Effective October 19, 2026

Privacy policy

MyPhotosAnywhere (MPA) is a gallery that uses your devices and connected Google Drive storage. There is no mandatory MPA-hosted backend. The companion MPA Processor described here is under development; release notes identify which features are available in each version.

Information MPA accesses

With your authorization, MPA accesses connected Google account and Drive file identifiers, folder structure, names, sizes, revisions, checksums, thumbnails, photo and video content, and associated metadata. Photo information may include capture dates, location, camera details, captions, people names and album memberships. Device photos require Android media access; Takeout archives or folders are accessed when you select them.

Supported versions can also import photos and videos you explicitly select using Google Photos Picker. That permission covers selected media and does not grant access to your entire Google Photos library.

Google permissions and purpose

MPA uses drive.file for app-authorized files and can request the restricted drive scope for existing folders, recursive discovery and user-requested file operations. The broader scope technically permits reading, creating, editing and deleting files throughout the authorized Drive. It is not a Google-enforced folder-only permission. MPA limits its library operations to sources and destinations you configure and its managed metadata workspace.

These permissions support discovery, viewing and verified downloads, explicit backup/import, metadata and preview synchronization, and user-approved organization or Drive Trash/restore actions. Background analysis does not authorize changing original media bytes or embedded metadata. Camera discovery does not automatically enable backup.

The optional Google Photos Picker permission is photospicker.mediaitems.readonly; MPA uses it to read the media you select for import.

Processing and derived information

Depending on the installed version, optional analysis runs on your Android device or, in the planned 0.6 architecture, your paired computer. Analysis can generate previews, face regions and identity suggestions, object/category labels, recognized text and technical media information. Recognition features require their corresponding consent. Face names imported from Takeout and your manual corrections can form part of library metadata.

Face embeddings used for matching remain on the device performing recognition; they are not part of the synchronized phone catalog in the planned Processor release. Permitted identity annotations, regions and previews can be stored in your Drive workspace to support the gallery. Analysis does not train a general-purpose model on your photos. Feature availability and processing coverage are shown by the installed application.

Where information is stored and transferred

The Android application stores indexes, settings, local media references, previews, downloaded originals, annotations and pending work in local app storage. The Processor stores jobs, analysis results, caches, device trust and settings on your computer. Google authorization is kept locally using the platform's protected credential facilities; MPA does not store your Google password or send OAuth tokens to a paired phone or to GreenFuze.

Authorized clients communicate directly with Google over HTTPS. Originals you back up and synchronized metadata, annotations, previews and processing results are stored in the Google Drive destination or workspace you configure. A paired local-network connection exchanges setup, control and status information between your phone and computer. Access to a shared Drive workspace can expose its contents to other people who already have access to that workspace; review its sharing before placing private data there.

If you enable online map tiles in Places, the OpenStreetMap tile service receives requests identifying the map area you view, along with ordinary network-request information. Photo locations can be browsed without enabling online tiles. If you choose to open coordinates in another map application, those coordinates are passed to that application. See the OpenStreetMap Foundation privacy policy and the selected map application's policy.

MPA does not sell Google user data, use it for advertising, or send your library to a GreenFuze-operated server. Google and your operating system handle their own services under their policies. Diagnostic reports are shared with the developer only when you choose to provide them; review them for private information first.

Google API Limited Use

MPA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the user-facing photo-library features described here, not for sale, advertising, credit decisions, surveillance or training generalized artificial-intelligence models.

Retention, disconnecting and deletion

You control your source photos and Drive library. Disconnecting an account or uninstalling MPA does not automatically delete Drive originals, metadata or a previous workspace. Local app data can be removed by Android uninstall; local-only files and unsynchronized work must be protected before uninstalling. Processor uninstall preserves the Drive library and follows its displayed local-data removal choices.

Use MPA's explicit cleanup or source actions to remove supported local downloads or trash selected Drive originals. These are different operations. Generated caches can be rebuilt; human annotations and pending uploads are not disposable cache. You may independently remove retained workspace files through Google Drive after preserving anything you need.

You can revoke Google authorization at any time through Google Account connections. Revocation stops future authorized access but does not remotely erase copies already stored on your devices or Drive. Device media permissions can be changed in Android settings.

Website and support

This static website is hosted by GitHub Pages and has no added analytics, advertising scripts or account forms. GitHub may process ordinary web-request information under its privacy statement. External links use the linked service's policies.

For privacy questions, use the developer contact on MPA's Google consent screen. General issues can be reported in the public support tracker; do not include private media or credentials there. Material data-use changes will be described in this policy and relevant release notices.