Safelight
Safelight collects nothing. There is no account, no server, and no analytics — and the app cannot connect to the internet at all.
Safelight does not request the INTERNET permission. You can verify this yourself: open Android Settings → Apps → Safelight → App info, or inspect the app package. Without that permission, Android blocks every network connection the app could attempt. Your photos, your search index and your vault key have nowhere to go, so they stay on your phone.
Safelight is an Android photo gallery with an encrypted vault and an on-device semantic search. This policy explains what happens to your information when you use it. It covers the app itself — not Google Play, not the other apps you may share photos into, and not any modified build of Safelight distributed by someone else.
For anything in this policy, write to noddlesxie@gmail.com.
None. We do not collect, receive, transmit, sell, share or store any personal data. Specifically, Safelight does not collect:
There is no analytics SDK, no advertising SDK, no attribution SDK and no crash-reporting SDK in the app. Our Google Play Data safety declaration states “No data collected” and “No data shared”, and that declaration matches the code.
Safelight works with a fair amount of information — it simply never leaves your phone. All of the following is stored in Android's private storage for the app, readable only by Safelight:
| What | Where it lives and why |
|---|---|
| Your photos and videos | Wherever Android already keeps them. Safelight reads them to display them; it does not copy them anywhere except when you move a photo into the vault or ask for an export. |
| Search index | A mathematical representation (embedding) of each indexed photo, computed on your phone by an AI model bundled inside the app. It is stored in a local database and used only to match your search text against your own photos. |
| Vault contents | Photos you move into the vault are encrypted with AES-256-GCM envelope encryption and stored inside the app's private directory. They disappear from your gallery and from every other app on the device. |
| Vault keys | The key that encrypts your vault is itself wrapped separately by your PIN, by your biometric unlock and by your recovery code, and each of those wrappings is protected by a key held in the Android Keystore that cannot be extracted from the phone. Keys never leave the device and are excluded from every backup channel. |
| Recovery code | Generated when you create the vault and shown to you then; you can view it again later after a biometric check. The code itself is never stored anywhere — only a copy of the vault key wrapped with it. We never see it and cannot reset it for you. |
| Index for vault items | Encrypted with the vault's own key and readable only while the vault is unlocked. |
| App settings | Your preferences: theme, sort order, folder visibility, indexing schedule, auto-lock timeout. |
The AI search model ships inside the app rather than living on a server. That is the entire reason nothing needs to be uploaded: the intelligence comes to your photos instead of your photos travelling to a data centre.
Android permissions grant access on the device. In Safelight's case none of them results in data being transmitted anywhere, because the app has no network access.
| Permission | Purpose |
|---|---|
READ_MEDIA_IMAGESREAD_MEDIA_VIDEO | To show your gallery and to index photos for search. This is the core function of the app. |
ACCESS_MEDIA_LOCATION | To read the GPS coordinates already embedded in a photo, so the info panel can show you what a file carries and so the share sanitizer can strip it. The coordinates are only read on your device. |
MANAGE_MEDIA | Optional. Lets file moves, deletions and vault operations complete without a system confirmation dialog for every single file. |
POST_NOTIFICATIONS | To show the progress notification while photos are being indexed. You can decline it; the app still works. |
FOREGROUND_SERVICE_DATA_SYNCWAKE_LOCK | Search indexing is a long batch job that runs on your phone. Android requires a foreground service for it, and requires the app to declare a service type. |
RECEIVE_BOOT_COMPLETED | To refresh the list of media folders on your device after a reboot, so the gallery is up to date the first time you open it. This is a local scan of storage you have already granted access to. |
USE_FINGERPRINT | To offer biometric unlock for the vault. Biometric matching is performed entirely by Android; the app is only told pass or fail, and never receives your fingerprint or face data. |
INTERNET | Not requested. The app cannot open a network connection. |
Safelight contains no advertising networks, no trackers and no analytics services. Two things nevertheless involve Google, and you should know about both.
Occasionally the app may ask the Google Play Store app already installed on your phone to display Google's official rating card. If you choose to rate the app, your rating and any review text go to Google Play — not to us — and are handled under Google's Privacy Policy. Safelight only requests that the card be shown; it does not see your rating, and it is not told whether you submitted one. You can dismiss the card, and Google limits how often it can appear.
Because the app is distributed on Google Play, Google collects information about installs independently of the app, and gives us aggregated statistics — install and uninstall counts, country, device model, Android version, ratings — in the Play Console. Android may also send us stability reports (“Android vitals”) if your device is configured to share usage and diagnostic data with Google. None of this comes from code we wrote, none of it identifies you to us, and you control the diagnostic part in Settings → Google → Usage & diagnostics on your device. This data is governed by Google's Privacy Policy.
The vault is excluded from every backup and transfer channel — Android cloud backup and device-to-device transfer alike. Even though the backed-up bytes would be ciphertext, “photos never leave this phone” does not allow for an exception, and the Keystore key the vault depends on cannot be migrated anyway: on a new device that backup would be an unopenable pile of bytes.
Non-vault app settings may be included in Android's standard app backup to your own Google account, if you have that feature enabled. That backup belongs to you and is governed by Google's terms; we have no access to it. You can turn it off in Settings → Google → Backup.
To move your vault to a new phone, use Export everything in the app's settings. You choose the destination, and the export happens under your control.
Sharing a photo through Safelight hands a file to whichever app you pick from Android's share sheet. If you use the sanitize option, Safelight first writes a cleaned copy with GPS coordinates, capture time, camera model, serial number and editing history removed, and leaves your original file untouched. What the receiving app does with the file afterwards is outside our control and governed by that app's own privacy policy.
Safelight is a general-purpose gallery and is not directed at children. Since the app collects no data at all, it does not knowingly or unknowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction).
Privacy laws including the GDPR (EU/UK), the CCPA/CPRA (California) and similar frameworks elsewhere give you rights over personal data a company holds about you: access, correction, deletion, portability, objection, and the right not to have your data sold.
We hold no personal data about you, so there is nothing for us to disclose, correct, export or delete on your behalf. We have never sold or shared personal data, and there is no mechanism in the app by which we could. No data is transferred internationally, because no data is transferred at all.
Your data is under your own control on your device:
If you want to exercise a right anyway, or want written confirmation of the above for your records, email noddlesxie@gmail.com and we will respond within 30 days.
Vault contents are protected with AES-256-GCM envelope encryption, with the key derived from your PIN and held in the Android Keystore. The vault locks itself after a timeout, and its screens are blocked from screenshots and from the recents preview.
This design has a consequence we would rather state plainly than bury: there is no recovery path that runs through us. If you forget your PIN and lose your 16-character recovery code, nobody — including us — can decrypt your vault. That is the same property that makes the vault private in the first place.
No security measure is perfect, and physical access to an unlocked device remains outside the app's control. Keep a device lock screen enabled.
If this policy changes, the effective date at the top of the page changes with it, and the updated version is published at this same address. A change that would meaningfully affect your privacy — should the app ever gain network access for a feature, for instance — would be announced in the app's release notes as well, not quietly amended here.
Questions, privacy requests, or a report of something in the app that does not match what this page says: