Privacy Policy

Effective: June 23, 2026

TAG Lens is a macOS app that tags, rates, and helps you review and delete photos in your Apple Photos library. It is built to work entirely on your Mac.

The short version

• 100% offline by default. No account or sign-in for tagging, no analytics, no tracking, no ads. The one exception: the optional one-time unlock purchase (and its restore) goes through the App Store with your Apple Account, like any Mac app purchase — Apple processes it, and TAG Lens never sees your account details.
• Your photos never leave your Mac. TAG Lens never uploads your image files to the internet. The one optional feature that reads a photo’s pixels works only with a model running on your own Mac (see below) — the pixels stay local.
• All metadata you create (keywords, titles, captions) is written into your own Photos library. Ratings are stored locally on your Mac.
• The only network features are off by default and clearly labeled, and each one tells you exactly what it sends before you turn it on.

What TAG Lens stores, and where

• Keywords, titles, captions, favorites, albums, capture dates, locations — written directly into your Apple Photos library on your Mac, using the same fields Photos itself uses. They are yours, in your library, and remain there if you delete TAG Lens. If you use iCloud Photos, Photos syncs these edits to your other devices the same way it syncs any edit made in Photos itself — on iPhone and iPad, search finds your keywords, though iOS has no screen that displays them.
• Star ratings, progress, and app settings — stored in TAG Lens’s sandboxed app container on your Mac. Never transmitted.
• Location data is never stored by the app itself. TAG Lens writes coordinates only into the photo’s own record in your Photos library, and only when you act: when you set or clear a location in the inspector, when you confirm a “place from photo text” suggestion (see below), when you approve photos in the reviewed bulk location-repair flow, or when you undo one of those changes and the prior location is restored. Every case is user-confirmed — never a third party, and never into TAG Lens’s own storage.
• API keys you supply for optional AI providers are stored in the macOS Keychain on this Mac only — never synced, never logged, never sent anywhere except to the provider you chose.

Optional network features (all off by default)

If you choose to enable them in Settings, each feature sends only what is listed here:

• Keyword suggestions (Wikidata / Grokipedia): sends the keyword term you typed (and only the term) to a public reference API — Wikidata, and/or Grokipedia (a keyless wiki lookup) — to find related terms. The term itself could contain personal information if you type it; nothing else is sent.
• AI keyword suggestions (a provider you choose): sends the keyword term — and only the term — to an AI service you select and, for the hosted ones, supply your own API key for: xAI, OpenAI, Anthropic, Mistral, Groq, or DeepSeek. You can instead point it at a model running locally on your Mac (e.g. Ollama on localhost) or a custom endpoint URL you configure. TAG Lens has no key of its own and no server of its own; it never sends your photos to these services — only the typed term. Each hosted provider runs in its own operator’s region (DeepSeek’s endpoint, for example, is in China); the term you send is governed by that provider’s policy, and you choose the destination.
• On-device photo analysis with a local model (loopback only): if — and only if — you configure the AI endpoint as a model running on your own Mac (a localhost/127.0.0.1 address), TAG Lens can send a small copy of the photo to that local model to suggest a caption. A strict check rejects any address that isn’t your own machine, so your photo’s pixels never reach an internet endpoint — they stay on your Mac. Hosted providers (above) never receive pixels, only text.
• Place names: resolves a photo’s existing GPS coordinates to a place name (“Kyoto”) using Apple’s geocoding service. Off by default; when off, coordinates are never sent anywhere and are shown as raw numbers instead.
• Place from photo text: for a photo with no location, reads any place name on a sign in the photo (on your Mac) and sends only that recognized text — e.g. “Pine Ridge, South Dakota” — to Apple’s location search to find a coordinate to suggest. Off by default. Only the recognized place text is sent, only for the photo you’re viewing (never a library-wide sweep), and never the photo itself; text that looks like a street address, phone number, or email is filtered out and never sent. You confirm each suggestion before any location is written.

Disable any of these at any time; TAG Lens returns to fully offline operation.

Exports you create

Two features copy data out of the app only when you invoke them, to a destination you choose — this is your action, not collection by the app:

• Export Metadata as CSV writes a file you pick that by default includes each photo’s precise latitude/longitude. Turn on Strip location when sharing or exporting to blank those columns.
• Share / drag exports a JPEG copy; GPS is stripped when that same setting is on.

What TAG Lens never does

• Never uploads or shares your photos.
• Never collects analytics, telemetry, or crash reports of its own.
• Never sells, shares, or retains any data — it has no servers to retain it on.
• Never modifies your photo pixels. TAG Lens writes only metadata — the labels and descriptions attached to a photo, never the image itself.

Permissions

TAG Lens asks macOS for access to your Photos library (to read and write metadata) and for automation access to the Photos app (to write keywords, titles, and captions). Both are revocable at any time in System Settings ▸ Privacy & Security.

Contact

Questions: email wells01440@gmail.com.

Changes to this policy will be posted at this URL with an updated effective date.