a17lab
Effective 26 September 2026 · Last updated 26 September 2026
This policy explains what Restore Old Photos (the “app”, shown on your Home Screen or in your Applications folder as Photo Restoration) does with your data, on iPhone and on Mac. The two versions share one App Store listing but do not work the same way: where they differ, this page says which one it means. It describes the apps as they actually behave, not as a generic template.
The short version. There is no account and no login in either version.
On the Mac, every feature — restore, clean up, colorize and upscale — runs on your Mac. Your photos are never uploaded to us or to anyone else.
On iPhone, Colorize and Upscale run on your iPhone and never upload anything. Restore sends the photo you are restoring to our server, where it is repaired and cleaned up and then deleted as soon as the result is sent back — we never keep it, look at it, share it or use it to train anything. The app asks your permission before the first photo is ever uploaded.
All restoration work — cleaning up noise and damage, sharpening and enlarging, and colorizing black and white photos — runs locally using Apple’s Core ML framework and your Mac’s own CPU, GPU and Neural Engine. No image you open, restore or export is ever transmitted off your Mac, to us or to any third party.
The Mac app reads and writes only the files you pick yourself in the macOS Open and Save dialogs, or drop onto its window. It runs inside the macOS App Sandbox and has no access to your Photos library or to the rest of your disk.
Colorizing a black-and-white photo and enlarging it run locally on your iPhone using Core ML. No image you colorize or upscale is transmitted anywhere.
You choose photos with the system photo picker, which gives the app only the photos you select — it has no access to the rest of your library. To save a result, the app asks for permission to add photos to your library; it cannot read, change or delete anything already there.
Repairing cracks and scratches and cleaning up noise needs more memory and computing power than a phone can spare for a full-size scan, so on iPhone the Restore feature runs on our servers. When you tap Restore — and only then — the app:
photoapi.a17lab.com (a virtual server we rent from UpCloud, located in the United States);The photo is held only in memory, only for the seconds it takes to process. It is not written to a database, not stored in any cloud, not copied into logs, not reviewed by a person and not used to train any model. When the request finishes, our server and the processing provider discard it.
The first time you tap Restore, the app shows a notice explaining this and asks you to continue. If you choose “Not Now”, nothing is uploaded; you can still use Colorize and Upscale.
| Field | What it contains |
|---|---|
image | The photo being restored, as a JPEG. Deleted right after processing, as described above. |
device_id | A random identifier the app generates on first launch. It is not your Apple Account, device serial number, device name or an advertising identifier, and it is not linked to your identity. |
transaction | Your subscription’s proof of purchase, as signed by Apple (a StoreKit transaction). It contains the subscription’s transaction identifiers, product, purchase and expiry dates and the App Store environment — not your name, email address, Apple Account or payment details. Our server checks Apple’s signature and uses it to charge Restore credits (see below). |
client_version | The app version, e.g. 1.0.0. |
op | Which server operation ran: restore. |
Like any web server, ours also sees the IP address your request comes from. The app also sends the same device_id and transaction, without any photo, when it refreshes the credit balance it shows you.
Request log. To enforce the daily limit of 30 restores per device, to stop abuse and to fix problems, our server keeps a small log entry for each Restore: the random device_id, the app version, the operation, the image’s width, height and file size, how long processing took, whether it succeeded (and a technical error message if not), the credits charged and the subscription’s original transaction identifier, the IP address and the time. The log never contains the photo or any part of it. Log entries are deleted automatically after 90 days.
Credit balance. Each subscription includes a monthly allowance of Restore credits. For each subscription our server keeps one record: its original transaction identifier, product, App Store environment, the current credit period and allowance, the credits used, the last device_id that used it and when it was last updated. This is what lets your credits follow your subscription across devices; it contains no photo and nothing that identifies you by name.
The AI models for the features that run on your device are not bundled inside the app. The first time you use one, the app downloads it from a public GitHub release (github.com/nguyen-tam/aiimageupscale); on iPhone it tells you the size and asks first. Colorize is roughly 400 MB; the upscale (and, on the Mac, clean-up) models are about 30 MB each. The download carries no photo, no personal data and no identifier we assign. GitHub, as the host, may log the request under its own privacy statement. Downloaded models are stored on your device and reused offline.
After a feature finishes successfully, the app sends a single small event to our server at a17lab.com so we can see how often each feature is used. It is sent in the background, contains no photo and no personal information, and is discarded silently if it fails. The complete contents are:
| Field | What it contains |
|---|---|
device_id | The random identifier described above. |
event | Which action ran, for example restore, colorize, upscale or (Mac) denoise. |
client_version | The app version. |
platform | The fixed text ios or mac. |
daily_count | How many actions this install has completed in total. |
timestamp | The date and time of the event, in UTC. |
It is used only to understand aggregate usage, is not used for advertising, is not sold and is not shared. Neither app contains a third-party analytics or advertising SDK, and neither tracks you across other apps or websites.
If you submit the feedback form (iPhone: Settings › Send feedback; Mac: Help ▸ Send Feedback), we receive the email address, message and suggestions you typed, plus the fixed text ios or mac. We use them only to read your feedback and reply. The app never sends this form on its own.
Subscriptions and purchases are handled by Apple through the App Store. We never see or receive your name, email address, payment card or billing details. The app asks StoreKit whether your Apple Account holds a valid subscription (or a Mac lifetime purchase) and stores the yes/no answer on your device. On iPhone, the Apple-signed proof of that subscription is also sent with Restore, as described in section 3. Apple’s handling of your purchase is governed by the Apple Privacy Policy.
All of it is removed when you delete the app.
Photos sent to Restore: deleted as soon as the result is returned. Restore request logs: deleted after 90 days. Credit records: kept while the subscription is in use and for as long as needed to handle billing questions, and deleted on request. Usage events are kept in aggregate for as long as they are useful for product analysis. Feedback messages are kept for as long as needed to handle your request and keep a record of support history. Everything else lives only on your device, under your control.
Depending on where you live — for example under the GDPR in the EEA and the UK, or the CCPA in California — you may have the right to access, correct, delete or obtain a copy of personal data we hold about you, and to object to certain processing. We do not sell or share personal information, and we do not use your data for targeted advertising. Write to us at the address below and we will act on your request; if you include the device identifier or the approximate time of a restore, we can find and delete its records sooner than the limits above.
Our servers and processing provider are in the United States. If you use Restore on iPhone from outside the United States, your photo crosses borders for the few seconds it takes to restore it, under the safeguards described above.
The app is not directed at children under 13, and we do not knowingly collect personal information from them.
If this policy changes, the updated version will be posted on this page with a new “Last updated” date. Material changes will be reflected in the app’s release notes.
Questions about this policy, or a request about your data: [email protected]. You can also use the feedback form inside the app.