectML.
Zero External Transmission or Developer Servers: All Google user data is transferred directly between your personal device and Google's official endpoints over encrypted HTTPS. We do not operate any intermediate relay or storage server; raw or derived Google user data is never sent to the app developer or third-party cloud infrastructure.
No Sale, Rental, or Commercial Transfer: We do not sell, rent, lease, trade, or transfer Google user data to third parties, data brokers, advertisers, or marketing agencies under any circumstances.
No Advertising or Behavioral Profiling: Google user data is never used, transferred, or disclosed for serving advertisements, including personalized, targeted, re-targeted, or interest-based advertising.
Local Retention & User Control: Contact data and account profiles are stored strictly within your local on-device SQLite database. You can disconnect your Google account and erase all local tokens and synced contact data at any time from the app Settings or by uninstalling the application.

Limited Use Compliance Statement

Photo Organizer AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs / Google API Services User Data Policy, are for Limited Use requirements only:

Limited Use Fulfillment: The use of raw or derived user data received from Google APIs is strictly limited to providing and improving user-facing features directly requested within the application (e.g., syncing contacts to recognize friends and family or backing up selected albums).
No External Transmission or Generalized AI Training: Google user data is never transmitted externally, never stored on third-party servers, and never used to train, retrain, or improve generalized AI/ML models for third parties.
No Sale or Third-Party Transfer: We do not transfer, sell, or disclose Google user data to third parties, except as strictly necessary to fulfill prominent user-requested features within the application, comply with applicable law, or as part of a merger or acquisition with explicit notification.
No Advertising or Profiling: Google user data is never used or transferred for serving advertisements, including personalized, targeted, re-targeted, or interest-based advertising.
No Human Inspection: No human is permitted to read or inspect raw or derived Google user data, unless the user has given affirmative consent for specific technical support or troubleshooting, it is necessary for security investigations (such as debugging security incidents), or it is required to comply with applicable law.

Contact Us

If you have questions regarding this Privacy Policy, you can contact the developer via the official Microsoft Store listing page.