KinFrame: People & Memories — Effective Date: July 8, 2026 | Last Updated: July 8, 2026
1. Our Privacy Model in One Sentence
KinFrame performs all face detection and recognition entirely on your device; the Developer does not collect, receive, transmit, store, or have any access to your photos or your biometric data.
2. Scope
This Policy explains how the App handles data. It applies to the App on macOS (and, when released, iOS/iPadOS). It does not cover Apple’s own processing (e.g., the App Store, iCloud if you enable it), which is governed by Apple’s privacy policy.
3. Data the App Processes Locally
To organize your library, the App processes the following on-device only:
- Photos and images you choose to make available to the App (via the system Photos picker or folders you select).
- Detected face regions extracted from those images.
- Biometric feature vectors / embeddings — mathematical representations derived from detected faces, used to group similar faces. These are generated on-device and stored in the App’s local sandbox. They are never transmitted to the Developer or to any third party.
- Local app settings and labels (e.g., names or tags you assign to face groups), stored only on-device.
4. What the Developer Collects: Nothing Personal
The Developer does not collect, receive, or store your photos, face regions, feature vectors, labels, or any personal data. No personal data is ever sent to the Developer. The Developer maintains no server that receives your content and operates no analytics that transmit personal or biometric data.
5. Biometric Data — Purpose, Handling, Retention & Destruction (BIPA-Style Written Policy)
Framed for a local-only application:
- Purpose: Biometric feature vectors are generated for the sole purpose of grouping and organizing faces within your own photo library. They are never used to identify strangers, for surveillance, for advertising, or for any other purpose.
- Storage: Within the App’s local sandbox on your device. Never on any Developer server.
- User control: You may delete individual face groups, feature vectors, and labels within the App at any time.
- Retention schedule: Because the Developer never possesses this data, the Developer has no retention period. On your device, feature vectors persist only as long as you keep them; they are destroyed when you delete them in-app, when you remove the underlying photos from the App’s access, or when you uninstall the App. As a default guideline the App is designed to permanently delete biometric feature vectors when the purpose for which they were created is satisfied or upon your deletion request, and no later than the point of uninstallation. (This mirrors the retention-and-destruction discipline required of data possessors under Illinois BIPA §15(a), which requires destruction when the initial purpose is satisfied or within 3 years of last interaction, and Texas CUBI, which requires destruction within a reasonable time and no later than one year after the collection purpose expires — even though, as a purely on-device app, the Developer is not a possessor.)
- Destruction: Uninstalling the App permanently removes all locally stored feature vectors, labels, and settings from the device sandbox.
6. Minimal Non-Personal / Transactional Data
- In-app purchases: The App offers a one-time-purchase Pro upgrade via Apple’s In-App Purchase system (StoreKit 2). Payment is processed by Apple; the Developer never receives your payment card details. StoreKit 2 validates purchases using cryptographically signed transaction data (JWS) that can be verified on-device, so purchase validation for KinFrame does not require sending your personal data to a Developer server. Apple may provide the Developer with anonymized/aggregated sales and payment reports; these do not identify you.
- Diagnostics: The App records basic performance diagnostics (such as scan speed and memory usage) in a local file inside the App’s own sandbox, solely to help diagnose performance problems. This file never leaves your device unless you choose to send it yourself. The App transmits no analytics or telemetry of any kind to the Developer or to any third party.
Network Use
All recognition works offline. The App uses the network in only two situations: (1) on first launch, to obtain the decryption key for its on-device recognition models from Apple’s servers; (2) when you open the Map feature, to load map tiles from Apple Maps. In neither case are your photos, faces, or biometric vectors sent over the network.
7. No Third-Party Sharing; No Sale; No AI Transmission
The Developer does not share, sell, lease, trade, or otherwise disclose your personal or biometric data, because the Developer never holds it. The App does not transmit your data to any third-party AI service. (This aligns with Apple App Store Review Guideline 5.1.2, which as revised on November 13, 2025 requires that you “clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.”)
8. Children’s Privacy
The App is not directed to children. The Developer does not knowingly collect personal information from children (under 13 in the US under COPPA; the applicable age of digital consent, which ranges from 13 to 16 depending on the Member State, in the EU/EEA under GDPR Article 8). Because no data is collected by the Developer, no personal data of children is transmitted to the Developer. Note that under the FTC’s amended COPPA Rule (published in the Federal Register April 22, 2025; effective June 23, 2025; compliance deadline April 22, 2026), “personal information” now expressly includes “biometric identifiers that can be used for the automated or semi-automated recognition of an individual, such as … facial templates, or faceprints.” If you are a parent and believe a child has used the App, note that all data remains local to the device and can be deleted by uninstalling the App.
9. Your Rights (GDPR / UK GDPR / CCPA-CPRA / Taiwan PDPA) — Satisfied by Design
Because your data stays under your control and the Developer holds none of it, your data-subject/consumer rights are satisfied structurally:
- Access / know: All your data resides visibly within the App on your device.
