Photo Courier Privacy Policy
Photo Courier temporarily provides data from the photo library on your iPhone or iPad to an AI agent you approve on the same local Wi-Fi network.
The developer does not collect data
Photo Courier has no developer server, account, ads, analytics, or third-party SDKs. It does not collect photos, location, device identifiers, or usage records for the developer, and the developer cannot access your photo library or exports through the app.
On-device processing
With Photos permission, the app can read photo dates, file information, dimensions, favorite state, Photos asset identifiers, available GPS/EXIF metadata, previews, and originals explicitly requested by an approved agent. It does not modify or delete photos and supports Limited Photos Library. This version does not download resources that exist only in iCloud.
Sharing with an agent you choose
Every connection runs only while the app is in the foreground. Before access begins, the app shows the self-reported agent name, source address, and requested access for your approval. Photo Courier sends approved data to that tool over local HTTPS. The agent you choose may send requested data to its own AI provider under that agent's privacy terms. Approve only agents you recognize.
Temporary files and deletion
The app briefly creates encrypted-at-rest, backup-excluded temporary copies so that it can send files reliably. A download URL is one-use; its file is removed after the transfer succeeds, fails, or disconnects. Leaving the foreground removes all remaining session files and revokes tokens. Crash leftovers are removed before the next local session; if cleanup fails, the service remains closed. The app has no seven-day retention and does not persist session audit history.
Network security and your controls
Production connections use TLS 1.2 or 1.3. The server key stays in this device’s Keychain (never backed up or migrated) and its self-signed certificate is rebuilt each foreground session, so the agent you give the copied public-key pin to can verify the device every time. While the app is open, devices on the same local network can see this public key and recognize the same device; it contains no photos or personal information. You can refuse any connection, move the app to the background to end the session, or change Photos and Local Network permissions in iOS Settings.
Contact and changes
If data practices change, this policy and the Privacy & Security section on the app’s home screen will be updated with the app. For privacy questions, use the contact method on the support page.
照片信使隐私政策
照片信使把 iPhone 或 iPad 照片库中由你允许的数据，临时交给同一局域网中由你批准的 AI Agent。
开发者不收集数据
照片信使没有开发者服务器、账号、广告、分析或第三方 SDK。它不会为开发者收集照片、位置、设备标识或使用记录；开发者也无法通过本 App 访问你的照片库或导出内容。
设备上的处理
经 Photos 权限授权后，App 可读取照片时间、文件信息、尺寸、收藏状态、Photos 资产标识、可访问的 GPS/EXIF，以及获准 Agent 明确请求的预览或原图。App 不修改或删除照片，支持有限照片授权。当前版本不会下载仅存在于 iCloud 的资源。
与所选 Agent 共享
每次连接只在 App 前台运行。访问开始前，App 会显示 Agent 自报名称、来源地址和所请求的能力，由你决定是否允许。照片信使通过本地 HTTPS 把获准数据交给该工具。你选择的 Agent 可能依据其隐私条款，把请求的数据发送给自己的 AI 服务提供方。请只批准你认识的 Agent。
临时文件与删除
为了可靠传输，App 会短暂创建受系统文件保护且排除备份的临时副本。每个下载地址只能尝试一次；成功、失败或断线后删除对应文件。App 离开前台时删除全部剩余会话文件并撤销令牌。异常退出残留会在下次本地会话前清理；清理失败时服务保持关闭。App 没有 7 天保留期，也不持久化会话审计。
网络安全与用户控制
生产连接使用 TLS 1.2 或 1.3。服务端私钥只保存在本设备钥匙串（不进备份、不随换机迁移），自签名证书每次前台会话重建而公钥不变，你复制给 agent 的公钥固定值因此每次都能核对设备身份。App 在前台时，同一局域网的设备可以看到这个公钥并认出同一台设备；它不包含照片或个人信息。你可以拒绝任何连接、让 App 退到后台立即结束会话，或在 iOS 设置中修改 Photos 与本地网络权限。
联系与变更
如果数据处理方式变化，本政策和 App 首页的“隐私与安全”说明会随版本更新。隐私问题请使用支持页面列出的联系方式。