Life Capture Privacy Policy

Your life is never the product#

Life Capture's mission is legacy without strings or monetization. We sell a tool, once. We never sell, rent, mine, or monetize what you make with it. There is no subscription that can lapse and lock you out of your own past, no advertising between your memories, no analytics watching how you use them, and no training of AI models on your photos, your voice, or your words. Revenue comes from the price of the app and nothing else — so the app answers to you, not to an engagement metric.

This policy is short because the business model asks nothing of you beyond the purchase.

The short version#

Life Capture does not collect your captures. There is no account to create, no hosted sync, no analytics, and no advertising. AI processing runs on your Mac by default. Cloud narrator and Cloud photo descriptions are separate, default-off Private Cloud Compute options. Optional remote receiving sends an Apple-signed app-acquisition proof to the Life Capture management service to create an encrypted route to your Mac; the service does not receive the capture content or its encryption key. Your archive and original media remain on your Mac. When enabled, Weather and Place Names send the dates or coordinates needed for lookups to Apple. An optional image-understanding model downloads only when you choose Download. You control any transfer, export, or publication of your archive content.

What Life Capture collects#

Life Capture reads the local files you choose to import and writes its derivatives back to local storage. It does not send your photos, video, voice, writing, transcripts, Journals, or search data to the developer. The optional Apple service requests described in this policy, including Cloud narrator and Cloud photo descriptions, are not developer-operated storage. If you enable built-in remote receiving, the Life Capture management service receives the setup values described below and no capture payload.

For App Store privacy disclosure purposes, Studio declares User ID data linked to you and used only for App Functionality. This represents the one-way app-transaction hash retained while a remote registration is active. Studio declares no tracking. Pocket declares no data collected. Neither app includes third-party tracking or analytics SDKs, advertising, or a required account.

On-device processing#

By default, Life Capture Studio transcribes voice notes, reads photos, and drafts a day's story on your Mac using Apple's own frameworks — Apple Speech for transcription, Apple Vision for photo understanding, and Apple's on-device Foundation Models for writing. Cloud narrator sends only the text described below for journal writing; it does not authorize photo transfer. Studio 1.4.1 requires separate consent for Cloud photo descriptions. Transcription remains on your Mac.

Life Capture Studio may perform Apple-local capability checks and provision Apple's on-device models (for example, through Speech, Foundation Models, and Apple's asset installation paths). Those paths prepare local Apple capabilities on your machine; they are not channels for uploading your content.

Cloud narrator (optional)#

Cloud narrator is an optional journal-writing feature introduced in Life Capture Studio 1.4.0. It is off by default and requires macOS 27 with Private Cloud Compute available on your Mac. It runs Apple's larger writing model on Apple's Private Cloud Compute servers. This option is in Studio, not Pocket.

Only with your explicit opt-in, and only while the Cloud narrator toggle in Settings is on, Studio sends the text the journal is written from — event notes, transcripts, photo captions, dates and places. Photos, audio, video, and your archive are never sent to Cloud narrator.

Apple processes the text on Apple silicon servers under its stateless-compute design. It is not stored, is not readable by Apple, and is never used to train models. Life Capture still has no accounts and no analytics. Nothing is retained anywhere but your Mac.

Life Capture works without Cloud narrator. You can turn it off in Settings; turning it off changes nothing about your archive. If Cloud narrator is offline, reaches its quota, or is unavailable, Studio writes on your Mac instead.

Cloud photo descriptions (Studio 1.4.1)#

Starting with Studio 1.4.1, including TestFlight builds, Cloud photo descriptions is a separate optional setting, off by default on each Mac. It requires macOS 27 with Private Cloud Compute image processing available. Cloud narrator's text-only permission does not authorize images. This option is in Studio, not Pocket.

Only while you enable Cloud photo descriptions, Studio sends Apple Private Cloud Compute an orientation-corrected sRGB copy of the displayed still photo, including saved edits, at no more than one million pixels. Incidental EXIF, GPS, IPTC, TIFF, and text metadata are removed. If an intended edit is not ready or the image cannot be prepared, no image is sent. The caption prompt may include only this photo's tags, typed note, linked spoken-note transcript text, locally detected subject counts, and supplied time-of-day and place context. This inventory is shown before the toggle in Settings.

