Numa — Privacy Policy

Everything Numa does to a photograph happens on your device: opening it, editing it, finding masks and faces in it, rating it, exporting it. Numa has no servers of its own and no accounts. Your photographs, your edits, your ratings and your libraries stay wherever you keep them: on your device, on an external drive or a NAS, in a synced folder such as iCloud Drive or OneDrive, or in your Photos library. Numa reaches them through your device’s own files. It sends nothing to anyone, except to a Numa Home server that you set up (see Numa Home).

Photos library (iPhone, iPad and Mac). If you let Numa use your Photos library, it reads the photographs you open and saves your edits back to Photos, as you choose when you tap Done. Nothing from your Photos library is sent anywhere, except to your own Numa Home server if you choose so.

Faces. Numa can find faces in a photograph, for example to retouch them or to see whether someone's eyes are closed. On Linux, if you download the model for it and name people yourself, Numa can also recognise them in your other photographs; Numa for iPhone, iPad and Mac does not recognise who someone is. All of this happens on your device: what Numa knows about faces stays in your library and is never sent anywhere.

Numa Home is a photo server that you run yourself, for example on a NAS. Numa sends photographs to it only after you sign in to it. The developer of Numa does not run it and never sees or receives anything that goes to it.

Numa sends photographs to your server when you do one of these:

• Export to it, or use Send Home.
• Switch on “Send new photographs home” (iPhone).
• Choose Keep at Numa Home for a library or a Photos album.
• Choose Sync to Numa Home for a library.

After Keep or Sync, Numa sends the original files and their edits in the background, once. After that it sends only what changes: new photographs, edits, stars and flags. Sending waits for an unmetered connection unless you allow mobile data. On iPhone and iPad it also stops in Low Power Mode.

Sync on This Device does the reverse. It downloads the originals of a library on your server to this device. Numa first tells you how much space they need and asks. After that, changes go both ways.

The address you type decides where everything goes. It can be a server on your own network. It can also be a server that you can reach from outside, if its owner turned that on. Your name and password go to that server. The sign-in token stays on your device (in the Keychain on iPhone, iPad and Mac). Numa does not keep your password.

On Linux, Numa uses the address as you type it. An address with no https:// at the start uses plain http, so the password and the photographs travel unencrypted on that network. On iPhone, iPad and Mac, plain http works only for a server on your own network or Tailscale (a private address, .local or .ts.net). Numa refuses plain http to any other address, and a name typed without https:// that is not on your own network goes to https. Use https for any server that you reach from outside your home.

What your server does with your photographs is up to you and to your server’s own policy.

Numa keeps its own records beside your photographs, never inside them: a catalogue with your ratings, flags, edits and what it measured in each photograph, in the library it belongs to. Your original files are never written to; a photograph you save back to your Photos library keeps its original there, as Photos always does.

On Linux the catalogue is a hidden .numa folder inside each library, with a weekly backup. Add-ons, presets and settings are kept in ~/.local/share/numa, thumbnails in ~/.cache/numa. Deleting those folders removes everything Numa knows; your photographs are untouched.

Some features need extra files, such as AI models for masks or camera colour profiles. You choose to download these in Add-ons (or say Yes in Set Up Features); no model or profile is downloaded without you asking. Most come from Numa's own release page on GitHub (github.com). A few come from where their makers publish them: Hugging Face (huggingface.co) and Intel's OpenVINO storage (storage.openvinotoolkit.org). On Linux, the optional GPU acceleration comes from the Python Package Index (files.pythonhosted.org).

Each download is an ordinary web request, so that service sees what any website sees, such as your IP address. Numa sends nothing about you or your photographs with it. See GitHub's privacy statement.

Maps. On Linux, when you open Places, Numa downloads map tiles from Protomaps (build.protomaps.com): the world once, about 45 MB, then detail around where your photographs were taken. Protomaps can see which map areas Numa asks for, so it can tell roughly where those places are. Numa sends no photographs and no names. On iPhone, iPad and Mac, the Places map and the small map in a photograph’s info use Apple Maps, under Apple’s own privacy policy.

The Flatpak never looks for updates by itself. The AppImage asks once whether it may look for new versions; if you say yes, it looks at Numa's releases page on GitHub at most once a day and tells you when there is a new one. Nothing about you or your photographs is sent, and Preferences turns it off again.