- Rectification / correction: Rename or re-group faces in-app at any time.
- Erasure / deletion: Delete groups/vectors in-app, or uninstall to erase everything.
- Restriction / objection / opt-out of processing: Stop the App’s access to photos in system Settings, or stop using the feature.
- Portability: Your source photos remain in your own library in their original form.
- Right to limit use of sensitive personal information (CPRA): Under the CPRA, “processing of biometric information for the purpose of uniquely identifying a consumer” is sensitive personal information; this right is inapplicable in the ordinary sense because the Developer performs no use of your sensitive information — all processing is user-directed and local.
- GDPR household exemption: Personal, non-commercial use of the App to organize your own photos generally falls within the GDPR’s “purely personal or household activity” exemption (Art. 2(2)(c), Recital 18); note this exemption can be lost if you publish or widely distribute the results to an indeterminate number of people.
Because the Developer holds no personal data, the Developer’s practical ability to act is generally limited to guidance about on-device controls.
10. Legal Basis (GDPR)
Where the GDPR applies and the household exemption does not, facial templates processed to uniquely identify a person are Article 9 special-category data requiring both an Art. 6 basis and a separate Art. 9 condition. The App’s on-device processing relies on your explicit consent (Art. 9(2)(a)), given through your voluntary choice to enable and use the face-grouping feature; you may withdraw consent at any time by disabling the feature or uninstalling.
11. Security
Your data is protected by Apple’s platform security, including the App sandbox and device-level encryption tied to your passcode/Face ID/Touch ID. The Developer applies a reasonable standard of care to the App’s local data handling. No method of storage is perfectly secure; because data stays on your device, device security (passcode, updates) is essential.
12. International Data Transfers
None. Because the Developer receives no personal or biometric data, the Developer makes no cross-border transfers of your data.
13. Changes to This Policy
The Developer may update this Policy. Material changes will be indicated by updating the “Last Updated” date and, where appropriate, via in-app notice. Continued use after changes constitutes acceptance.
KinFrame：人物和回憶 — 生效日期：2026 年 7 月 8 日｜最後更新：2026 年 7 月 8 日
1. 一句話說明我們的隱私模式
KinFrame 之所有臉部偵測與辨識完全於您的裝置端執行；開發者不會收集、接收、傳輸、儲存或以任何方式存取您的相片或生物特徵資料。
2. 適用範圍
本政策說明本App如何處理資料，適用於 macOS 版本（及日後推出之 iOS/iPadOS 版本）。本政策不涵蓋 Apple 自身之處理（如 App Store、您啟用之 iCloud 等），該等處理受 Apple 隱私政策規範。
3. 本App於本機端處理之資料
為整理您的相片庫，本App僅於裝置端處理下列項目：