This does not send original photo files, filenames, archive paths, unrelated journal records, raw audio, videos, video preview frames, or your archive. Cloud photo descriptions uses Apple's first-party Private Cloud Compute service under the stateless-compute design described above. It introduces no third-party model service. Local Vision labels, recognized text, and subject counts remain available in your archive.

While enabled, Cloud photo descriptions handles still-photo captions ahead of the optional local image model. If a cloud description cannot complete or is not usable, Apple Vision supplies the local result; Studio does not load or download the local image model as a fallback. Existing useful captions for the same image and your caption edits keep their author, with any failed cloud attempt recorded separately. Video preview frames remain on the existing local route.

Turning this option off cancels pending cloud work and discards late responses. It cannot recall an image already sent and does not delete existing descriptions. Turning it back on does not revive old work or reprocess your archive; use Refresh Photo Descriptions to update existing captions. This option does not download or remove the local image model.

Rich image understanding (optional)#

Photos are described on your Mac by Apple Vision by default — no setup, no network. If you choose Download for rich image understanding in Settings, Life Capture downloads an open vision model once (about 6 GB — Qwen3.5, from the MLX community repository on Hugging Face) and then runs it entirely on your Mac. This model processes your photos, captions, tags, and notes on your Mac; its network use is limited to the model download or resume you explicitly start, and the Settings pane names the exact model, its source, and links its public model card before you agree. Removing the download in Settings returns the local photo route to Apple Vision; Cloud photo descriptions keeps its separate setting.

Rich image understanding is entirely opt-in and needs a Mac with enough memory; Macs that can't run the local model use Apple Vision for the local route. Cloud photo descriptions is a separate option in Studio 1.4.1. The downloaded model is a pre-trained open model that runs locally — it is never trained or fine-tuned on your content.

The model integration uses reviewed MLX and Hugging Face software libraries. Download requests identify the public model and files and expose ordinary connection information, such as your IP address, to the model host and its delivery providers. These requests do not include your archive content.

Weather and place-name lookups#

When a day has a location, Studio can request that day's weather from Apple's WeatherKit service. The request contains the date and location needed to return weather; it does not include your photos, video, voice, writing, transcripts, or Journal. No weather request is made for a day without a location.

Place Names uses Apple's geocoding service to resolve coordinates into human-readable locations. It sends the coordinates being resolved to Apple; it does not send your photos, voice notes, or writing. Weather and Place Names start enabled and may run automatically when you open or import located Moments. Turn either off in Settings to stop new lookups. A request already transmitted cannot be recalled. Previously saved local context remains in the archive; disabling a feature does not delete earlier generated writing or external copies.

Calendar reads authorized events through Apple Calendar on your Mac. It does not upload them to Life Capture. You can disable this context in Studio and revoke calendar permission in macOS Settings.

Remote receiving (optional)#

Studio's built-in remote connection is off by default. After you pair one or more iPhones locally and press Enable in Studio, Studio sends the fixed Life Capture management service an Apple-signed App Store acquisition proof, Apple's device-verification identifier, and random connection identifiers. The service independently verifies that proof before it allocates and publishes a route. You do not create a Life Capture account or enter a setup invitation.

The proof and device-verification identifier are used only to authorize and bound setup. Studio and the service do not retain them. While the registration is active, the service retains a one-way SHA-256 hash of the verified app-transaction identifier so it can limit the number of active Mac registrations. Revocation erases that hash. The service also retains hashed device credentials and the routing state and secrets needed to provision, recover, and remove the connection. It does not receive your archive path, pairing token, capture encryption key, or capture content.

Captures, notes, tags, confirmations, and returned vocabulary are encrypted between each paired iPhone and your Mac before they pass through the route. Cloudflare can observe connection addresses, timing, transfer sizes, and encrypted protocol traffic, but cannot read that content. Studio must be open and the Mac awake, and Pocket must remain in the foreground while sending. Turning remote receiving off retires its current local enrollment; Remove Remote Connection also asks the management service to revoke its route. Both apply to the route every paired iPhone shares; unpairing a single iPhone instead revokes only that iPhone's remote access, and the other paired iPhones keep their pairing, consent and ability to send. Your archive and local pairings remain on your devices.

