Skip to main content

​
What stays on the iPhone

  • Photos and videos. The SDK reads small previews to build the index. No image, video or preview is sent anywhere.
  • The index: what photos show, when and where they were taken, the places visited, text read from images and screenshots. It lives in your app’s container under Application Support/Rollup.
  • Search. search runs on the iPhone and sends nothing about what was searched.
The index lives in your app’s own container, so your app’s code can read its files. Treat it as the person’s private data. Encrypting it would not change this, because the key would live in the same app.
iOS protects these files with its default data protection: they are encrypted until the iPhone is first unlocked after a restart. Indexing in the background needs that.

​
What leaves the iPhone

Rollup runs the query and profile agents with OpenAI as its model provider. Questions, schemas, conversations, tool results, answers and profiles are not logged or stored by Rollup, and requests to OpenAI are made with storage turned off. Answers and profiles come back only to your app on the iPhone. Run reports and usage counts contain no photos, labels, places, text or questions.

​
What you must tell the person

​
Photos permission

The person grants Photos access through iOS’s prompt. Your NSPhotoLibraryUsageDescription must say why your app reads their photos.

​
Before query and profile

App Review guideline 5.1.2(i) requires apps to clearly disclose where personal data is shared with third parties, including third-party AI, and to get explicit permission before sharing it.
query and profile send text derived from the person’s photos to Rollup and its model provider. Before your app calls them:
  1. Tell the person, in your app, that information from their photos is used to answer, and that it is sent to Rollup and to OpenAI.
  2. Get their explicit permission, such as an “Allow” button, before the first call.
  3. Let them turn it off later.
The Photos permission alone does not cover this. The SDK does not show this disclosure for you.

​
Places

With places on, the areas the person’s photos were taken in are sent to Rollup to download place data. Include this in your privacy disclosures and App Store privacy details, or turn places off.

​
Deleting data

  • reset() deletes everything the SDK keeps on the iPhone and the device’s record on Rollup’s server.
  • If the person revokes Photos access, the SDK deletes the index the next time your app runs.
  • If your app’s Rollup access stays stopped for 30 days, the SDK deletes the index and models. See Keys and revocation.
  • Deleting your app deletes everything in its container.