Privacy Policy

We collect information you provide directly, such as your email address when you sign up, contact us, or manage your account.

We also collect technical information that is needed to operate the service reliably, such as authentication state, browser and device details, and request metadata used for security and troubleshooting.

• Account details such as email address and verification state
• Basic profile information used to operate account access
• Support messages and account-related requests
• Technical logs needed for security, debugging, and abuse prevention

We use collected information to provide the website, manage sign-in, maintain account access, improve reliability, and respond to support requests.

We may also use first-party service data to understand which pages, downloads, or release details are being used most so we can improve the product experience over time. PhotoDesk does not use this website to upload or host your personal photo library.

If you sign in to a PhotoDesk app or this website, the PhotoDesk administrator can see your account email, sign-in method, the date you joined, when you last signed in or used a PhotoDesk app, which PhotoDesk apps you use (including the Windows app version), and whether you have PhotoDesk Pro. This is used to provide support, prevent abuse, and manage Pro access. People who use the Android app without signing in are not visible to us.

You can use the Android app's photo tools without an account. The analysis runs on your phone, and the results are kept in the app's private database on your phone.

• Face recognition: faces are detected, grouped, and matched by machine-learning models that run on your phone. Names, tags, face boxes, recognition templates, and thumbnails stay in the app's private database. They leave your phone only if you turn on the optional Google Drive backup, and then only into your own Google Drive.
• Text, object, and license-plate recognition: text and objects found in your photos are indexed on your phone so you can search them. A scan you start may continue in the background with a visible progress notification. The images are not sent to an online recognition service. A scan you explicitly start may continue while you switch apps or lock the screen, using an Android foreground service with a visible progress notification.
• Age and gender estimates: approximate, computed on your phone, stored locally, and used only for the People filters.
• Photo locations: if you turn on the Map, the app reads location data already in your photos to place them on a map. The locations are not sent anywhere.
• Locked Folder: photos and videos you move into the Locked Folder are kept only inside the app's private storage on your phone, behind your screen lock. They are not included in PhotoDesk backups and are deleted if you uninstall the app.
• Free version allowance: the free version analyzes up to 500 photos and videos, plus any extra free photos you earn through optional invitations. To count them, the app keeps the identifiers of the items it analyzed in its local database. This list never leaves your phone.

The Android app uses Google's ML Kit libraries, bundled inside the app, for face detection and text recognition (including reading plate text). The recognition itself runs on your phone, and PhotoDesk does not send your photos to Google for it.

However, the ML Kit libraries also record technical diagnostics and usage analytics when these features run, and automatically send them to Google over HTTPS in batches in the background. This happens without any account or setting on your part, and Google documents no setting that lets an app switch it off. Google's ML Kit data disclosure lists the data as:

• device information (such as manufacturer, model, OS version and build) and the ML hardware accelerators available
• the app's package name and version
• per-installation identifiers that are not intended to uniquely identify a user or physical device
• performance metrics (such as processing time)
• API configuration (such as image format and resolution), and input and output sizes
• the ML Kit feature version, event types (such as initialization and detection), and error codes
• Google's published list does not include your photos, the faces or text recognized in them, names, or locations. Google states that ML Kit encrypts this data in transit using HTTPS, does not transfer it to third parties, and handles it under the Google Privacy Policy.

PhotoDesk uses third-party infrastructure providers to run core parts of the service. These providers may process limited information as needed to host the site, authenticate users, and store account data.

• Firebase Authentication and Firestore for website accounts, feedback, and linking PhotoDesk Pro across devices
• Wasabi object storage for app installers and marketing media uploaded by the administrator
• Firebase Hosting and related infrastructure for website delivery
• Google Play Billing for the optional one-time PhotoDesk Pro purchase in the Android app. Google Play handles your payment account and payment method and keeps the purchase record under Google's terms and privacy policy. PhotoDesk never sees your card details
• Google ML Kit (Android) for on-device recognition, which sends the automatic technical diagnostics described above to Google
• Mapbox for map imagery when you use the optional Map in the Android app
• Google Drive for the optional backup in your own Google account, described below

Two optional Google Play options remove the 500-photo free limit: a one-time purchase of the PhotoDesk full version (Lifetime), or the PhotoDesk Monthly subscription, which renews automatically every month until you cancel it in Google Play and removes the limit only while it is active. When a subscription ends, PhotoDesk returns to the free version and keeps everything it has already analyzed. You do not need an account to buy or use either on Android. Android installations used before version 1.9.0 keep every feature free.

For the optional monthly subscription, PhotoDesk reads from Google Play on your phone whether the subscription is active and set to renew, and stores only that answer and the time Google Play last confirmed it, so the subscription keeps working for a few days without an internet connection. The subscription is not linked to the license service: its purchase token is not sent to PhotoDesk's servers, and it unlocks only the Android device where it is used. Google Play bills it, renews it and lets you cancel or manage it at any time under Payments & subscriptions, Subscriptions.