- 您選擇提供予本App之相片與影像（透過系統相片選擇器或您所選取之資料夾）。
- 自該等影像擷取之臉部區域。
- 生物特徵向量／嵌入值——由偵測到之臉部衍生之數學表示，用於將相似臉部分組。其於裝置端產生，並儲存於本App之本機沙盒內。該等資料絕不會傳輸予開發者或任何第三方。
- 本機應用設定與標籤（如您為臉部群組指定之姓名或標記），僅儲存於裝置端。
4. 開發者所收集者：無任何個人資料
開發者不會收集、接收或儲存您的相片、臉部區域、特徵向量、標籤或任何個人資料。您的個人資料絕不會傳送予開發者。開發者未維運任何接收您內容之伺服器，亦未運作任何傳輸個人或生物特徵資料之分析工具。
5. 生物特徵資料——目的、處理、保存與銷毀（BIPA 式書面政策）
就純本機端應用而言：
- 目的：生物特徵向量之產生，其唯一目的係於您自己的相片庫內將臉部分組與整理，絕不用於辨識陌生人、監控、廣告或任何其他目的。
- 儲存：存於您裝置上本App之本機沙盒內，絕不存於任何開發者伺服器。
- 使用者控制：您可隨時於本App內刪除個別臉部群組、特徵向量與標籤。
- 保存期程：因開發者從不持有此等資料，開發者並無保存期間。於您裝置上，特徵向量僅於您保留期間存在；當您於App內刪除、移除本App可存取之底層相片或解除安裝本App時即予銷毀。本App設計為於其產生目的達成時或您提出刪除請求時永久刪除生物特徵向量，且不遲於解除安裝之時點。（此對應伊利諾州 BIPA §15(a) 對資料持有者所要求之保存與銷毀紀律——須於初始目的達成時或最後互動起 3 年內銷毀——以及德州 CUBI 所要求之於合理期間內、且不遲於收集目的屆滿後一年內銷毀；惟本App作為純本機端應用，開發者並非持有者。）
- 銷毀：解除安裝本App將自裝置沙盒永久移除所有本機儲存之特徵向量、標籤與設定。
6. 最少量之非個人／交易資料
- 應用程式內購買：本App透過 Apple 應用程式內購買機制（StoreKit 2）提供一次性買斷之 Pro 升級。付款由 Apple 處理；開發者絕不會接收您的付款卡片資訊。StoreKit 2 以可於裝置端驗證之加密簽章交易資料（JWS）驗證購買，故 KinFrame 之購買驗證無須將您的個人資料傳送至開發者伺服器。Apple 可能提供開發者匿名／彙總之銷售與付款報表；該等報表無法識別您的身分。
- 診斷：本App會將基本效能診斷資料（例如掃描速度與記憶體用量）記錄於本App沙盒內之本機檔案，其唯一目的係協助診斷效能問題。除非您自行選擇傳送，該檔案絕不會離開您的裝置。本App不會向開發者或任何第三方傳送任何分析或遙測資料。
網路使用
所有辨識功能均可離線運作。本App僅於下列兩種情形使用網路：(1) 首次啟動時，向 Apple 伺服器取得其裝置端辨識模型之解密金鑰；(2) 當您開啟地圖功能時，向 Apple 地圖載入地圖底圖。於上述兩種情形中，您的照片、臉部與生物特徵向量均不會經由網路傳送。
7. 無第三方分享、無出售、無 AI 傳輸
開發者不會分享、出售、出租、交易或以其他方式揭露您的個人或生物特徵資料，因開發者從不持有該等資料。本App不會將您的資料傳輸予任何第三方 AI 服務。（此與 Apple App Store 審查指南 5.1.2 一致；該指南於 2025 年 11 月 13 日修訂後要求：於將個人資料分享予第三方（含第三方 AI）前，須「清楚揭露個人資料將於何處分享予第三方，並於分享前取得明確許可」。）
8. 兒童隱私
本App非以兒童為對象。開發者不會在知情下收集兒童個人資訊（美國 COPPA 下為未滿 13 歲；歐盟/EEA 於 GDPR 第 8 條下為適用之數位同意年齡，依會員國不同介於 13 至 16 歲）。因開發者不收集任何資料，故無兒童個人資料傳輸予開發者。請注意，依美國 FTC 修正後之 COPPA 規則（2025 年 4 月 22 日刊載於聯邦公報；2025 年 6 月 23 日生效；2026 年 4 月 22 日為遵循期限），「個人資訊」現明確包含「可用於自動或半自動辨識個人之生物特徵識別碼，例如……臉部模板或臉紋」。若您為家長且認為兒童曾使用本App，請注意所有資料均保留於裝置本機，可透過解除安裝本App予以刪除。
9. 您的權利（GDPR／英國 GDPR／CCPA-CPRA／台灣個資法）——藉由設計即已滿足
因您的資料始終在您的掌控之中，且開發者未持有任何資料，您的資料主體／消費者權利於結構上即獲滿足：
- 查閱／知悉：您的所有資料均可見於裝置上本App內。
- 更正：隨時於App內重新命名或重新分組臉部。
- 刪除：於App內刪除群組／向量，或解除安裝以清除全部資料。
- 限制／反對／退出處理：於系統設定停止本App對相片之存取，或停止使用該功能。
- 可攜性：您的來源相片以原始形式保留於您自己的相片庫。
- 限制使用敏感個人資訊之權利（CPRA）：於 CPRA 下，「為唯一識別消費者之目的處理生物特徵資訊」屬敏感個人資訊；惟於一般意義上此權利不適用，因開發者不對您的敏感資訊為任何使用——所有處理均由使用者主導且於本機端進行。
- GDPR 家庭豁免：為整理自己相片而個人、非商業使用本App，一般落入 GDPR「純屬個人或家庭活動」豁免（第 2 條第 2 項第 c 款、前言第 18 點）；惟若您將結果公開或廣泛散布予不特定多數人，此豁免可能喪失。
因開發者未持有任何個人資料，開發者實際上能採取之行動，一般僅限於就裝置端控制方式提供指引。
10. 法律依據（GDPR）
於 GDPR 適用且家庭豁免不適用之情形，為唯一識別個人而處理之臉部模板屬第 9 條特殊類別資料，須同時具備第 6 條之依據及另一項第 9 條之條件。本App之裝置端處理係依據您的明示同意（第 9 條第 2 項第 a 款），透過您自願啟用並使用臉部分組功能之選擇而為之；您可隨時透過停用該功能或解除安裝撤回同意。
11. 安全
您的資料受 Apple 平台安全機制保護，包括 App 沙盒及與您密碼／Face ID／Touch ID 連結之裝置層級加密。開發者就本App之本機資料處理採合理注意標準。無任何儲存方法為絕對安全；因資料留存於您的裝置，裝置安全（密碼、更新）至關重要。
12. 國際資料傳輸
無。因開發者未接收任何個人或生物特徵資料，開發者亦不會對您的資料為任何跨境傳輸。
13. 本政策之變更
開發者可能更新本政策。重大變更將以更新「最後更新日期」表示，並於適當時以App內通知方式告知。變更後繼續使用即構成接受。