PRIVATE BY DESIGN

Your photos do not leave the device.

Detection, alignment, rendering, export. Every step runs on your iPhone. There is no Lign server for a photo to land on.

TECHNICAL PROOF

Every Apple Vision request the app runs, named.

Each item below is the verbatim Swift class name as used in the iOS app source. Look any one of them up in Apple's developer docs and the documented behaviour is on-device execution via the Neural Engine.

  1. VNDetectFaceLandmarksRequest

    Face landmark detection. Locates eyes, pupils, eyebrows, nose, mouth, chin, forehead, and the face contour. Runs locally on the Neural Engine; the request returns coordinate observations, not image data.

  2. VNDetectFaceRectanglesRequest

    Face bounding-box detection. Used to anchor each detected face to a region before the landmark pass refines it. Runs in the same on-device Vision pipeline.

  3. VNDetectHumanBodyPoseRequest

    Human body pose detection. Returns joint coordinates for shoulders, hips, knees, ankles, neck, ears, and root. Same on-device pipeline; no image upload.

  4. DetectAnimalBodyPoseRequest

    Animal body pose detection (iOS 18 and later, dogs and cats). Returns joint coordinates for animal eyes, ears, nose, neck. The Swift Vision API runs on the Neural Engine.

  5. RecognizeAnimalsRequest

    Animal recognition. Returns bounding boxes for detected animals so Lign can offer a multi-animal selection step. Identifies that an animal is present; it does not identify which specific animal it is.

  6. GenerateForegroundInstanceMaskRequest

    Foreground instance segmentation, for Object Anchor. Isolates the tapped object as a pixel mask. Requires the Neural Engine and is intentionally disabled in the Simulator.

  7. GenerateImageFeaturePrintRequest

    Image feature print generation. Produces a numerical descriptor of the tapped object so Lign can find the closest match in every other photo. The descriptor is a vector; the photo never leaves the device.

All seven request types are listed in App/EyeMatch/Services/VisionService.swift. Apple's Vision documentation states each one runs locally; none of them open a network connection.

WHAT WE COLLECT

What Lign sees, and what it never sees.

What Lign does not collect.

  • No photo analytics. We do not send RevenueCat which landmarks you use or which photos you import. It also never receives your photos, projects, names, or email address.
  • No cloud processing. There is no Lign server or API, so there is nowhere for a photo to go. The only network traffic is for subscription checks with RevenueCat and the App Store.
  • No AI face model. Lign aligns your real photos using Apple Vision. It does not run a generative model. It does not invent features. The output is your photos, lined up.
  • No Lign server exists. If we wanted to receive a photo, there is nowhere for it to land. The cloud is not a feature; it is the absence of a feature.
  • No full-library access. The Photos picker hands Lign only the specific photos you choose. The rest of your camera roll is invisible to the app.

What we do collect.

  • Subscriptions via RevenueCat. RevenueCat receives a random anonymous ID created when you install Lign, plus your App Store purchase and transaction history. This lets us unlock and restore Pro, validate purchases, and prevent fraud.
  • Subscription-screen activity. RevenueCat records taps on the subscription and subscription management screens, such as when one is shown, closed, or a purchase starts or fails. It also receives your device's vendor identifier, model, iOS and app versions, language, App Store country, and IP address for the connection. We use this in aggregate to understand how those screens perform.

See the full Privacy Policy for the details. RevenueCat processes this subscription data for Lign; it is not used for ads or tracking.

IOS RECENTLY DELETED

iOS keeps deleted photos for forty days. Lign routes around that.

When you delete a photo on iOS, it sits in the system Recently Deleted album for forty days before purge. For clinical use, that retention window is a documented compliance gap. Lign never routes patient photos through your camera roll, so they never end up in that forty-day holding pen.

SCOPE

Lign is not a medical device.

Lign aligns photos for portfolios, consultations, and visual progress. It does not diagnose. It does not measure. It is not certified by the FDA, the MHRA, or any equivalent body. Use it where that scope fits.