If you choose to sign in with Google to use a Lifetime purchase on Windows too, Google sign-in shares your basic Google profile, including your name, email address, and Google identity, with Firebase Authentication to create or sign in to your PhotoDesk account. The app then sends the purchase token, product ID, and your PhotoDesk user ID over HTTPS to PhotoDesk's Firebase license service, which checks ownership and refunds with the Google Play Developer API.

The license service stores your PhotoDesk user ID, the purchase product and token, ownership state, verification times, and hashed account-ownership proofs, plus short-lived request counts to prevent abuse. Your photos and videos are never uploaded, and nothing from your photo library is sent to the license service.

Account credentials and a verified, account-specific license cache are stored in Android secure storage. Windows protects its license cache with the operating system's encryption service when available. An account-linked verification can remain usable offline for up to 90 days. Signing out removes the local account credentials.

To delete the optional account, open Full version, then Pro on Android and Windows, then Delete PhotoDesk account in the Android app, or follow the steps on our account deletion page at photodesk2026.com/delete-account. Small hashed purchase, Google-owner and deleted-account proofs are kept for fraud prevention and safe purchase restoration; they contain no raw purchase token, email address or photo data. Google Play keeps its own purchase records.

If you sign in with Google, the Full version page shows your personal invite code and link. For each friend who installs PhotoDesk with your link, signs in with Google for the first time and redeems your code, you get extra free photos in the free version (500 per friend, up to 10 friends). Rewards are given only for invitations, never for ratings or reviews. Invitations are handled by PhotoDesk's Google Firebase service, the same one as the optional account above.

• What the app sends: your authenticated PhotoDesk user ID from Google sign-in, the platform (Android or Windows) and a hashed device identifier. On Android this is a SHA-256 hash of a random number created for this installation, not your phone's hardware or advertising ID. On Windows it is a SHA-256 hash derived from the PC's Windows installation ID; the ID itself never leaves your PC. When you redeem a code, the app also sends the code, a one-time request ID and, on Android where available, a Google Play Integrity result that confirms the app came from Google Play. Your photos, their file names and your photo library are never sent.
• What the service stores: your invite code, invitation receipts (which code was redeemed, by which account, on which hashed device), your reward totals, a keyed hash of your Google account identity, and short-lived request counts to prevent abuse.
• Invite links: after you install PhotoDesk from an invite link, the Android app reads the Google Play install referrer once on your phone to find the code. On Windows, an invite link opens the app with the code. The code stays on your device until you sign in with Google.
• Deleting: deleting your PhotoDesk account deletes your invite code, invitation receipts, reward totals and request counts. Small hashed records that stop one device or Google account from redeeming more than once, and the number of rewarded invitations, are kept to prevent abuse. They contain no email address or photo data.

Google Drive backup is off until you turn it on in PhotoDesk. When you do, Google asks you to sign in and allow PhotoDesk one permission, drive.appdata: a hidden app-data folder that only PhotoDesk can open in your own Google Drive. PhotoDesk cannot see, list or change any other file in your Drive. The backup goes directly from your phone to Google Drive over HTTPS and is not sent to any PhotoDesk server.

PhotoDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Drive data is used only to provide the backup and restore feature you asked for. It is not used for advertising, is not sold or transferred to others, is not used to build or train models, and is not read by people at PhotoDesk.

• What is saved: one backup file with the names of your people, their groups and categories, tags, any age-group or gender corrections, albums, favorites and hidden people, "not the same person" answers, which photos each person appears in (photo identifiers and face positions as boxes), and the recognition templates of faces you outlined by hand. It does not include your photos or videos, their GPS locations, or the recognition templates of automatically detected faces.
• Where it lives: in the hidden app folder of the Google account you chose. It counts toward your Google Drive storage and is handled by Google under the Google Privacy Policy.
• How often: at most about once a week while the app is open, and whenever you tap Back up now. The 3 newest copies are kept; older ones are deleted automatically.
• Restoring: you choose a saved copy and review it before anything on your phone changes.
• Deleting it: tap Remove Drive backups in PhotoDesk, or open Google Drive, then Settings, Manage apps, PhotoDesk, Delete hidden app data. To disconnect PhotoDesk from your Google account, remove it under Google Account, Security, Your connections to third-party apps and services. Uninstalling PhotoDesk or deleting a PhotoDesk account does not delete Drive backups.

The optional Map downloads map tiles from Mapbox after you turn it on in the app. Like any web request, a tile request exposes your IP address and the map areas you view. Your photos and their locations are not sent to Mapbox; only the map imagery is downloaded. Mapbox telemetry is disabled in the app.

Send feedback in the Android app opens your own email app with a draft that contains your message and the app version. Nothing is sent unless you send that email yourself. When you do, we receive your email address, the message and anything you choose to include, and use them only to read and answer your feedback.

Your photo organization data (people, names, tags, dates, albums and text index) lives in the app's private database on your phone. If you choose a backup folder, the app writes backup files (names, tags, favorites, album lists, never the photos themselves) to that folder on your phone. If you export an XMP sidecar, it contains the saved date and user tags, and optionally named face boxes and people categories; face templates and GPS are excluded.

