Privacy Policy
Effective date: September 2, 2026
This policy applies to Album Pro, a photo and video organizer for iPhone and iPad.
Summary
We do not collect, transmit, store, or sell any of your personal data, photos, or videos. Album Pro has no servers, no accounts, and no analytics. Everything you import stays in Album Pro's private storage on your device.
1. Information We Do Not Collect
Album Pro does not collect your name, email address, phone number, device identifiers, advertising identifiers, location, usage statistics, or crash reports. We operate no backend that could receive them.
We have no technical means of seeing what you import, what your folders are called, or how you use the app.
2. Photo Library Access
Album Pro touches your photo library in three distinct ways, each of which you control.
2.1 Reading the items you pick
Album Pro's core purpose is to copy photos and videos out of your system photo library exactly as they are — the original file, byte for byte, with no re-encoding and no loss of quality.
Doing that requires read access to the photo library (NSPhotoLibraryUsageDescription). An app that only has add-only permission cannot reach the original file at all; it can obtain only a re-compressed derivative, which would defeat the entire purpose of this app.
What we do with that access is deliberately narrow:
- You choose items in Apple's own system photo picker, which runs outside Album Pro as a separate process.
- Album Pro then reads only the specific items you selected, using the identifiers the picker handed back.
- Album Pro never enumerates, scans, indexes, or browses the rest of your library, and never reads anything in the background.
- If you prefer, you can grant access to selected photos only in iOS Settings. Album Pro works normally that way — you will simply be able to import only from the items you have granted.
2.2 Deleting the originals (only when you choose)
After an import finishes, Album Pro offers to delete the originals from your photo library so your camera roll stays clean. This is entirely optional.
If you accept, iOS itself shows its own confirmation dialog before anything is deleted — Album Pro cannot delete photos silently. Deleted items go to Recently Deleted in the Photos app and remain recoverable there for 30 days.
2.3 Exporting back to Photos
When you export an item back to your photo library, Album Pro writes a new copy of it. This uses add-only permission (NSPhotoLibraryAddUsageDescription) and creates new items only; it never modifies or removes anything already in your library.
3. Face ID and the App Passcode
Album Pro offers an optional passcode that locks the app at launch, with Face ID or Touch ID as a convenience (NSFaceIDUsageDescription).
- Biometric matching is performed entirely by iOS in the Secure Enclave. Album Pro never receives your face or fingerprint data — only a yes-or-no result from the system.
- Your passcode is never stored. What we store is a salted hash of it, derived through 120,000 rounds of SHA-256, kept in the iOS Keychain and marked so that it never leaves this device and is readable only while the device is unlocked.
- Because we store only a hash, a forgotten passcode cannot be recovered — not by you and not by us. The app tells you this before you set one.
4. Data Stored on Your Device
Everything Album Pro stores lives on your device and never leaves it:
- Your imported photos and videos — the original files, saved in Album Pro's private app storage (the sandbox), which iOS protects from other apps and encrypts while the device is locked.
- Thumbnails — small previews generated on your device so the grid loads quickly.
- A local database — folder names, and each item's file name, type, size, dimensions and capture date. It is an ordinary database file inside the same private storage.
- Preferences — your language selection, sort order, and the export-date setting.
- Passcode hash — in the Keychain, as described above, only if you turn the passcode on.
- Purchase status — whether the one-time unlock is active.
Deleting an item in Album Pro permanently removes its file from your device. Deleting the Album Pro app removes everything it holds along with it.
5. Device Backups
iOS includes app data in device backups, and Album Pro does not opt out of this. That is deliberate: your imported items are stored only in this app, so excluding them from backups would mean losing them whenever you restore or replace your device.
As a result, your imported photos and videos may be present in your own iPhone or iPad backups (iCloud Backup or an encrypted local backup). Those backups are governed by Apple's privacy policy and your own settings, not by us. We cannot see or access them.
Please also note the flip side: because Album Pro stores everything on this device only, if you delete the originals from Photos, your own backup is the only copy. Keep a backup arrangement you are comfortable with.
6. In-App Purchase
Album Pro offers one non-consumable, one-time purchase that removes the free-tier limits on the number of folders and imported items.
