How On-Device Sensitive Photo Scanning Works
On-device scanning analyzes media on your device. Here is what to check about media access, iCloud downloads and saved results before using a scanner.
Follow the media, step by step
- PermissionYou choose which library items the app may access.
- AvailabilityLocal media is ready. iCloud-only items may download through Apple if permitted.
- AnalysisSensitivity classifies media on your device.
- ReviewSaved results are protected with device authentication. Suggestions can be wrong.
- Your decisionKeep an item, hide supported Photos media, or delete what you select.
Usage analytics and crash reporting are separate from media processing. See the privacy policy for their contents and controls.
Permission opens the library to the app
On iPhone and iPad, a scanner needs Photos permission to read the items it is asked to classify. On Mac, a workflow may use the Photos library or folders a person explicitly selects. Permission is necessary for the job, but it does not explain where the media goes afterward.
Classification happens on the device
In an on-device workflow, the app supplies local image or video data to a model running on the iPhone, iPad, or Mac. The result is a score or category used to build a review queue. For Sensitivity, the media is not uploaded to Sensitivity servers for classification.
iCloud can still download an item
Photos may keep an optimized copy locally while the original remains in iCloud. When a scan requests an iCloud-only item, Apple Photos may download it to the device. That is an Apple Photos transfer into local storage, not an upload from the scanner to its developer.
Results need their own protection
Local classification can still reveal private information if the result list is exposed. Sensitivity protects saved results with device authentication and stores scan state locally. Its analytics excludes media contents, thumbnails, filenames, album names, media identifiers, and detection results.
Questions every privacy policy should answer
- Are photos or videos uploaded for classification?
- Is an account required?
- Do analytics events include media identifiers or classifications?
- Where are result lists and scan progress stored?
- Can the app automatically hide, move, or delete media?
- What happens when an item exists only in iCloud?
- What are the known detection limitations?
Local does not mean perfect
Processing location and model accuracy are separate. A local detector can still flag ordinary media and miss private content. Video sampling can miss moments between frames. Use detection to narrow the items you review, then decide what to keep, hide or delete.
Details for Sensitivity
- Privacy policy and stored-data table
- Developer, disclosures, and guide process
- False positives and missed items
Sensitivity classifies likely private photo and video content; it does not look for passwords, recovery codes, or API keys written inside an image. I also build SecretScan for that separate camera-roll audit. Its OCR runs on the device and every possible match remains under human review. Read how to find password screenshots for Apple Photos search steps and optional scanning.