Android automatic cloud backup is disabled, so the private PhotoDesk database is not silently uploaded by the operating system. On supported Android devices, a direct phone-to-phone setup transfer may move your local app data directly to your new phone; Locked Folder media and the device-identity safety stamp are excluded. Uninstalling the app deletes its database. Your photos are never touched.

PhotoDesk only asks for what its features need.

• Photos and videos: to display and analyze your photo library
• Notifications: to show the progress of a scan that continues in the background
• Biometrics or screen lock: for App Lock and the Locked Folder. Android handles device authentication; the app never sees your fingerprint or unlock credential
• Google Play billing: so the optional full-version purchase can be offered and restored
• Google account (optional): for sign-in to link a purchase, and for the Google Drive app-data permission if you turn on Drive backup. You can revoke it any time in your Google Account settings

Android versions before 1.9.0 offered optional online photo services using Supabase and Wasabi. Version 1.9.0 removed those services. If you created an older account, data such as your email address, sign-in records, preferences, activity summaries, account-linked feedback and, if you turned on encrypted backup, its encrypted backup files and recovery records may still be stored until it is deleted. Encrypted backups never contained the photos themselves.

At Supabase: your email address, a generated user ID, authentication records and sign-in times (and, if you used Google Sign-In, the basic profile details Google supplied), your online-service preferences, privacy-minimal activity summaries (first and last activity, session counts, app version and platform), account-linked feedback conversations, daily Cloud AI edit counters, and, if you turned on encrypted backup, its catalog, a server-wrapped recovery key and a salted, peppered Argon2id verifier for your backup PIN. At Wasabi (private cloud storage in Singapore): your encrypted backup files, which hold your PhotoDesk index (names, tags, albums, face templates, recognized text) encrypted on your phone, never the photos themselves. In the PhotoDesk feedback inbox in Google Cloud Firestore: feedback you sent anonymously from an earlier version (the message, an optional reply address and the app version).

When the older online services are switched off, all remaining PhotoDesk account data there will be deleted. You do not have to wait: you can remove it now from Profile, Online services, Remove PhotoDesk online data in an earlier version, or through our account deletion page. Deleting account data never deletes photos or anything stored on your phone.

The Windows app analyzes your photo library, face descriptors, scan progress, editor drafts, and recognized text on your PC. Signing in does not upload or back up that library.

The Windows app needs a free PhotoDesk account (Google or email, verified) and an internet connection for the first sign-in; after that it works offline. Accounts use Firebase Authentication. Firebase receives your account email, authentication information, the app version, and first and last online activity timestamps (recorded at most about once an hour while the app is open and online). PhotoDesk uses these to run your account and to show the administrator registered and recently active accounts. A verified cached session allows offline use; offline activity is not recorded.

Optional usage sharing starts turned off. If you turn it on in the Account panel, the app sends Google Analytics app-open events, fixed section identifiers, active time, and an anonymous per-profile identifier. These events do not contain photos, face descriptors, filenames, search text, or your account email. Google also processes network and device information. Advertising personalization and Google signals are disabled. Turning sharing off stops new events but does not erase events already received.

The optional map in the Windows app downloads map tiles from an online map provider; your photos and their locations are not sent.

To delete your account from Windows, open Account and choose Delete this login. It deletes the shared PhotoDesk sign-in, which is the same login used by the Android app and this website, and the Windows activity record; a timestamp-only deletion marker keyed to your user ID is kept so old sign-in tokens cannot recreate the record. Local photos, scan results, and drafts on your PC are not deleted.

The website may record first-party page visits, referral information, device category, browser, approximate country, and session timing so PhotoDesk can understand reliability and usage. When you are signed in, an authenticated identifier may be attached to that session. Photos are not included in these analytics records.

We do not sell personal data or use it for advertising. There is no advertising, advertising identifier or cross-app tracking, and the Android app adds no analytics or crash-reporting service of its own (Windows usage sharing is optional and off by default). Google receives the automatic ML Kit technical diagnostics described above. Google Play processes optional payments; Google Firebase processes the optional sign-in and license records; Google Drive stores the optional backup in your own account; Mapbox receives map-tile requests when you use the map. Your original photo files and their locations are not sent to these services by the license, analysis, map or backup features.

We keep account and operational data for as long as it is needed to provide the service, maintain security, comply with legal obligations, or resolve disputes.

We use reasonable technical and organizational safeguards, but no website or online service can guarantee perfect security.

PhotoDesk is a general-audience utility and does not knowingly collect personal information from children. Its photo tools do not require sign-in.

You can contact us to request updates to account-related information or to ask questions about how your information is used. To delete a PhotoDesk account or remove Google Drive backups, see photodesk2026.com/delete-account.

If this policy changes, the updated version will be published at this address with a new date.

For privacy questions, contact info@photodesk2026.com.