Privacy Policy

Introduction

Pluto Photos ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. It covers both the Pluto Photos desktop application and the Pluto Companion mobile app (Android).

Pluto Photos is a desktop photo organizer. All photo processing, including AI face detection, contextual search, object removal and background removal, happens entirely on your local machine, using AI models stored on your own disk. We never upload your photos to our servers.

The app does make a small number of network connections, for licensing, updates, the one-time AI model download, and the optional Map View. Every one of them is listed under Connections the Desktop App Makes below, including the single case in which information derived from your photos is sent to a third party.

Information We Collect

Desktop App

1. Email Address (Free Trial & Purchase)

When you start a free trial or purchase a license, we collect your email address to deliver your license key and provide customer support. Your email is stored on our license server and is never shared with third parties for marketing purposes.

2. Payment Information

Payments are processed by Stripe. We never see or store your credit card number, CVV, or billing address. Stripe handles all payment data under their own privacy policy.

3. Technical Data

Our license server logs minimal technical data during API requests (IP address, user agent, timestamp) for security and abuse prevention. This data is retained for up to 90 days and then automatically deleted.

4. Website Analytics

We use self-hosted, privacy-friendly analytics on our website. This collects anonymous page view data including the page visited, referrer, device type, and browser. We do not use cookies, fingerprinting, or cross-site tracking. IP addresses are hashed and never stored in raw form. No personal information is collected or shared with third parties.

We also record a small number of conversion events on the website. That a download button, a purchase button or a link to a product page was clicked, and which page it happened on. These carry the same anonymous data as a page view, plus a short-lived session identifier kept in your browser's session storage and discarded when you close the tab. They tell us which articles lead people to try the app. They do not identify you, and they are not shared with anyone.

5. Device Identifier

When you activate a license, the app creates a device identifier: a random value hashed together with basic machine characteristics (hostname, operating system, processor model). It is stored on your own machine and sent to our license server with activation and validation requests, so that a license can be limited to the number of devices it covers. It cannot be reversed back into those characteristics, is not linked to any advertising identifier, and is used for nothing other than license enforcement.

6. License Check-Ins

While you hold a license, the app contacts our license server at most once every 24 hours to report that it is in use. That request contains your license key, the device identifier above, the app version and your operating system: and nothing about your photos, your library or how you use the app. We use it to understand how many licenses are actively in use and to detect license key sharing. A permanent license is otherwise re-validated at most once every 30 days, which is what allows the app to keep working offline indefinitely.

7. Diagnostic Logs

The app writes an error log on your machine to help with troubleshooting, viewable under Settings → Diagnostics. Home directory paths, operating system usernames and email addresses are stripped out before anything is written. This log is never transmitted anywhere, automatically or otherwise. If you want us to see it, you send it to us yourself.

Pluto Companion Mobile App

The Pluto Companion app works on its own as a photo and video browser and editor for the files on your phone: you do not need the Pluto Photos desktop app to browse, search, edit, share or delete them. It is also a companion to the Pluto Photos desktop app: it can back up your phone's photos and videos to your own desktop library over your home Wi-Fi network, or, when your phone is away from that network directly over the internet to your own desktop, always over an encrypted, certificate-pinned connection. Your photos are never sent to Pluto Photos servers. On their own they stay on your phone; when you choose to back up, they go directly from your phone to your own computer.

8. Photo and Video Library Access

With your permission, the app reads your on-device photo and video library to show it to you, to search it by file name, album, date and photo or video type (this search runs entirely on your phone), to let you edit, share and delete items, to determine which files have already been backed up to your desktop, and to transfer selected files to your desktop, whether over your home Wi-Fi network or directly over the internet when you're away from it. Location stored in a photo's own metadata is read on your phone only to show it to you. We never access, store, or transmit your photos to our servers.

Recently deleted. When you delete a photo or video on your phone, the app moves it to Android's own Recently deleted trash, where it stays for 30 days before it is removed for good, and you can restore it until then. On phones that do not have this feature the app keeps a private copy in its own storage for 30 days instead. Neither copy leaves your phone. If a photo is also in your desktop library, the app asks whether to delete it from the phone, the computer or both; a copy on your computer goes to that computer's own Recently Deleted.

9. Camera Access

The app requests camera access solely to scan the QR code displayed by the Pluto Photos desktop app during the initial pairing step. No photos or video are captured or stored.

