Privacy

What is indexed?

Linked local folders and Capture imports: image/video paths, EXIF-style metadata when present, OCR text, derived tags, embeddings (when the pack is available), and structured Markdown/JSON records. Originals are not copied by default.

Where is it stored?

Vault database and derived artifacts live under ~/Library/Application Support/PhotoKB/. The on-disk directory name remains PhotoKB for compatibility; the product display name is BlobberVault.

What leaves the device?

Default Strict Local: no image, thumbnail, crop, or embedding leaves the device during indexing.

Optional OpenAI query planning (when you enable it) sends metadata-only planning prompts — never your image bytes as a default vision upload. Optional Hugging Face model downloads are user-initiated weight fetches.

Which AI providers or models?

• On-device OCR / tagging / Ask packs shipped or downloaded for local use.
• Optional SmolVLM weights via in-app download (not baked into the DMG).
• Optional OpenAI metadata-only planning with a Keychain-stored key.
• Semantic CLIP / faces extras are not claimed as DMG freeze features.

How do I delete vault data?

Use in-app delete / reset flows where available, or remove the Application Support PhotoKB directory. Uninstalling the .app does not always wipe Application Support — delete that folder when you want a clean slate.

Where are exports?

Markdown and JSON exports go to locations you choose in Export flows (typically a folder you pick). They are ordinary local files under your control.

Telemetry / analytics?

Desktop app: no metrics SDK in the default build. The desktop app does not load Google Analytics. Nothing leaves your Mac unless you opt into features that explicitly call a cloud API (e.g. OpenAI tagging).

This website — first-party: each page load (and Download click) sends a small beacon to our AWS Lambda counter — no cookies on that path. Unique visitors use a hashed client IP plus a random session id kept only in sessionStorage for that browser tab session (salt server-side; raw IPs are not stored). Aggregate counts are published to public S3 site-stats.json for the hero and /stats. We do not use GitHub Release counters — the repo stays private.

This website — Google Analytics 4: when a Measurement ID is configured, this marketing site loads Google Analytics 4 on every page (always-on; no consent banner). Google may set cookies and/or use client identifiers. Google acts as a processor for analytics on this website only. This is a weaker EU / GDPR posture than a consent-gated CMP; it is accepted for the marketing website only. The Mac app is unchanged and does not load GA.

Download email (optional): before a DMG download you may leave an email for release notes. It is stored in our DynamoDB lead list for product updates only — never sold. Unique emails count toward the public Blobberizers community total. You can always continue without providing an email.

Download compatibility check: the download gate uses device and user-agent signals in your browser to decide whether this Mac build is a match. Your client IP is not shown in the UI. Visitor uniqueness still uses a hashed IP as above.

Contact form: messages (email, optional name, message) are stored in our DynamoDB so we can reply. Your email is not added to the download / marketing lead list — Blobberizers count only unique opt-in emails from the optional download gate. Do not send secrets or vault data. Never sold.

Local MCP residual risk

Optional photokb-mcp / Collections fleet ships as a slim binary in the DMG and is a localhost surface only. Tokens and slice caps are managed in Settings → Local MCP. Keep BlobberVault running while agents query; treat MCP like any local API you enable.