Privacy policy · Effective April 2026

We collect nothing.

Révéler has no analytics, no crash reporter, no event telemetry, no user identifier, no view counters, no scroll tracking. Zero third-party SDKs. Zero network calls of any kind. Nothing ever leaves your device — because nothing is ever sent.

What we collect

Nothing. There is no mechanism in Révéler by which your usage, identity, location, or activity is transmitted off the device. Specifically, we do not collect:

• Analytics events, heartbeats, or session data
• Crash reports or error telemetry
• Device identifiers (IDFA, IDFV, advertising ID, device name)
• Your location or any GPS data
• Your photographs, thumbnails, or image metadata
• Your roll names, notes, starred flags, or EXIF
• Your settings, preferences, or capture history
• Your email address, phone number, or any account data

We don't collect any of this because we don't have anywhere to send it. The app ships with no backend, no analytics SDK, no crash reporter, and no network calls of any kind to first- or third-party infrastructure.

What stays on your device

Everything Révéler remembers about your photography, it remembers locally. That data lives in three places, all of which are sandboxed to the app and never transmitted:

• Your photographs — saved as HEIC (or JPEG) files in the app's private Documents/frames/ directory, plus small thumbnails in Documents/thumbs/. You can optionally mirror each new frame to the system Photos library by turning on Settings → Save to Photos.
• Frame metadata — capture time, film stock used, your starred flag, your 140-character notes, which roll (if any) the frame belongs to. Stored in a local SwiftData database inside the app's sandbox.
• Settings and preferences — bath duration, daily frame cap, the "Save to Photos" toggle, your currently selected film stock, the active roll's identifier, and today's frame count. Stored in UserDefaults, the standard iOS key-value store for app preferences.

All three stores survive an iOS backup-and-restore flow because iOS includes the app sandbox in device backups. All three are deleted with the app if you uninstall Révéler — iOS drops the entire sandbox. Enable Save to Photos if you want a durable off-device copy of your frames.

Permissions we request

Camera

Required. Without it, the viewfinder can't show anything and the shutter has nothing to capture. iOS prompts you the first time you hit the camera screen; declining leaves the rest of the app intact (the contact sheet, settings, and knowledge center all still work) but the viewfinder shows a "Camera access is off" overlay with a Settings-app shortcut. You can revoke the permission anytime in iOS Settings; the app recovers gracefully when you return.

Photos (Add Only)

Optional. Requested only when you toggle on Settings → Save to Photos. Révéler requests the Add-only scope (PHAuthorizationStatus for .addOnly) — which lets the app write new assets to your photo library but explicitly prevents it from reading or deleting anything that's already there. If you never turn Save to Photos on, Révéler never asks for this permission.

Live Activities

Optional. Used to show the develop-bath progress pill in the Dynamic Island so you can leave the app during a bath and come back to it. The Activity's data (progress, phase label, stock short name) is generated entirely on-device and rendered by iOS locally — nothing about your Activity is transmitted anywhere.

Required-reason APIs

Apple requires apps to declare certain low-level iOS APIs in a PrivacyInfo.xcprivacy manifest shipped with the binary. Révéler's manifest declares exactly two, both for app functionality on-device only:

• UserDefaults — reason code CA92.1. Used to persist your settings (bath duration, daily cap, Save to Photos toggle), the currently selected film stock, the active roll's identifier, and today's frame count. Not used for tracking.
• System Boot Time via CACurrentMediaTime() — reason code 35F9.1. Used as a monotonic clock inside the develop-bath tick loop, the face-detection throttle, and the display-link wrapper that drives the 60fps bath animation. Strictly for measuring elapsed intervals within a running session; not used as a device identifier or tracking signal.

The manifest also declares NSPrivacyTracking = false, NSPrivacyCollectedDataTypes = (empty), and NSPrivacyTrackingDomains = (empty). You can verify these declarations by inspecting the app bundle or by reviewing the app in App Store Connect's privacy nutrition label.

Third parties

There are no third-party SDKs in Révéler. The app is built entirely with Apple-provided frameworks (SwiftUI, AVFoundation, Core Image, Core Haptics, SwiftData, Vision, Core Spotlight, ActivityKit, the Translation framework). All of those frameworks run locally on your device. None of them send data to Apple except as part of iOS's own diagnostics, which are governed by Apple's privacy policy, not ours.

Specifically, we use the following Apple frameworks in ways worth noting:

• Vision — for face-tracking autofocus. VNDetectFaceRectanglesRequest runs locally on-device and returns bounding boxes only. No face is identified, no embedding is produced, nothing is stored beyond the next frame.
• Translation — optional, used in the Knowledge Center so you can translate the film-stock story copy into your preferred language. Apple's Translation framework runs on-device after an initial language pack download. We don't send text anywhere ourselves.
• Core Spotlight — your roll names are indexed into Spotlight search so you can find a roll by name from the system search field. The index lives on your device. Frame contents are deliberately not indexed.

Children

Révéler is not directed at children under 13 and does not knowingly collect information from any user, regardless of age. There is no account system, no sign-up, and nothing to opt out of — because there is nothing being collected in the first place.

Changes to this policy

If we ever update this policy, we'll change the "Effective" date at the top of this page and note material changes in the app's release notes. If Révéler ever adds any form of tracking, analytics, crash reporting, or cloud sync, it will be opt-in, it will be disclosed here and inside the app first, and the PrivacyInfo.xcprivacy manifest will be updated to reflect the new collection before the change ships. That's a promise, not a plan.

Contact

Questions about this policy or about Révéler's privacy practices in general? Write to honorius@neogy.dev. Every message is read personally.