10. Device Name

During pairing, the app sends a device name ("Pluto Companion") to your desktop so the desktop app can identify which device is connected. This is transmitted only to your own computer, over your local network, or directly over the internet when connecting remotely, and is not sent to our servers.

11. Authentication Token

After pairing, a bearer authentication token is generated by your desktop and stored on your device in encrypted storage (iOS Keychain / Android Keystore). This token authenticates requests between the mobile app and your desktop and is never transmitted to or stored on our servers.

12. Subscription Sign-In (Mobile)

To sign in to a Pluto Companion subscription, you enter the email address on your account. The app sends it to our license server (license.plutophotos.com), which emails that address a one-time code; when you enter the code, the server issues this phone a random device identifier. The email and the device identifier are stored on your phone in encrypted storage. From then on the app, directly, or through your desktop, sends only that device identifier to our license server to check whether your subscription is active, to show your renewal date, and to cancel, resume or delete your subscription when you ask it to. The license server keeps the email, the subscription status and the list of signed-in device identifiers (up to eight), and nothing about your photos.

13. Direct Connection to Your Desktop

The app connects directly to your own desktop running Pluto Photos, over your local Wi-Fi network when you're on the same network, or over the internet to your own desktop when you're not (directly where possible, otherwise through the relay described below). Every connection is encrypted and certificate-pinned to that specific desktop, and no data is ever readable by Pluto Photos' servers or any third party, whether you're at home or connecting remotely. This also covers the app's People and Duplicate Finder screens: both browse and manage data (face groups, duplicate matches) that your desktop has already computed. No new data is collected or sent anywhere beyond that same direct connection.

Remote access (optional, off by default). If you switch it on in the desktop app, your computer asks your router to open one port, and sends your computer's current internet address and port to our license server so your phone can find it again after the address changes. That note is encrypted with a key derived from your phone's pairing key, so we cannot read it and cannot tell whose it is; it is deleted when you switch remote access off, and expires after 45 days if your computer stops refreshing it. Our license server also makes a single connection back to that address to check the port is reachable; it learns only whether the connection worked. As with any request to our license server, it sees the IP address the request came from (see section 3). Your phone fetches the same encrypted note from our license server when it is away from home. Your photos and library are never stored on our servers.

Relay (only if a direct connection is not possible). Some home internet connections cannot be reached directly. In that case, with remote access switched on, your computer keeps one outbound connection open to our relay server (relay.plutophotos.com), and your phone connects through it. The relay only forwards bytes: your phone's encrypted session ends at your computer, not at the relay, and your phone refuses to talk to anything that cannot prove it is your computer, so the relay cannot read or alter your photos, library or login. It keeps nothing on disk and does not log addresses. Like any server you connect to, it can see that a connection was made, when, and how much data moved, from which IP address. Switching remote access off closes the connection.

14. Other Connections the Mobile App Makes

Besides your own desktop, the app contacts exactly these, and none of them receives your photos:

• license.plutophotos.com: ours; the subscription sign-in and checks described in section 12.
• tile.openstreetmap.org: only while the Map screen is open, to draw the map. The OpenStreetMap servers see your IP address and which part of the map you are looking at, which implies the general area your photos were taken in. The photo locations themselves are drawn on your phone and are not sent.
• Google ML Kit: the app's QR-code scanner, used only while you scan a pairing code, is built on Google's ML Kit barcode scanning library, and the editor's portrait blur uses ML Kit's subject segmentation, which finds the person or object in a photo on your phone. The Memories and collages on the Photos tab use ML Kit's face detection, on your phone, to tell whether a photo has people in it and whether they are smiling with their eyes open, so the best photos are chosen; it detects faces but does not recognise or identify anyone, and ML Kit's image labelling, also on your phone with its model built into the app, notes what a photo shows (for example a cake or a pool) so a collage only brings together photos of the same thing. Nothing either finds leaves your phone. The segmentation and face models are downloaded to your phone by Google Play services. Google states that ML Kit sends Google diagnostic and usage information about the scanner, device and app information, a per-installation identifier, performance metrics and error codes, encrypted in transit, not transferred to third parties, and used to maintain and improve ML Kit. It does not send the camera image, your photos or the contents of the code. See Google's ML Kit data disclosure.