Your photos, your places and your people never leave your Mac.
To chart an atlas of decades of memories, Calypso Photo has to read some of the most personal data on your computer: faces, names, coordinates, the labels you invented for your own life. None of it is ours. This page lists what the app reads and keeps local, what it measures, and the few things that genuinely cross the network — so you can check the promise instead of taking our word for it.
Last updated 3 September 2026 · Calypso Photo 0.1.0
No photo ever leaves
Not an original, not a video, not even a thumbnail. There is no Calypso cloud to upload them to.
Your catalog is a file on your disk
Everything the app learns — albums, places, people, tags, cameras — lives in a database on your Mac. Delete it and all of it is gone.
No account, no sign-up
The app never asks who you are. No e-mail, no login, no profile. It doesn't know your name and has nowhere to put it.
Your originals stay read-only
Whatever the app reads — any photo library, any drive, any file inside them — it only reads. Calypso Photo never writes a single byte back into a source.
Seen on your Mac, never collected
Building the atlas means reading a lot. Here is the personal data the app touches, item by item. All of it stays on your machine, in your catalog, under your control — and none of it is ever transmitted to us or to anyone else.
-
Your photos and videos
Read to identify, count, deduplicate, preview and export them. The pixels are never transmitted.
-
The thumbnails the app generates
Created on your Mac, stored on your Mac, used only to draw the app's screens and your desktop widgets.
-
Album names and hierarchy
“Wedding”, “Summer 2004”, and every folder you nested inside them.
-
Library and volume names
The names you gave your libraries and your external drives, and which drive holds what.
-
File names and paths
Original file names, folder structure and the exact location of every file on every disk.
-
The GPS coordinates of your photos
Read from the photo metadata to drop pins on the map. They stay in the local catalog — your movements are nobody else's business.
-
Place names
Cities, states and countries are resolved by an offline geographic database that ships inside the app. No location service is queried, so no server ever learns where you have been.
-
Faces
Face detection and grouping run entirely on your Mac, using Apple's on-device frameworks. No face image and no face data is ever uploaded.
-
The names you give to people
You name your family; the app writes it into your catalog and stops there. It never sends a name out and never compares it against anyone else's.
-
How many people you have, and how often each one appears
A count about your family is still information about your family. It stays local, like the names.
-
Tag names
The tags you invent, and the media each one reaches.
-
Dates, cameras and technical metadata
When each photo was taken, with which camera, at what settings.
-
What you type into search
Your search text stays on your Mac — unless you deliberately switch on an AI engine, which is spelled out below.
-
Export destinations and reports
Where you exported to, what was copied and what failed. The report is a file on your disk.
What we do measure
One small thing does leave your Mac: a stream of product events that tells us which features are used and whether they work. Each event is a name plus a few numbers — durations, counts, outcomes. It exists so we can see that exports fail too often on some setup, or that a screen nobody opens deserves to be rethought. Here is the complete list, with everything each event carries.
| Event | When it happens | What travels with it |
|---|---|---|
| App Launched | You open the app. | Nothing else. |
| Scan Completed | A scan of your drives finishes. | How long it took, how many media items the catalog holds, and how much disk the thumbnail and face-analysis caches use. |
| Export Completed | An export run finishes. | Which export mode, how many files were exported, how many failed. Never a file name or a destination. |
| Thumbnail Generation Started / Finished | You build thumbnails from the Thumbnails screen. | How many were generated, how many failed, how long it took. |
| Face Detection Started / Finished | A face-analysis run starts and ends. | How long it took. |
| Face Grouping Started / Finished | A grouping run starts and ends. | Whether it finished or failed, how many libraries were involved, how many groups came out, how long it took. Never a name, never a face. |
| Merge Review Opened | You open the merge review screen. | Nothing else. |
| Search Performed | A natural-language search runs. | Which engine answered, whether it succeeded, whether it had to fall back to another one, and how many results came back. Never the question you asked. |
| LLM Provider Connected | You connect your own AI account. | Which provider it was. No token, no account name, no e-mail. |
| Tag Created | You create a tag. | Nothing else — not the tag name. |
| Collection Created | You create a widget collection. | Nothing else — not its name or its filters. |
| Library Deleted | You remove a library from the catalog. | Nothing else — not the library name. |
| Camera Search | You drill into the Cameras screen. | Where you started from and which axis you used (model, make, year, rank). Never the term you typed. |
| Redundant Media Opened | You open the duplicates screen. | Nothing else. |
| Paywall Shown | The purchase screen appears. | Nothing else. |
| Checkout Started | You start a purchase. | Whether it went through the App Store or the direct store. |
| Purchase Succeeded / Failed | A purchase ends. | The store, the method, and — on failure — the technical reason, so we can fix what broke. |
| License Activated | A license becomes active. | How it was activated (license key, App Store purchase, restore, offer code). Never the key itself. |
What no event ever contains
- No photo, no video, no thumbnail.
