Your library
Privacy policy.
Countenance keeps a record of your face over time. Here is how the current beta handles that record.
Photos and face analysis
With camera permission, Countenance takes still photos using the front or back camera. With Photos access, it can scan the accessible Selfies album or library, or import photos you select. It reads image data and available metadata, including dates, location, camera and lens information. It does not record microphone audio.
Apple Vision and a bundled Core ML face-matching model analyze photos on your device. Countenance uses face landmarks, body alignment information, and numerical face representations (“faceprints”) to line up frames and find the person you choose. It can learn faceprints from existing aligned frames, and you can provide example photos to help it recognize that person. Matching can be wrong; review imports before keeping them.
The app stores people and project names, photos, thumbnails, dates, camera details, alignment information, and available location data in its library. Saved faceprints and landmark summaries are also stored there and can sync with iCloud. These features do not send photos to a remote AI service or train a remote model.
Import progress, candidate previews, and review decisions are kept in a separate device-local store so imports can resume. Aligned images and place names are also cached locally. Local app data may be included in backups managed by your device settings.
Your private iCloud library
Countenance is configured to sync its library using Apple CloudKit and the iCloud account on your device. This includes people, projects, photos, thumbnails, location and camera metadata, saved faceprints, landmarks, and project reminder settings, including any chosen arrival place. Sync uses your private database, not a public photo feed or a Countenance-operated server.
Sign in with Apple inside Countenance is not required for this sync. The app has no separate in-app switch for iCloud sync; availability depends on your device’s iCloud settings, storage, connection, and the app’s sync status. Check Settings in Countenance before relying on a copy being synced. Apple operates iCloud under its own privacy terms.
Private iCloud storage is different from keeping everything only on the phone. This policy does not promise that every field is end-to-end encrypted or that backups and synced deletions complete immediately.
Location and maps
If you allow location access, Countenance requests location and heading while the camera is open and attaches available coordinates to new frames. Location is also used while choosing a reminder place. Imported photos can already contain GPS coordinates, which the app retains even if you decline permission for new location readings.
Countenance uses Apple’s geocoding service to turn coordinates into place names, and Apple MapKit to display located frames and choose reminder places. Coordinates may be sent to Apple to provide these services. Rounding used for a local place-name cache does not remove the more precise coordinates stored with your photos.
You can change location access in iOS Settings. Changing permission does not remove location already stored with imported or captured frames.
Optional Sign in with Apple
You can skip Apple sign-in and use the app. If you sign in, Countenance requests your name and email address from Apple, which may be an Apple relay address. It stores the values Apple supplies in local app preferences, and your Apple user identifier and identity token in the device Keychain. The current app does not send them to a developer-operated account service.
Signing out in Countenance removes those locally saved sign-in details. It does not delete your library, stop iCloud sync, or revoke the app’s authorization with Apple. You can manage that authorization separately in your Apple Account settings.
Reminders and notifications
Optional reminders are scheduled on your device. Timed reminders use your project settings; arrival reminders use a place you choose and iOS location notification services. Notifications can show project and chosen place names on your lock screen, depending on your notification settings.
The app also registers for Apple remote notifications to support CloudKit sync. It has no developer-operated marketing push service. You can turn off reminders per project or change notification access in iOS Settings.
Analytics, diagnostics, and support
The current app has no advertising SDK, cross-app tracking, or third-party analytics or crash-reporting SDK. It does not sell your photos or use them for advertising. It writes operational messages to the device’s system log, such as import performance and sync errors; it does not upload those logs to its own server.
When you use the beta through TestFlight, Apple automatically shares crash logs and usage information with the developer. Depending on how you joined the beta, this can include your name and email address. Feedback you submit can also include comments, screenshots, and device diagnostics. See Apple’s TestFlight privacy information for details.
Beta diagnostics and feedback help investigate problems and improve Countenance. Send only what is needed to investigate the issue; personal photos are not required for a general support request. To ask about access to or deletion of feedback you sent, use the beta feedback route. A separate retention period for developer-held support records has not yet been established for this beta.
Retention, deletion, and your choices
The app keeps library records until you delete them; it does not apply an automatic expiry period. You can delete a frame from its detail view or a project from that project’s Settings. Library deletions are intended to sync when iCloud sync is working.
- Photos and shared copies: deleting a frame or project does not delete copies in Photos, exported films, or files you have shared. Manage those separately in the destination, including Recently Deleted in Photos where applicable.
- Saved face data: deleting a project does not delete the person record or their saved faceprints. The current beta has no in-app control to delete a person or reset their faceprints, and no complete “delete all data” control.
- Local working data: Settings → Storage → Clear cache removes aligned image renders. It does not erase the library, faceprints, import records, place-name cache, or sign-in details. Stopping an import does not guarantee its stored review records are erased.
- Device and iCloud copies: deleting the app alone is not a guarantee that iCloud data, Keychain entries, Photos copies, or backups are erased. Apple provides separate controls for device backups and iCloud storage.
You can disable the Photos safety net in Countenance, skip Apple sign-in, and change camera, Photos, location, and notification permissions in iOS Settings. For privacy questions or help with the current deletion limits, use the beta feedback route.
If optional cloud features are added
Cloud-generated in-between frames and server-based sharing are planned, not available in this version. A future opt-in backend would require an updated explanation of which photos, identifiers, metadata, and diagnostics leave your device; who processes them; and how retention and deletion work. Those details and any necessary consent will need to be provided before that service is enabled. Signing in today does not upload photos to such a service.
Questions about privacy
Email [email protected] with privacy questions. During the beta, you can also open Countenance in TestFlight and use Send Beta Feedback. See support and feedback for what to include.