On iPhone, iPad and Mac: if you have allowed your device to share analytics with app developers (in Settings › Privacy & Security › Analytics & Improvements), Apple may share anonymous crash and performance reports about Numa with me. These are collected and anonymised by Apple, not by Numa. Numa can also show these reports to you in its Diagnostics screen, so you can choose to send them to me yourself; nothing is sent automatically.

On Linux Numa writes a crash report to a file on your computer when it dies. The file holds the Numa version, how Numa runs (Flatpak, AppImage or another way), the GTK version, the graphics renderer and technical addresses that help me read it. The last error message is kept with it, with paths and photograph names replaced. At the next start, Numa says that it closed unexpectedly. “Send Report…” shows you the whole text before anything leaves your computer. You can then open a GitHub issue with it, which is public, or copy it and mail it to me. Numa sends nothing by itself. A normal exit deletes the file.

• No tracking, analytics or advertising.
• No accounts and no cloud storage of its own. The only sign-in is to a Numa Home server that you run.
• No selling or sharing of data, because none is collected.

Numa is suitable for all ages and collects no data from anyone, including children.

The website numa.photo counts visits in a way that stores nothing on your device. The counting itself sets no cookie and writes nothing to local storage or session storage. The only things kept on your device are your own choices and the optional extras, described below. If your browser sends Do Not Track or Global Privacy Control, the page sends nothing at all, and you do not see the small notice at the bottom of the page.

What is counted without asking. When a page opens, it sends the path of the page, for example /beta, with no query string, and the host name of the site you came from, if there is one, for example news.example.com, with nothing after it. When you click a button that opens the beta page, the TestFlight button, a link to the guide, or a download link (GitHub or the openSUSE Build Service), it sends that click, the path of the page and the kind of link. When you leave the page or switch to another tab, it sends how many seconds the page was open. Nothing else is sent: no page title and no scrolling. The counting script keeps its session number in the memory of the page only, so the number is gone when you close the tab or reload. This also means that each page you open counts as a session of its own, and a session lasts as long as that page was open. Pressing Accept changes that, see below.

Optional extras, only after you press Accept. The notice at the bottom of the page asks whether you also want the extras. Until you press Accept, the code for them is not downloaded. After you press Accept, the page adds five things. First, where your visit started: the utm_source, utm_medium and utm_campaign values in the address, if there are any, or else the host name of the site you came from. It is kept in your browser’s session storage for the length of the visit and sent along with the clicks above. Second, how far down a page you scroll, sent once each time you pass 25, 50, 75 and 100 percent of the page. Third, which question you open in a list of questions, sent as the words of that question. Fourth, that the demo section on the home page or an install section on the Linux page came into view, sent once per page. Fifth, one session number for your visit, so that the pages you read in this tab count as one visit and the time spent adds up. It is a random number, kept in your browser’s session storage until you close the tab or stay away for half an hour, and sent with every event, which are then marked as sent with your consent. Nothing else is added: no keystrokes, no mouse movements, no fingerprint. If you press Decline, the extras are not loaded, and anything they kept is removed.

Your choice. Pressing Accept or Decline stores that word in your browser’s local storage. Pressing “Stop counting my visits” below stores a flag that stops all counting. Each one is written only when you click, because a choice has to be kept somewhere, and you can reset each one here at any time.

On the server. Any request carries your IP address, your browser’s user agent and its language. The server reads your country and region from the IP address and your operating system and browser from the user agent. It hashes the IP address and user agent with a salt that changes every day into a visitor number, and the event record has no field for the address itself. For the exact details, see Aptabase’s documentation. Aptabase is an open-source analytics tool that I run myself on my own server, stats.numa.photo. That address is reached through Cloudflare, a US company, so Cloudflare also handles these requests on their way to my server. Vercel, which hosts the site, still sees ordinary requests when a page loads, as any host does. Apart from the counting, the home page remembers, for as long as the tab is open, that you have already seen its opening animation, so it does not play again. This stays in your browser and is gone when you close the tab.

If this policy changes, the new version will be posted on this page with a new date.

Questions about privacy: support@numa.photo