Privacy policy
Scope and contact
This policy applies to the PhotosMemory iPhone app (previously named Yorli and Photo Memories). Operator: Yunpeng Wang. Privacy and support: qmqx2026@163.com. We do not operate a photo-processing server, require an account, show ads, access advertising identifiers, or integrate behavior-tracking or third-party analytics SDKs. You choose whether to contact us by email, which is handled by the email provider. Do not send identity documents, original photos or sensitive information.
On-device playback diagnostics
Playback diagnostics are enabled by default in this release solely to investigate loading and playback issues. In Settings > Export troubleshooting logs, you can disable or clear them, or choose to export them. Logs contain event times, app and system versions, session and media-request states, buffering and seeking events, memory-pressure signals and clues that the main thread was unresponsive for an extended interval. Asset identifiers are replaced with hashes; original photo identifiers, photo or video content, coordinates, place tags, private notes and original filenames are not written. Logs are batched at low frequency on a background queue and rotate on this device only, up to 2 MiB and seven days. There is no logging server or automatic upload, and logs are not used for recommendation preferences or advertising analysis. Background writes and iOS process limits mean the final events before force-quitting, a crash or system termination may not be saved. Missing logs do not prove that no stall occurred, and diagnostic clues do not necessarily establish a cause. A copy reaches a system share destination only when you choose to export and share it. You and the recipient manage that copy; clearing local logs cannot recall copies already shared.
Recommendation sessions and caches
Every cold launch discards the previously loaded recommendation queue and prepares a new batch. The old queue is not restored after force-quitting, process recreation or an iPhone restart. A brief background visit can retain the current position while reducing media caches; returning after at least 30 minutes away discards the old queue and prepares a new one. Continuous viewing is not interrupted merely because 30 minutes elapsed. iOS may reclaim caches, and preparing a new queue cannot guarantee zero waiting. These session changes clear temporary content, not existing effective reads, favorites, notes, album relationships or settings. Recommendations still respect current authorization, exclusions and read rules.
Photo access and on-device processing
You may allow access to all photos, selected photos, or none. Access is needed to browse and recommend your photos, but not to read policies and help. Apple PhotoKit reads permitted photos and videos, capture and edit dates, the library-added date when available, dimensions, formats, photo types, existing coordinates, favorite flags and available album relationships for display, filtering and recommendations. The library-added date is not the capture date. Existing photo coordinates can be matched to nearby cities using a bundled offline GeoNames index. This offline matching sends no photos or coordinates to a place service. Optional Apple detailed-place lookups are described below. These are approximate city labels, not exact addresses, and may be unavailable or inaccurate. For media with a capture date and location accuracy within 100 m, the app also counts permitted photos and videos within 1 km on the same day on device. This provides an approximate count tag and a lightweight on-device ranking feature. The app also counts permitted media captured within 15 minutes before or after an item for another count tag and lightweight ranking feature. Neither count identifies a trip or event, stores a location trail, or bypasses sensitive-document screening, content filters or read avoidance. Elevation and vertical accuracy from an existing capture location are used only for approximate display tags when sufficiently accurate, not recommendation ranking. Local image files can supply camera, lens, focal length, aperture, shutter speed, ISO, EXIF true-north direction, capture time zone, embedded IPTC place fields and keywords. Locally available videos can supply frame rate, audio-track presence, QuickTime camera model, embedded place name and keywords. Only whitelisted fields are cached in memory; full metadata dictionaries are not stored and originals are not downloaded for tags. Embedded file places are claims in the file, not live positioning. Dates use the file time zone when available, otherwise your current zone. Anniversary, weekday and season labels are rule-derived, not semantic recognition or observed weather. Sunrise/sunset timing is an approximate on-device calculation from existing capture time and sufficiently accurate location, not a claim about the image or observed weather. Its two lightweight ranking features have no preset preference and learn only from on-device browsing feedback. Everyday browsing, recommendations and local organization do not modify or move originals in Apple Photos. Only when you choose deletion in the More menu and confirm with iOS does the app request deletion of that original photo or video; see Storage, security and deletion. We do not access hidden photos or identify people by name.