Road Mode and the Private Place Trail#

Road Mode is off by default. If you turn it on, it uses Apple’s low-power Visits service—not continuous GPS—to keep a rolling Private Place Trail on your iPhone. Always Location is required so iOS can deliver visits when Life Capture is not open.

The private trail contains arrival and departure times, estimated location centers, accuracy radii, delivery metadata, and local markers for stops you chose to promote. It keeps up to 512 stops. Default retention is 30 days; you can choose 7 or 90 days in Settings. Expiry happens at the next Life Capture or visit-service opportunity after a retention boundary, so it may not occur at the exact boundary.

Unpromoted private-trail records:

• stay only in Life Capture’s local iPhone container;
• are excluded from device backup, without claiming that backup exclusion is cryptographic erasure;
• are not exported, transferred to Studio, logged, geocoded remotely, or included in analytics or diagnostics;
• never become Moments unless you select the stops and Save.

Pause and Turn Off close Life Capture’s state gate immediately so new Road Mode deliveries are rejected. Existing stops remain until they expire or you delete them. Revoking system Location permission likewise suspends collection without silently deleting the trail. You can delete an individual stop from the trail review or use Delete Private Trail to remove the whole trail, including temporary, journal, and quarantined trail artifacts.

Once you select a stop and save it as a Moment, that ordinary Moment follows the existing archive, owner-directed transfer, export, retention, and deletion policy. Deleting a private-trail record does not delete a Moment you already saved.

Transfer, export, and publishing#

Pocket can send selected Moments to your paired Studio using an encrypted connection. When you enable automatic sending, pending Moments can transfer when that Mac becomes reachable. Manual export and AirDrop are also available. These transfers go to the destination you choose, not to a Life Capture storage service.

Studio can export files or prepare web publications in a folder you choose, including a folder you arrange to synchronize to your own host. Exported files, shared montages, and published pages can contain the content you selected. Your chosen recipients, storage services, or hosting providers control those external copies under their own policies.

What stays on your device#

Unless you choose to transfer, export, publish, or synchronize them, the following remain in your local archive: raw photo, audio, and text captures; capture metadata and import manifests; checksums and archive integrity metadata; Apple Speech transcripts or local placeholders; normalized event data; generated daily drafts; reviewed journals; weekly and monthly lookbacks; and rebuildable local search indexes and app state.

With Cloud narrator on, the journal source text described above is also sent to Apple's Private Cloud Compute for processing. With Cloud photo descriptions separately enabled in Studio 1.4.1, the reduced still-photo copies and per-photo hints described above are also sent. With remote receiving enabled, the setup proof and routing metadata described above go to the management service, while encrypted selected captures pass through Cloudflare to your Mac. The archive and its original media stay local; these options do not create hosted archive storage.

Your control#

Your archive is stored as inspectable folders, JSON, Markdown, and your original files. Because everything is local and in open formats, you can read it, move it, back it up, or delete it whenever you like, without asking anyone — and the open-source Open Life Reader can browse it without Studio at all. Removing a Moment in Studio first moves its recovery copy into Recently Deleted, where it remains until you restore or permanently delete it. Deleting your archive removes that local copy. It does not remove exports, recipients’ copies, backups, or hosted publications; manage those at their destinations. Life Capture operates no storage service retaining a copy for us to delete.

Publishing strips capture metadata. Published images are re-encoded without it, so no coordinates enter the published copy. Published video is transcoded for the web and stripped of location and identifying metadata before it leaves the archive; if you publish a single file, the video is left out and the page says so.

Children#

Life Capture is a general-purpose personal journaling app and is not directed to children. It requires no account and does not knowingly collect information from children.

Changes to this policy#

If the app's privacy posture changes, this policy will be updated here with a new effective date. The intent is to keep Life Capture local-first, explicit about optional network features, and matched to the repository's no-leakage release review.

Contact#

Questions about this policy or about Life Capture: Gregory Stoltz, [email protected].