locallens@community:~$ cat privacy.md
Your photos never leave your computer
LocalLens is a photo organizer with no cloud upload: sorting, face recognition and place names all run on your own machine. Below is each privacy claim, the line of code behind it, and a command you can run to check it yourself, followed by the few connections that do exist.
Does LocalLens upload my photos?
No. LocalLens reads your photos from disk, works on them in memory and writes the sorted copies back to disk, and its backend has no code that talks to any server but itself. The face data it learns and its settings stay in folders on your computer too.
The app is open source under AGPL-3.0, so this is not a promise you have to take on trust: the full source is public, and every claim below points at the line that makes it true.
How can I check these claims myself?
Run the command in the last column against the source or a running copy of the app. Each one takes seconds and needs no special tools. Paths are the macOS ones; on Windows the same files are in %APPDATA%\LocalLens.
| Claim | Where | Check it |
|---|---|---|
| The backend makes no external network callsEvery hit is a call to 127.0.0.1 or the local port picker. | scheduler_daemon.py | grep -rn "requests\|httpx\|urlopen\|socket" backend/*.py |
| Its API listens on this computer onlyBound to 127.0.0.1, never 0.0.0.0. | main.py | lsof -nP -iTCP -sTCP:LISTEN | grep 127.0.0.1 |
| Sensitive endpoints need a local secretA random 64-character token, readable by your user only (0600). | main.py | ls -l ~/.config/LocalLens/local_api_token.txt |
| A web page cannot call the APINo Access-Control-Allow-Origin comes back: only the app’s own window is allowed. | main.py | curl -si -H "Origin: https://example.com" http://127.0.0.1:$(cat ~/.config/LocalLens/port.txt)/ |
| Face recognition runs on your machineface_recognition and dlib, no model server, no API key. | requirements.txt | grep -n "face_recognition\|dlib" backend/requirements.txt |
| Place names are looked up offlineThe place-name dataset ships inside the app. | requirements.txt | grep -n reverse_geocoder backend/requirements.txt |
Does LocalLens connect to the internet at all?
Yes, for two checks of its own, and neither carries anything about your photos. It asks GitHub whether a newer release exists, and from the release after v3.1.0 it also asks this site whether anyone has replied to your posts on the board.
- The update check is the updater fetching a small file from the latest GitHub release.
- The board check (from the release after v3.1.0) runs only while the app is open, every two minutes. It sends a random key your install made for itself and the time of its last check, and gets back new posts and replies. The key is not tied to you or your device: the site stores only a hash of it, and only next to posts you wrote from a browser the app opened. Cloudflare, which hosts the site, sees the request the way it sees any web request. There is no setting to turn this check off yet.
The other cases are ones you start yourself, and each is stated here so nobody has to find it first:
- Links you click, such as this site or the release page, open in your normal browser.
- LL Agent, the optional MCP server, lets Claude or another assistant run LocalLens. The assistant receives text: counts, folder names and the person names you chose. It never receives the image files.
- LL Agent Pro checks its licence key once with the licence provider when you activate it.
This list changes only with a release note.
Does LocalLens collect analytics or telemetry?
No. Neither the app nor its backend sends analytics of any kind, anonymised, aggregated or opt-in. Adoption is measured only from public numbers such as GitHub release downloads, which you can see on the stats page.
What does this website record?
This site counts one visit per address per day, stored as a salted SHA-256 hash rather than the address itself, so the number on /stats means something. It runs no third-party analytics, and posting on the board passes a Cloudflare Turnstile check instead of asking for an account.
Where each one processes faces, what gets uploaded, and what it costs.