Privacy and data flow

​

Where things live

​

What Pool never does

• Upload a photo or screenshot.
• Identify a person from a face. Under .people it groups faces of the same person, unnamed, on the device only.
• Return a capture that looks like an identity document, payment card, credential or health record.
• Sell or share what it learns. Pool is your processor for the service calls above and nothing else.
• Log question text, recognized text, labels, names or photo identifiers.

​

Deletion

• Deleting a photo deletes everything derived from it.
• Taking away photo access, or revoking the last grant, deletes the whole index.
• Deleting your app deletes its container and the index with it.

​

Your part

• Describe your use of photos truthfully in NSPhotoLibraryUsageDescription and in your App Store privacy answers.
• If your app sends context from Pool to your own servers, that transfer is yours to disclose and protect. Apply deletes from the change log there too.
• If you turn on cloud assist, say so in your consent screen and list Pool as a processor in your privacy policy.

For the answers to App Store Connect’s privacy questions, see App Review and privacy labels. The package ships a privacy manifest (PrivacyInfo.xcprivacy). It declares no tracking, and lists the two things the service calls can carry, the random install identifier and text for cloud assist, as not linked to the person.