- No file name, no path, no drive.
- No album, tag, person, place, library or volume name.
- No GPS coordinate.
- No text you typed — not a search, not a note.
- No name, no e-mail, no license key, no IP-based profile of you.
There is no account behind these numbers: the measurement tool generates a random identifier on this Mac so that two launches can be recognised as the same installation, and that identifier is all the “who” that exists. It is not tied to you, to your Apple Account or to your purchase.
Even the way the app recognises your Mac stays here. So that the same computer isn't counted twice when you activate your licence, the app has to tell this Mac apart from another one. It keeps a scrambled code for that — one that can't be turned back into anything about your machine — and that code never goes anywhere: not to us, not to the store, not to Apple.
Everything else that crosses the network
An app that sells licences, updates itself and draws a map does talk to the network. To make the promise above verifiable, here is the complete list of the rest — what it is, why it exists, and what it carries.
-
The support message you write
When you use Help → Customer Support (or the contact form on this site), your e-mail address and the text you wrote are sent to us — because that is how we answer you. Nothing is attached to it automatically.
-
Diagnostics — only when you send them
If we are chasing a bug with you, we give you a code and you send a diagnostic package: technical logs, a fixed list of facts about your Mac (macOS version, model, memory, your app settings) and plain counts from your catalog — how many libraries, volumes, albums and media items. The logs can mention library and file names, and that is exactly why nothing is ever sent unless you type the code and press send.
-
License verification
Your licence key is checked with the store that sold it, or your purchase is validated by the App Store. Nothing about your photos is part of that request.
-
Update checks
The app asks our update server whether a newer version exists. It is a request for a public file; nothing about your library goes with it.
-
FAQ and remote settings
The in-app FAQ and a small settings file are downloaded from our server. Again: a download, with none of your data attached.
-
Camera brands we don't know yet
If your photos name a camera brand our list has never seen, the app reports that brand string once — “OM SYSTEM”, say — so we can add it and show it properly for everyone. It is the manufacturer name alone: no photo, no model of yours, no count. Each brand is reported once, ever.
-
The map screen
The map itself is drawn by Apple Maps, so macOS fetches map tiles for the area you are looking at — exactly as in any Mac app that shows a map, and under Apple's privacy terms. The pins are computed on your Mac from your local catalog; your coordinates are never sent to us.
-
AI search — only if you switch it on
Natural-language search is off until you either enable Apple Intelligence or connect your own AI account. When you do, your question is sent to that engine — Apple's Private Cloud Compute, or the provider you connected, under your own account — together with the list of your tag names and people names, so the model can recognise them when you say “Ana in Paris”. Nothing about that passes through our servers, and we never see it. If you connect nothing, no search text ever leaves your Mac.
What we never do
- We never sell or share your data. There is nothing to sell: we don't have your photos, your places or your names.
- No ads and no advertising identifiers. The app carries none, and never will.
- No profiling. The events we measure describe features, not people.
- No hidden uploads. Everything that leaves your Mac is on this page.
- No trackers on this website. No analytics, no cookies, no ad scripts — the pages load their typeface from Google Fonts and nothing else. The demo video only contacts YouTube after you click play.
If anything here is unclear, or you want to know exactly what a specific screen does with your data, ask us — we read every message.