The transaction is handled entirely by Apple through the App Store using StoreKit 2. We never see or receive your payment card details, billing address, or Apple Account credentials. What Album Pro receives on your device is a cryptographically signed confirmation of whether the purchase is active.
Apple's handling of purchase data is described in Apple's own privacy policy.
7. Network Access
Album Pro makes no network requests of its own. It contains no networking code and has no API to call.
The only network activity associated with the app is Apple's own StoreKit communicating with the App Store to fetch the product price and validate a purchase. That traffic goes to Apple, not to us. Every other feature of the app works normally in Airplane Mode.
8. Third-Party Components
Album Pro contains no analytics, no advertising, no crash reporting, and no attribution or tracking SDKs of any kind.
The app is built on Apple's own frameworks, with one exception: it uses GRDB.swift, an open-source library that provides access to the local SQLite database described in section 4. It runs entirely on your device, makes no network requests, and sends nothing anywhere.
9. Children's Privacy
Album Pro does not knowingly collect data from anyone, including children under 13. Because the app collects nothing at all, it presents no data-collection risk to children.
10. Your Rights
We hold no data about you, so there is nothing for us to disclose, correct, export, or delete on your behalf.
Control rests entirely with you: your items are on your device, you can export any of them back to Photos at any time, delete them individually, or remove all of them by uninstalling the app.
11. Changes to This Policy
If this policy changes, we will update this page and revise the effective date above. Material changes will also be noted in the app's release notes.
12. Contact Us
Questions about privacy or data handling: hello@oktool.ai
隐私政策
生效日期：2026 年 9 月 2 日
本政策适用于 iPhone 与 iPad 照片视频整理 App 相册Pro（Album Pro）。
摘要
我们不会收集、传输、存储或出售你的任何个人数据、照片或视频。相册Pro 没有服务器、没有账号、没有统计分析。你导入的一切都留在相册Pro 位于你设备上的私有存储中。
一、我们不会收集的信息
相册Pro 不收集你的姓名、邮箱、电话号码、设备标识符、广告标识符、位置、使用统计或崩溃日志。我们没有任何可以接收这些信息的后端。
我们在技术上无法知道你导入了什么、文件夹叫什么名字，也无法知道你怎么使用这个 App。
二、相册权限
相册Pro 会以三种彼此独立的方式接触你的相册，每一种都由你控制。
2.1 读取你选中的内容
相册Pro 的核心用途，是把照片和视频从系统相册里原样复制出来 —— 复制的是原始文件本身，一个字节都不改，不转码，不掉画质。
