> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryrollup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and App Review

> What the Rollup SDK keeps on the iPhone, what it sends, and what you must tell the person.

## What stays on the iPhone

* **Photos and videos.** The SDK reads small previews to build the index. No image, video or preview is sent anywhere.
* **The index**: what photos show, when and where they were taken, the places visited, text read from images and screenshots. It lives in your app's container under `Application Support/Rollup`.
* **Search.** `search` runs on the iPhone and sends nothing about what was searched.

<Warning>
  The index lives in your app's own container, so your app's code can read its files. Treat it as the person's private data. Encrypting it would not change this, because the key would live in the same app.
</Warning>

iOS protects these files with its default data protection: they are encrypted until the iPhone is first unlocked after a restart. Indexing in the background needs that.

## What leaves the iPhone

| Sent to Rollup | When | What |
| - | - | - |
| Device registration | Once per install | A random installation ID and secret, an App Attest attestation, your app's version and the SDK's capabilities |
| Place and geography data requests | While indexing, with `places` on | The grid cells, 0.01 degrees on a side (about 1 km), that photos were taken in |
| `query` and `profile` | When your app calls them | The question or schema, and the text results of the agent's tools: dates, place names, labels, text read from images and screenshots, and the identifiers of photos |
| Run reports | After each indexing run | Timings, counts, outcomes, error codes, SDK and iOS versions, device model |
| Key checks | At launch, at each run, and daily | Your app's key and the device credential |

Rollup runs the `query` and `profile` agents with OpenAI as its model provider. Questions, schemas, conversations, tool results, answers and profiles are not logged or stored by Rollup, and requests to OpenAI are made with storage turned off. Answers and profiles come back only to your app on the iPhone.

Run reports and usage counts contain no photos, labels, places, text or questions.

## What you must tell the person

### Photos permission

The person grants Photos access through iOS's prompt. Your `NSPhotoLibraryUsageDescription` must say why your app reads their photos.

### Before query and profile

<Warning>
  App Review guideline 5.1.2(i) requires apps to clearly disclose where personal data is shared with third parties, including third-party AI, and to get explicit permission before sharing it.
</Warning>

`query` and `profile` send text derived from the person's photos to Rollup and its model provider. Before your app calls them:

1. Tell the person, in your app, that information from their photos is used to answer, and that it is sent to Rollup and to OpenAI.
2. Get their explicit permission, such as an "Allow" button, before the first call.
3. Let them turn it off later.

The Photos permission alone does not cover this. The SDK does not show this disclosure for you.

### Places

With `places` on, the areas the person's photos were taken in are sent to Rollup to download place data. Include this in your privacy disclosures and App Store privacy details, or turn `places` off.

## Deleting data

* `reset()` deletes everything the SDK keeps on the iPhone and the device's record on Rollup's server.
* If the person revokes Photos access, the SDK deletes the index the next time your app runs.
* If your app's Rollup access stays stopped for 30 days, the SDK deletes the index and models. See [Keys and revocation](/guides/keys-and-revocation).
* Deleting your app deletes everything in its container.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.