Optional Apple place labels and maps
Apple place labels are off by default and require explicit confirmation. After consent, a place is looked up on demand only after you pause on the currently visible photo or choose Map and address, by sending existing coordinates and necessary connection information (such as IP address) to Apple's geocoding service. No photos, videos, notes, album names, capture dates or photo identifiers are sent. Loaded batches and offscreen photos are no longer queried ahead of time; the app does not scan the library or look up places in the background. Valid cached results are reused for identical coordinates and language. Swiping away cancels pending work, and failed lookups pause before retrying. Earlier manual-only consent does not authorize automatic visible-photo lookups. Current-location access is not requested and cannot restore missing capture coordinates or improve their accuracy. Queries follow the app language and prefer Simplified Chinese in Chinese mode; Apple may lack a translated name or return an approximate locality. Local captions stop at a city reference (or a coarser state/country), without guessing a district. The found label replaces the local one in place, without waiting for a map, reloading photos or changing read history. Captions stop at a structured district or county where available, otherwise the city; no district is inferred from a full address. Tapping a place label first opens an on-device, two-column list of memories from the same place. A photo in the two-column list counts as read only when its image is ready, more than 60% is visible, and you pause on it in the foreground for the existing read threshold. Loading, quick scrolling and background time do not count. Video thumbnails do not count as reads; open a video and play it to meet the existing playback threshold. Choosing Map and address opens more address detail and an Apple map. A slow map does not hold back the completed address lookup. Coarse fixes or distant matches do not show street addresses; unknown accuracy is disclosed. Offline, timed-out or failed lookups preserve the local label. Hiding found-place labels also pauses automatic lookups and does not grant query permission. Results remain only in memory, at most 128 entries for 30 minutes, never merged into the offline dictionary or saved in local records, ranking, logs or backups. Disabling lookups, backgrounding, clearing local records or memory pressure clears the cache and cancels requests; sent requests cannot be recalled. Apple's processing follows Apple Maps & Privacy: https://www.apple.com/legal/privacy/data/en/apple-maps/. The app operator receives none of these queries on a server.
Nearby across days tag
The app also counts other distinct capture days within 1 km of this photo or video using existing capture dates and locations accurate to 100 m or better in the currently permitted, non-hidden library. Both location errors are included in the distance bound. The count is capped at at least 10 days and days are grouped in the phone's current time zone. This approximate display tag cannot prove a return visit or shared event, stores no location trail and does not change recommendation ranking.
Optional on-device visual tags
Visual tags are on by default and can be disabled in Settings. After a photo or video passes sensitive-document screening, Apple Vision classifies an image and detects face rectangles on device as needed. In the feed, a second cat-and-dog check runs only when the first pass suggests an animal without a confident cat or dog label. Opening the full tag sheet may separately check a photo for cats and dogs. A locally available video cover is labeled separately; opening the full tag sheet may sample at most three interior frames and check them for cats and dogs without downloading a cloud original. These clues do not describe the whole clip. Only common scene or object clues in a limited allowlist and above a confidence threshold, plus whether one or multiple faces or cats and dogs were detected, are shown. Results can be missing or mistaken. Face rectangles do not identify anyone, and animal detection does not identify individual pets. We do not identify people by name, read private People groups or intelligence labels from Apple Photos, persist image copies or full classification outputs, or download cloud originals just to add tags. For screened photos, up to 5,000 compact on-device theme records contain an asset fingerprint, analysis time and high-confidence broad themes: flowers, parks and gardens, coasts, mountains, animals, food, architecture and snow. Records expire after 90 days or a detectable asset change. These clues can lightly influence retrieval and ranking together with actual favorites, organization and viewing feedback; a read alone is not a preference. They never override exclusions or read avoidance. A tree or plant alone is not treated as a park. Turning the setting off clears the visual-label cache and saved theme index; clearing all local records also removes this index. Album-source tags use actual readable PhotoKit membership, including the available system Favorites album. Other public smart-album names are display-only tags and do not feed user-album preference learning. Local album names come from albums you create in this app.
Background preparation
Background preparation is enabled by default and can be disabled in Settings. During a short period after leaving the app and refresh opportunities granted by iOS, the app may screen a limited number of locally available photos, prepare upcoming images in memory and build the on-device theme index described above. It does not start new iCloud-original downloads, play media, count preloads as reads or request current location in this work. Low Power Mode, high thermal state and memory pressure limit or stop preparation. iOS controls timing and duration; regular execution or loading-free browsing is not guaranteed. Image memory caches may be reclaimed. Theme records and screening summaries remain in the protected, backup-excluded local records directory.
Sensitive documents excluded by default
Recommendation candidates are checked on device using Apple Vision for signs of identity documents, bank cards, contracts, receipts, medical files and similar documents. Videos are sampled at 3–24 points across the timeline. Any positive or failed check withholds the video. Brief sensitive frames between samples can be missed; this is not a frame-by-frame safety guarantee. Screen recordings are excluded by default. Unchecked media and failed checks are withheld from recommendations. Only broad categories and check times are saved, not recognized text, names or document numbers. Detection can miss or wrongly exclude content and does not replace your judgment. Manually opening a photo in a local album does not mean it passed recommendation screening.
