Private by construction, not by policy

Does Sfuma upload my photos?

No. Every edit runs on your iPhone, and the photo is never sent to a server for editing. The only upload is a feedback report you choose to send, and the Send screen lists what it contains before anything goes.

What runs where

Proof: every row above is part of iOS or the app’s own code; the app bundles no machine-learning model of its own.

The network log

Settings → Network activity lists every server the app’s own code has connected to, with its purpose and how many times. On a fresh install it reads “No network activity — as promised.” After you send a feedback report it shows sfuma.cam with the purpose “Feedback you sent”. Purchases, ratings and crash reports are handled by iOS and Apple outside the app, so they never appear there. Anything else would be a bug we want to hear about.

Proof: the log is written by the app’s own network layer, not by a setting you turn on.

No account, no login, no cloud

There is nothing to sign up for. Your edits are documents on your phone. Your purchase is tied to your Apple Account (Apple ID) by Apple, so Restore purchase works on a new phone without us knowing who you are.

Feedback: the one upload, and it is yours to make

When you choose Send feedback, the screen lists what will go: the photo you were editing, the edited result, your edit settings, the face-detection numbers, your device model, iOS and app version, language, a random install ID, and your email only if you type it. You can switch the photo off. Nothing is sent until you press Send. Location, the camera serial number and other identifying details are stripped from photos first (camera make, model and capture date stay, to reproduce the problem), and names you gave faces never leave the phone.

A report carries a random install identifier, not an account. You can delete a report from My reports at any time; its files are removed immediately and your text is erased. Otherwise files are deleted 90 days after sending, or 30 days after the linked issue is closed if that comes first. The text and device details are kept until you delete the report.

Proof: the full terms are in the privacy policy.

Ads, if you never unlock

Today’s version shows no ads and contains no ad code. If we add ads, your first 30 days stay ad-free; after that an ad may appear after an export or when you come back to the app, never while you edit. They would be non-personalized: no advertising identifier, no tracking prompt, no banners. The unlock removes them while it is active, or for good with Lifetime.

Proof: the app does not include Apple’s App Tracking Transparency framework, so it cannot show the tracking prompt.

Recipe links

A shared look link carries its data after the “#” in the address. Browsers never send that part to a server, so a recipe page on sfuma.cam decodes the code in your browser and our server only sees that the page was opened.

This website

sfuma.cam is served from our own server with no third-party scripts or fonts. If we measure visits, we use NameVerse’s own self-hosted, cookie-free analytics, and the privacy policy says so. The pages you read set no cookies of their own.