Privacy first
Privacy, in plain language
This page is not the legal privacy policy. It is the honest version: what stays on your phone, what the app talks to, and what we chose not to build.
The model: local first, no account
Pixel Gallery reads the photos and videos that are already on your phone and builds an index next to them. Faces, labels, recognized text, captions, colors, quality scores and semantic embeddings are all computed by models that run on the device. There is no sign-up, no cloud library and no copy of your media anywhere else. Pixel Gallery never uploads your photos or videos.
Permissions, and why each exists
- Photos and videosRead your media library. This is the gallery.
- Media locationRead the GPS tags already inside your photos for the map, places and countries. This is not a live-location permission.
- Contacts (optional)Only if you link a person to a phone contact. Never requested otherwise.
- BiometricsApp lock, vault lock and per-collection locks.
- NotificationsIndexing progress, memory notifications, export and Home-View status.
- Wi-Fi and network stateHome-View needs to know whether you are on a local network and to advertise the local server.
- Run at bootRestores widget auto-cycling and scheduled indexing after a restart.
What is encrypted, and what is not
The database that holds the sensitive derived data, meaning faces and face embeddings, locations, labels, recognized text, colors and semantic embeddings, is encrypted with SQLCipher. The key is generated on the device and stored in the Android Keystore, so it cannot be read from a file backup.
Your photo files are not touched. They stay ordinary files in your storage, readable by any app you grant access to. Collections, favorites and descriptions are stored in a separate, unencrypted database. Pixel Gallery does not offer end-to-end encryption and does not claim to.
Backup
If Android Auto Backup is enabled on your phone, app settings, favorites, collections and descriptions can be included in your Google account backup and in device-to-device transfers. The encrypted metadata database and its key are excluded from backup by the app's backup rules.
Every network connection the app can make
- Google PlayInstall and updates, Premium billing, in-app reviews, and the optional semantic search model delivered as a Play asset pack.
- Firebase AnalyticsOff by default. Analytics storage, ad storage and ad personalization are all disabled until you consent in the app.
- Firebase CrashlyticsCrash reports so bugs can be fixed. They contain stack traces and device info, not your media.
- Firebase Remote ConfigFeature flags and the AI model catalog, fetched at start.
- Firebase HostingThe Home-View web viewer is downloaded once, cached on the phone and then served locally. Your media never passes through it.
- Google MapsMap tiles for the map view. Google sees which tiles are requested, not your photos.
- Google Lens and Gemini appsOnly when you choose the hand-off action in the viewer. That sends the selected image to Google.
Home-View is local, by design
Home-View runs a small web server on the phone and only accepts connections from the local network. It refuses public addresses, requires a session token from the QR code, lets you approve each device, and stops itself when Wi-Fi drops, the battery runs low or the session expires. It is not remote access, and it does not use HTTPS, so treat it like any other device on your home network.
What we do not do
- No cloud AI. If a device cannot run a model, the feature is skipped rather than outsourced.
- No ads and no advertising ID.
- No matching of faces against external databases. Groups are local and names are yours.
- No open-source release yet, and no third-party security audit yet. We say so rather than imply otherwise.
Your data, your call
Settings contains a Delete all data action that removes the index, faces, collections and preferences. Uninstalling the app does the same. Your photos remain exactly where they were.