Your original photos, clips and PDFs never go to Opensolr. They leave the phone only for storage you own, when you set a backup. For each new photo the app sends a small copy, which Opensolr reads and does not store. What is kept is a description, in an index that belongs to your account, and in a copy of that index on the phone itself.
Figure 1 — where each piece of data lives.
An upright JPEG, 1024 px on its long edge, re-encoded from the pixels and carrying only the time, camera, lens, exposure and position of the original. With it go the file's name, folder and size, the md5 of the file, a fingerprint of the picture, the faces the phone found, and your tags and wording when this phone has them.
For a video, its first frame as the small copy, plus its length; for a PDF, each page drawn into a picture, plus its page number. The clip and the PDF file themselves never go to Opensolr.
The originals (or 1080p copies), a 720 px copy of each and a list per phone go from the phone straight to your S3 bucket or WebDAV folder. The phone sends nothing of it through Opensolr. Your Opensolr account keeps only the way in, sealed. See backup.
The words it was read into, its printed text, the people and their face fingerprints, your tags and wording, its place, its camera details, its path, folder, file name and size, and its search vector.
Tags, people, wording and places you set, carried by the sync after you save, with no picture.
The ids of the items you delete in the app, with the time, so your other phones remove them too.
Browsing, Stats and the tag suggestions send nothing; a typed search does.
Rounded to about ten metres before Opensolr turns it into place names, inside photos_ingest.
Only as tile requests, while the map screen is open.
With each call to Opensolr, in the request body, never in an address.
Never sent to Opensolr: the original files, the thumbnails in the grid, and anything about how you use the app.
- No analytics, no advertising, no crash reporting.
- No third-party SDK that talks to the network. The libraries are AndroidX, Jetpack Compose, WorkManager, OkHttp, Coil, osmdroid, LiteRT and CameraX. osmdroid draws the map and fetches its tiles only while the map screen is open; LiteRT runs the face models and CameraX the scanner, both on the phone, with no network.
- Once a day, and whenever you tap Check for updates, the app asks
api.github.comfor the latest release of Opensolr Photos: one unauthenticated request that carries nothing about you or your photos. In the copy installed from GitHub, when you tap to install a new version, the APK is downloaded fromgithub.com, unauthenticated too. The copy installed from Google Play is updated by Google Play. - No access to anything but your photos, clips and PDFs. To read PDFs other apps saved, the GitHub version asks for All files access, and still reads only the PDFs in the folders you sync. Your tags, the people you name and your wording are kept on the phone and in your own index, never written into a photo file. A photo file changes only when you edit it and choose to overwrite it, and a file is deleted only when you delete it in the app and confirm, on this phone or on another phone on the same index.
- This phone's API key and the index password, encrypted with a key held by the Android Keystore.
- The phone's copy of the index: everything the index holds except the search vector and the keys for similar photos. It never leaves the phone except to fill your index back after a Reset. Uninstalling removes it.
- Your edits that have not gone up yet: the tags, the people and the wording you gave photos, saved here first and carried up by the sync that starts straight after.
- The faces: frames, names and fingerprints for every photo read, the faces you unticked for a person, and which photos were read. Every comparison between faces happens here.
- Settings: chosen folders, schedule, the last sync report.
- Answers your index gave, kept for a short while in the search cache so the same question is not paid for twice, and thrown away with Clear cache.
Backups are switched off for the app, and its data, the copy of the index included, is excluded from cloud backup and from phone-to-phone transfer. A restored or new phone signs in again and reads the index once to rebuild the copy.
Android removes GPS positions from photos unless the app is allowed to access photo locations. Allow it and photos are indexed with their place; decline it and they are indexed without one. The choice can be changed in Android's settings at any time and applies to photos indexed from then on. See places.
When this phone's index is created, Opensolr looks at the internet address the phone connects from to put the index in the region nearest to you. The phone's own position is used only if you turn on Locate new photos.
Trust
- Privacy
- Security model