Your original photos never leave your phone. For each new photo the app sends a small copy, which Opensolr reads and does not store. What is kept is a description, in an index that belongs to your account, and in a copy of that index on the phone itself.
Figure 1 — where each piece of data lives.
An upright JPEG, 1024 px on its long edge, re-encoded from the pixels and carrying only the time, camera, lens, exposure and position of the original. With it go the file's name, folder and size, the md5 of the file, a fingerprint of the picture, the faces the phone found, and your tags and wording when this phone has them.
The words it was read into, its printed text, the people and their face fingerprints, your tags and wording, its place, its camera details, its path, folder, file name and size, and its search vector.
Tags, people, wording and places you set, carried by the sync after you save, with no picture.
Browsing, Stats and the tag suggestions send nothing; a typed search does.
Rounded to about ten metres before Opensolr turns it into place names, inside photos_ingest.
Only as tile requests, while the map screen is open.
With each call to Opensolr, in the request body, never in an address.
Never sent anywhere: the original files, the thumbnails in the grid, and anything about how you use the app.
- No analytics, no advertising, no crash reporting.
- No third-party SDK that talks to the network. The libraries are AndroidX, Jetpack Compose, WorkManager, OkHttp, Coil, osmdroid, LiteRT and CameraX. osmdroid draws the map and fetches its tiles only while the map screen is open; LiteRT runs the face models and CameraX the scanner, both on the phone, with no network.
- Once a day, and whenever you tap Check for updates, the app asks
api.github.comfor the latest release of Opensolr Photos: one unauthenticated request that carries nothing about you or your photos. In the copy installed from GitHub, when you tap to install a new version, the APK is downloaded fromgithub.com, unauthenticated too. The copy installed from Google Play is updated by Google Play. - No access to anything but images. Your tags, the people you name and your wording are kept on the phone and in your own index, never written into a photo file. A photo file changes only when you edit it and choose to overwrite it, and is deleted only when you select it and confirm.
- This phone's API key and the index password, encrypted with a key held by the Android Keystore.
- The phone's copy of the index: everything the index holds except the search vector and the keys for similar photos. It never leaves the phone except to fill your index back after a Reset. Uninstalling removes it.
- Your edits that have not gone up yet: the tags, the people and the wording you gave photos, saved here first and carried up by the sync that starts straight after.
- The faces: frames, names and fingerprints for every photo read, the faces you unticked for a person, and which photos were read. Every comparison between faces happens here.
- Settings: chosen folders, schedule, the last sync report.
- Answers your index gave, kept for a short while in the search cache so the same question is not paid for twice, and thrown away with Clear cache.
Backups are switched off for the app, and its data, the copy of the index included, is excluded from cloud backup and from phone-to-phone transfer. A restored or new phone signs in again and reads the index once to rebuild the copy.
Android removes GPS positions from photos unless the app is allowed to access photo locations. Allow it and photos are indexed with their place; decline it and they are indexed without one. The choice can be changed in Android's settings at any time and applies to photos indexed from then on. See places.
When this phone's index is created, Opensolr looks at the internet address the phone connects from to put the index in the region nearest to you. The phone's own position is used only if you turn on Locate new photos.
Trust
- Privacy
- Security model