Permission opens the library to the app
On iPhone and iPad, a scanner needs Photos permission to read the items it is asked to classify. On Mac, a workflow may use the Photos library or folders a person explicitly selects. Permission is necessary for the job, but it does not explain where the media goes afterward.
Classification happens on the device
In an on-device workflow, the app supplies local image or video data to a model running on the iPhone, iPad, or Mac. The result is a score or category used to build a review queue. For Sensitivity, the media is not uploaded to Sensitivity servers for classification.
iCloud can still download an item
Photos may keep an optimized copy locally while the original remains in iCloud. When a scan requests an iCloud-only item, Apple Photos may download it to the device. That is an Apple Photos transfer into local storage, not an upload from the scanner to its developer.
Results need their own protection
Local classification can still reveal private information if the result list is exposed. Sensitivity places review behind device authentication and stores scan state locally. Its analytics excludes media contents, thumbnails, filenames, album names, media identifiers, and detection results.
Questions every privacy policy should answer
- Are photos or videos uploaded for classification?
- Is an account required?
- Do analytics events include media identifiers or classifications?
- Where are result lists and scan progress stored?
- Can the app automatically hide, move, or delete media?
- What happens when an item exists only in iCloud?
- What are the known detection limitations?
Local does not mean perfect
Processing location and model accuracy are separate. A local detector can still flag ordinary media and miss private content. Video sampling can miss moments between frames. The correct product role is to reduce a manual review set while keeping every decision with the user.
Local classification, no media uploads, protected results, no automatic deletion, and an explicit human-review requirement can be independently stated and tested.