Optional current location
Only after you tap Get current location once and grant system permission does the app request one foreground location to adjust upcoming recommendations and show temporary distance tags for photos with usable capture coordinates and accuracy. Distance tags describe the relation to your current position, preserving original capture-place names. Clearing the location or its 15-minute expiry removes the tags without changing your current queue. There is no continuous tracking, address lookup or saved location trail. Current location stays temporarily in memory for up to 15 minutes. Leaving that settings page cancels a pending location request. Recommendation records may store distance-derived feature values, but not raw coordinates from the current-location request. Basic browsing works without location permission.
Records you create in the app
Favorites, private notes and drafts, user-authored photo and video tags, local album relationships, filter preferences and interactions are stored in the app sandbox to keep your organization and personalize ordering. The recommendation queue is for the current visit; a cold launch does not restore the previous queue. Notes are private, not public comments, and their text is not analyzed semantically. Effective reads contain only photo identifiers and viewing times, without image copies. You can retain 1,000, 5,000 or 10,000 reads; the default is 10,000. Lowering the cap removes the oldest read records. Up to 2,000 recently shown items are avoided for 3 days in normal recommendations. Reaching an item counts as shown. A photo is read after one second of actual viewing; a video after three seconds of actual playback, or half its duration for short clips with a one-second minimum. Loading, pausing, preloading, background time, overlays and grid covers do not count as video reads. Weak consumption signals and preference events each retain up to 512 entries. Read cooldown can be 7, 30 or 90 days, with 30 days as the default. Cooldown expiry does not erase read records. With Only recently unread enabled, all retained reads are excluded. Favorites, notes, your tags and album relationships stay until you remove them or clear local records. User-authored tags are shown separately from automatic tags and do not automatically become recommendation preferences. Bounded personalization records rotate. Sensitive-category cache holds up to 3,000 entries and is rechecked after photo or rule changes or expiry.
Internet access and intentional sharing
Recommendation computation happens on device. If Allow on-demand iCloud downloads is enabled, Apple PhotoKit may download photos or videos not available on this iPhone from your iCloud account, using network data. You can turn this off. We do not operate that service or receive the downloaded photos on a server. Sharing creates a static JPEG without original EXIF/GPS metadata or private notes or exports a fresh MP4 containing picture and sound tracks without original descriptive/location metadata or private notes. It passes the copy to the system sharing destination you select. Picture and sound may still reveal people, places or other private information. The destination handles data under its own rules. Temporary exports are deleted after normal sharing dismissal; after an abnormal exit they may remain in the system temporary directory until cleanup.
Storage, security and deletion
Local records use iOS file protection. The app record directory is excluded from system backups and is not synchronized across devices. You may delete notes or your tags, remove favorites, manage local albums, or confirm clearing all local records and screening cache in Settings > Data & privacy. Your iCloud download choice is retained. Clearing local records, filtering recommendations or removing local album membership does not delete original photos or revoke system permissions. These actions cannot recall copies already shared to other apps. Future use creates new records. Deleting the app loses its records; iOS Offload App, which keeps data, is different from deleting the app. Keep your own copies of important notes. We cannot recover these records. Original deletion is a separate action: after you choose deletion in a photo or video's More menu, iOS provides the sole deletion confirmation; only after that system confirmation does the app ask PhotoKit to delete that original, not merely hide it from recommendations. If iCloud Photos is enabled, Apple syncs the deletion to other devices using the same Apple Account with iCloud Photos enabled. Originals can usually be recovered from Recently Deleted in Apple Photos within 30 days; availability and the recovery period follow the system display and Apple's rules. This app cannot restore originals. This action does not intentionally clear the item's app favorites, notes or local album relationships, but related content may be unavailable while the item is missing. Before deleting, make sure this is what you want and keep your own copies of important originals. Apple guidance: https://support.apple.com/en-us/104967.
Your choices and rights
You can change the photo access scope or revoke photo and location permissions in iOS Settings. In the app, you can access, correct or delete notes, tags, favorites and album relationships you create and clear personalization records. The operator cannot remotely access or restore these local records. If you email us, you can request access, correction or deletion of personal information in that correspondence through the address above. Correspondence is kept only to handle requests and necessary legal obligations. We do not require uploading your library to exercise your rights.
Public website and email
Public policy and help pages use a third-party website hosting provider. Visiting them may cause that provider to process IP addresses and other connection information for delivery, security and operations under its own privacy rules. The pages have no photo-upload service, account login or online recommendation service, advertising, third-party analytics scripts or contact forms. Website visits and intentional email are separate from on-device photo processing. You can also read these policies offline in the app.
Minors and policy updates
This is a general photo organization tool, not directed at children. It has no contact with strangers or public publishing. Minors should manage photo access and sharing with a guardian. Policy changes update the version shown here. Any future server, synchronization, analytics or other new processing purpose will be explained before implementation and require separate consent where legally necessary. Contact the privacy email if needed.