What leaves your phone, and what does not.

To judge a photo the app has to see it, so the photos you choose to analyse are sent to Google’s Gemini API, which produces the description and the verdict. That is the only thing sent, and it happens only for the photos you have selected. Nothing else is sent with the photo — no name, no email, no device identifier that Google could use to build a profile of you.

That request is made on a paid Google Cloud account. Under those terms Google does not use what is submitted to train or improve its models, and does not retain it beyond serving the request.

Before anything is sent, the Analyze screen groups your photos by category and lets you untick any of them. Anything you skip is never transmitted, and the app does not ask about it again. Nothing is sent in the background, and nothing is sent while you are not in the app.

The photo itself is not retained after it has been analysed. It is used to produce the description and the verdict, and then it is gone from the service.

The description, the reasoning and the verdict are returned to your phone and saved to your own iCloud, in this app’s private storage area. They are what makes the review list and the photo search work on the second visit without sending anything again.

Saving them there rather than on our servers is deliberate: it means we never hold them, they survive the app being deleted and reinstalled, and they follow you to another device you sign in on. If you are not signed in to iCloud they stay on the phone instead, and are lost when the app is removed. Deleting them is the same as deleting anything else in iCloud, and the app has a Clear all data button that removes the lot.

With your permission the app reads your photo library through Apple's Photos framework, including the metadata iOS already keeps: the date a photo was taken, whether iOS flagged it as a screenshot, and which photos it considers duplicates. That reading happens entirely on the device.

You can change or revoke that permission at any time in Settings, then Privacy & Security, then Photos. Revoking it stops the app working, but it does not reach back into anything already stored on your phone.

The app never deletes anything on its own. It proposes deletions, shows the reason for each one in plain words, and waits for you to confirm.

When you do confirm, photos are removed through the standard iOS mechanism, which means they go to the Recently Deleted album and stay recoverable there for 30 days. The app has no way to bypass that and does not try to.

There is no sign-up, so the app holds no name, no email address and no password. Your analyses are not built into a profile, are not sold, and are not used to target advertising. There is no advertising in the app.

The app links no analytics or attribution library, and there is no advertising SDK of any kind. It does link one crash reporting library, Sentry, which sends a stack trace, the device model and the iOS version when the app crashes. It is configured to send no personal information: no IP address, no device name, no screenshots, no view hierarchies, and nothing about your photographs. It cannot see them.

The app is not directed at children under 13 and does not knowingly collect information from them.

If this policy changes in a way that affects what is sent or kept, the date at the top of this page changes with it, and the change will be described here rather than quietly folded in.

AI Photo Janitor is published by CodeChef Consulting LLC, a California limited liability company, at 1724 Barry Ave Apt 8, Los Angeles, CA 90025. That company is the data controller for everything described on this page.

Questions, or a request about your data, go to 13jeremywt@gmail.com.