AI That Stays Home: Why Pixel Gallery Runs Every Model on Your Phone

For a decade, “smart” photo apps have meant one architecture: upload everything, run the models in a data center, show the results on the phone. The intelligence lived on the server, so the photos had to live there too. That is the trade every cloud gallery asks you to make, and most people made it without noticing.

Pixel Gallery is built on the premise that the trade is no longer necessary. Not because phones caught up with data centers, they did not, but because the specific models a gallery needs have become small enough to run where the photos already are.

What a phone can run today

The gallery pipeline is not one giant model. It is a series of narrow ones, each good at one job:

• Face detection and embeddings run comfortably on any recent phone through ML Kit and a compact embedding model.
• Image labeling and text recognition are mature on-device tasks; ML Kit ships them for five scripts.
• Barcode and QR detection is trivial by comparison.
• Subject segmentation separates foreground from background for blur and cutouts.
• Captions and descriptions use Gemini Nano, a language model small enough to live in Android’s AICore on supported devices.
• Semantic embeddings use SigLIP2, an open vision-language model quantized to run on a phone CPU at roughly two seconds per image.

Chain those together and you get people, search by meaning, searchable text, captions, memories, cleanup and statistics without a server. That is the whole on-device pipeline.

The costs we accept

Running models on the device is not free, and pretending otherwise would be dishonest.

Time. A cloud service indexes your library on a rack of GPUs. A phone indexes it while charging overnight. First indexing of a large library takes a while, and the app is built around that: steps run independently, report progress, and resume.

Storage. The semantic search model is about 375 MB. It is optional and delivered through Google Play, and you can require Wi-Fi or remove it later.

Hardware limits. Gemini Nano only runs on supported devices. The semantic model is hidden on phones without enough RAM. When a step cannot run, it is skipped. There is no cloud fallback, on purpose, because a fallback would quietly reintroduce the upload.

Model size. No on-device model matches a frontier cloud model at open-ended understanding. A query like “photos of my grandfather” does not work until you have named him in People, because no local model knows who he is. We think that is the right kind of limitation: one that you resolve by adding your own knowledge, not by sending your photos away.

What it buys

No account. No upload. No monthly server bill to pass on, which is why Premium is a one-time purchase. Search that works on a plane. A database of faces, places and text that is encrypted on the device with a key in the Android Keystore, rather than a database of the same things sitting on someone else’s infrastructure.

It also buys clarity. The Privacy first page can list every network connection the app makes, because there are so few of them.

The line we hold

Every feature has to pass one test: can it run here? If the answer is no, the feature waits until it can. Semantic search waited until SigLIP2 could run on a phone. Captions waited for Gemini Nano. Both shipped when the phone was ready, not when a server was.

That is what “AI that stays home” means in practice. The phone is the AI. Not someone else’s server.