> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pool.day/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and data flow

> What stays on the device, what reaches Pool, and what you are responsible for.

## Where things live

| Data | Where it is | Who can read it |
| - | - | - |
| Photos and screenshots | The person's photo library | Your app, under the iOS photo permission. Pool's service never. |
| The index: recognized text, labels, fingerprints, vectors, things, evidence | Your app's container on the device | Your app, through grants. Pool's service never. |
| Grants | Your app's container on the device | Your app. |
| Install registration: random install ID, bundle ID, platform, SDK version | Pool's service | Pool, to check your key and count connected users. |
| Model list request: random install ID, bundle ID | Pool's service | Pool, to check your key before it lists the engine's models. The files then download to the device. |
| Cloud assist text, only if turned on | In transit to Pool's service, then discarded | Pool's model provider, for the length of the request. |
| Run reports, only if `sendsRunReports` is on: counts, timings, how a run ended, device model, iOS and SDK version | Pool's service, 90 days | You, in the dashboard. Pool, to support you. |
| App Attest key and assertions, when your app turns App Attest on | Pool's service | Pool, to check requests come from your app on a genuine device. |
| Coordinates, only under `.locations` | Apple's geocoder and Maps, to name places | Apple. Pool's service never. |
| Faces, only under `.people` | Your app's container on the device | Your app, through grants. Pool's service never. |

## What Pool never does

* Upload a photo or screenshot.
* Identify a person from a face. Under `.people` it groups faces of the same person, unnamed, on the device only.
* Return a capture that looks like an identity document, payment card, credential or health record.
* Sell or share what it learns. Pool is your processor for the service calls above and nothing else.
* Log question text, recognized text, labels, names or photo identifiers.

## Deletion

* Deleting a photo deletes everything derived from it.
* Taking away photo access, or revoking the last grant, deletes the whole index.
* Deleting your app deletes its container and the index with it.

## Your part

* Describe your use of photos truthfully in `NSPhotoLibraryUsageDescription` and in your App Store privacy answers.
* If your app sends context from Pool to your own servers, that transfer is yours to disclose and protect. Apply deletes from the change log there too.
* If you turn on cloud assist, say so in your consent screen and list Pool as a processor in your privacy policy.

For the answers to App Store Connect's privacy questions, see [App Review and privacy labels](https://docs.pool.day/app-review.md).

The package ships a privacy manifest (`PrivacyInfo.xcprivacy`). It declares no tracking, and lists the two things the service calls can carry, the random install identifier and text for cloud assist, as not linked to the person.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.