要做到这一点，必须申请相册读取权限（NSPhotoLibraryUsageDescription）。只有「仅添加」权限的 App 根本碰不到原始文件，只能拿到重新压缩过的副本 —— 那样这个 App 就失去了存在的意义。
拿到权限后，我们对它的使用范围是刻意收窄的：
- 你在 Apple 自己的系统照片选择器里挑选内容，它作为独立进程运行在相册Pro 之外。
- 相册Pro 随后只读取你明确选中的那些内容，依据的是选择器回传的标识符。
- 相册Pro 从不遍历、扫描、索引或浏览你相册里的其余内容，也从不在后台读取任何东西。
- 你也可以在 iOS 设置里只授权「选中的照片」。相册Pro 在这种模式下同样正常工作，只是你只能从已授权的那部分内容里导入。
2.2 删除原件（仅当你主动选择时）
导入完成后，相册Pro 会询问你要不要删掉系统相册里的原件，让相册保持清爽。这完全是可选的。
如果你同意，iOS 会在真正删除前再弹出它自己的确认框 —— 相册Pro 无法静默删除任何照片。被删除的内容进入「照片」App 的「最近删除」，30 天内随时可以恢复。
2.3 导出回相册
当你把内容导出回系统相册时，相册Pro 会写入一份新的副本。这里使用的是仅添加权限（NSPhotoLibraryAddUsageDescription），只会新增，绝不会修改或删除你相册中已有的任何内容。
三、面容 ID 与启动密码
相册Pro 提供可选的启动密码，用于在打开 App 时锁定，并可配合面容 ID 或触控 ID 快速解锁（NSFaceIDUsageDescription）。
- 生物特征比对完全由 iOS 在安全隔区（Secure Enclave）内完成。相册Pro 从不接触你的面部或指纹数据，只从系统拿到「通过 / 不通过」这一个结果。
- 你的密码从不被存储。我们存的是它加盐后、经过 120,000 轮 SHA-256 派生出的哈希值，保存在 iOS 钥匙串中，并标记为永不离开本机、且仅在设备解锁时可读。
- 正因为只存哈希，密码一旦忘记就无法找回 —— 你不行，我们也不行。设置密码前 App 会明确告知这一点。
四、设备本地存储
相册Pro 存储的所有内容都在你的设备上，从不离开：
- 你导入的照片和视频 —— 即原始文件本身，保存在相册Pro 的私有 App 存储（沙盒）中，iOS 会保护它不被其他 App 读取，并在设备锁定时加密。
- 缩略图 —— 在你的设备上生成的小尺寸预览图，用于让网格快速加载。
- 本地数据库 —— 文件夹名称，以及每一项内容的文件名、类型、大小、尺寸和拍摄时间。它就是同一个私有存储区里的一个普通数据库文件。
- 偏好设置 —— 你选择的语言、排序方式和导出日期设置。
- 密码哈希 —— 如上所述保存在钥匙串中，仅当你开启了启动密码时才存在。
- 购买状态 —— 一次性解锁是否已生效。
在相册Pro 中删除一项内容，会永久删除设备上对应的文件。卸载相册Pro，它保存的一切随之一并删除。
五、设备备份
iOS 会将 App 数据纳入设备备份，相册Pro 没有把自己排除在外。这是刻意的：你导入的内容只存在于这个 App 里，如果排除出备份，就意味着每次恢复或更换设备时它们都会丢失。
因此，你导入的照片和视频可能出现在你自己的 iPhone 或 iPad 备份中（iCloud 备份或加密的本地备份）。这些备份受 Apple 的隐私政策和你自己的设置管辖，与我们无关，我们既看不到也无法访问。
也请注意反过来的一面：由于相册Pro 只把内容存在这台设备上，如果你删除了系统相册里的原件，你自己的备份就是唯一的副本。请自行保留一份你放心的备份方案。
六、内购
相册Pro 提供一项非消耗型、一次性的购买，用于解除免费版对文件夹数量和导入数量的限制。
交易全程由 Apple 通过 App Store 使用 StoreKit 2 处理。我们从不接触也从不接收你的银行卡信息、账单地址或 Apple 账户凭据。相册Pro 在你设备上收到的，只是一份「该购买是否有效」的加密签名结果。
Apple 如何处理购买数据，请参阅 Apple 自己的隐私政策。
七、网络访问
相册Pro 自身不发起任何网络请求。它不含任何联网代码，也没有可调用的接口。
与本 App 相关的唯一网络活动，是 Apple 自己的 StoreKit 与 App Store 通信以获取商品价格和校验购买。该流量发往 Apple，不发往我们。App 的其余全部功能在飞行模式下均可正常使用。
八、第三方组件
相册Pro 不包含任何统计分析、广告、崩溃收集、归因或追踪 SDK。
本 App 基于 Apple 自有框架构建，只有一个例外：它使用了开源库 GRDB.swift，用于访问第四节所述的本地 SQLite 数据库。该库完全运行在你的设备上，不发起任何网络请求，也不向任何地方发送任何内容。
九、儿童隐私
相册Pro 不会在知情或不知情的情况下收集任何人（包括 13 岁以下儿童）的数据。由于本 App 完全不收集数据，对儿童不存在数据收集方面的风险。
十、你的权利
我们没有持有你的任何数据，因此不存在需要我们代为披露、更正、导出或删除的内容。
控制权完全在你手中：内容在你的设备上，你可以随时把任意一项导出回系统相册、逐个删除，也可以通过卸载 App 一次性清除全部。
十一、政策变更
若本政策发生变更，我们会更新本页面并修改上方的生效日期。重大变更也会在 App 的版本更新说明中标注。
十二、联系我们
隐私或数据处理相关问题，请联系：hello@oktool.ai