These are our commitments to you -- on privacy, pricing, and what it means to trust an app with access to your photo library.
The app analyzes your photos using AI models that run entirely on your iPhone. Nothing is uploaded. Nothing is transmitted. No photo data hits any server -- ours or anyone else's.
What we do store on-device: a metadata record of what the AI found (confidence scores, categories, timestamps). This is a vault of findings about your photos -- not a vault of your photos. We use the word "vault" deliberately in that sense.
What reaches our servers: subscription status (via Apple's IAP infrastructure), anonymous crash reports if you opt in. That is the complete list.
Vault: Privacy Guardian was built by a software engineer who shipped GDPR compliance and ISO 9001 quality processes at Uber. The architecture here reflects that background -- not aspirationally, but operationally.
On-device means on-device. We do not have a back door. We do not have a "feature" that uploads for better results. The AI models are bundled in the app binary. They run on Apple's Neural Engine. They have no network path.
When we find gaps in our privacy posture, we document them and close them. We test claims. We verify what we ship. The changelog reflects this -- version notes describe what was broken and how it was fixed, not just what was added.
We publish the current US storefront prices on our pricing page, and Apple shows the final localized price before you purchase. We do not advertise a planned price as though it were already live.
If Apple preserves an existing subscriber's price after a future change, that preserved price remains visible in the subscriber's App Store account. The purchase sheet and subscription settings are the authoritative record for that customer.
If you cancel and later rejoin, Apple shows the price available at that time before you confirm the new subscription.
If recurring payments make you nervous, they should not be a barrier to protecting your privacy. Buy-once token packs let you pay for exactly what you need, when you need it, with no ongoing commitment.
The Peek unlock is a one-time non-consumable purchase -- you buy it once and it is yours permanently, restorable on any device with the same Apple ID. It shows you your four highest-risk detections without subscribing.
Video analysis, which previously required the Bundle subscription, is now also available as a standalone buy-once pack. This reflects a deliberate choice: features that were subscription-gated should become accessible to people who do not want subscriptions as the product matures.
The detection system uses two layers: Apple's SCA (Sensitive Content Analysis) as a fast prefilter, and our ONNX YOLO models for scored per-frame detection. SCA is binary -- it flags or does not flag. Our ONNX models produce confidence scores, which is why you see percentages in results.
We are methodical about the gap between "we added this feature" and "this feature is verified to work correctly." The version notes on the changelog page reflect this -- when something had a bug, we say what it was.
We do not claim accuracy figures we cannot support. The "dual-layer" architecture meaningfully reduces false negatives, but no detection system is perfect. The confidence scores tell you how certain the model is. Review results with that in mind.
If we discover a privacy issue, we disclose it. If a scan result was wrong in a way that could have misled you, we say so. If a feature shipped broken, it goes in the changelog with an honest description.
This is the standard we hold ourselves to. Not a legal standard -- a professional one. The kind that comes from having shipped production software at organizations with real accountability processes, and bringing that discipline to an independent app.
Questions, concerns, or issues: support@linked.skin