On iPhone and iPad, a scanner needs Photos permission to read the items it is asked to classify. On Mac, a workflow may use the Photos library or folders a person explicitly selects. Permission is necessary for the job, but it does not explain where the media goes afterward.

Classification happens on the device

In an on-device workflow, the app supplies local image or video data to a model running on the iPhone, iPad, or Mac. The result is a score or category used to build a review queue. For Sensitivity, the media is not uploaded to Sensitivity servers for classification.

iCloud can still download an item

Photos may keep an optimized copy locally while the original remains in iCloud. When a scan requests an iCloud-only item, Apple Photos may download it to the device. That is an Apple Photos transfer into local storage, not an upload from the scanner to its developer.

Results need their own protection

Local classification can still reveal private information if the result list is exposed. Sensitivity places review behind device authentication and stores scan state locally. Its analytics excludes media contents, thumbnails, filenames, album names, media identifiers, and detection results.

Questions every privacy policy should answer

• Are photos or videos uploaded for classification?
• Is an account required?
• Do analytics events include media identifiers or classifications?
• Where are result lists and scan progress stored?
• Can the app automatically hide, move, or delete media?
• What happens when an item exists only in iCloud?
• What are the known detection limitations?

Local does not mean perfect

Processing location and model accuracy are separate. A local detector can still flag ordinary media and miss private content. Video sampling can miss moments between frames. The correct product role is to reduce a manual review set while keeping every decision with the user.

Details for Sensitivity

• Privacy policy and stored-data table
• Developer, disclosures, and guide process
• False positives and missed items

A false positive is an ordinary or acceptable image classified as likely sensitive. Beaches, sports, skin-colored backgrounds, artwork, medical photos, cropped bodies, and screenshots can resemble patterns that a nudity detector associates with sensitive content.

False negatives matter too

A false negative is private content the detector does not suggest. Low light, unusual framing, heavy cropping, clothing, small subjects, illustrations, and video moments between sampled frames can all make detection harder. That is why a scanner cannot certify that a library is clean.

Thresholds trade one error for another

A broad threshold can surface more possible matches but also more ordinary images. A strict threshold can create a shorter list while missing ambiguous content. There is no universal setting that reflects every person’s definition of private.

A safe review policy

1. Treat the result list as a queue, not a conclusion.
2. Open the full-resolution photo or enough of the video timeline to understand it.
3. Check neighboring items from the same moment.
4. Keep deletion selections small enough to verify.
5. Review Recently Deleted after any cleanup.
6. Use a manual pass for dates or contexts where missing an item would matter.

Privacy and accuracy are different questions

On-device processing answers where classification happens. It does not make a detector perfect. A trustworthy product should explain both its media boundary and its accuracy boundary: where the data goes, whether an account is required, whether results leave the device, and whether the user reviews every action.

How Sensitivity uses results

Sensitivity analyzes media on the device and displays likely matches behind device authentication. It does not upload media for classification and does not delete anything automatically. The user decides whether to keep, hide, or delete each item.

Further details

• Sensitivity privacy policy
• Product boundaries and editorial process
• How on-device scanning works