Privacy Policy

What stays on the device

When you import photos, Nine Pick opens the system photo picker. You choose the images; the app never asks for permission to browse your whole library. Everything that happens next runs on the device:

• Decoding and scoring each photo — sharpness, exposure and clipped highlights or shadows, face detection and face quality, subject position.
• Comparing similar shots with a perceptual hash and, where available, an on-device feature print, so repeats and closed-eye frames can be dropped.
• Choosing the layout, cropping around subjects, applying styles, and rendering the finished image.

No photo, crop, caption or finished image is uploaded by the app. There is no account, no sign-in, and no developer server that holds your work.

Saving to your photo library

Nine Pick writes to your photo library only when you tap Save, and only the single composed grid image is added. On iPhone that goes through the "Add Photos" permission, which does not let the app read back or list the rest of your library. On Android 10 and newer the same write needs no permission; on the older devices this build still supports, it asks for storage write, again only to add the finished image. You can still use the system share sheet if you decline.

Your collection

By default, every export is also filed into a local collection so you can reopen it later, change the layout or export again. For each saved grid the app keeps, inside its own sandbox:

• Compressed copies of the photos used in that grid, downscaled to at most 1600 pixels on the long edge and saved as JPEG, plus a small thumbnail. These copies may differ in resolution, format or quality from your originals.
• The layout and style settings for that grid — ratio, template, cell count, which photo sits in which cell and how it is cropped, spacing, frame, corner radius, backdrop, look and its strength, export size, file format, and whether the finished image is sharpened.

The collection keeps up to 60 grids; the oldest are trimmed automatically as new ones arrive. You can delete a single grid, clear the whole collection at once with "Delete all", or turn saving off in Settings. This is a working archive for re-editing, not a photo backup: keep your originals somewhere safe.

Nothing goes to the developer

Nine Pick sends nothing to the developer. There is no launch counter, no session log, no analytics SDK, no crash collector, no account, and no developer endpoint that receives anything about you or your work. Earlier text on this page described a small launch-count request sent to the developer's server, with a switch for it in Settings; that reporting has been withdrawn from both builds and the request is no longer made.

The iPhone build needs no network access of its own. The transfers you can observe there are Apple's - an iCloud photo downloaded because you picked it, a share sheet you opened - started by you and governed by your own device settings. The only thing the app itself sends anywhere is the pair of Android reports described next.

Crash and usage reporting: none on iPhone, Firebase on Android

• The App Store build contains no telemetry of any kind: no crash reporting, no usage statistics, no analytics SDK, no remote config, no A/B split, and no seam wired for one. Everything below describes the Google Play build.
• The Google Play build ships two Google Firebase components, Crashlytics and Analytics. They send two kinds of things: the stack trace of a crash or non-fatal exception, and the events Firebase records on its own - app install and first open, session start, how long each screen stayed in view and which screen that was. This build adds no custom event of its own.
• What those reports carry: an anonymous installation ID that Firebase generates on the handset; the device brand, model, Android version and locale; the app version; which screen was on view; and, for a crash, the call stack and the screens visited just before it. The Android build contains no advertising library, and the advertising identifier permission that the Analytics runtime would otherwise add has been taken out of its manifest - so no advertising identifier (AAID), no App Set ID, and no install referrer from the store.
• What they never carry: photos, crops, captions, layout or style settings, finished exports, collection entries, or any field that names you. With no account and no developer endpoint, there is nothing on our side that ties a report to a person.
• Google is the collector and processor of this data, which travels over TLS. The purpose is limited to seeing which build crashes and which features people actually reach for; the reports are not joined to any advertising account and are not used to personalise anything. Google's privacy policy is at https://policies.google.com/privacy and Firebase's data processing terms at https://firebase.google.com/terms/data-processing-terms.
• How long Google keeps it: usage reports age out of the Firebase project on that project's fixed storage duration, and a crash group stops collecting once the crash stops recurring. Neither is a record of who you are, and neither contains a copy of your work.
• Turning it off: the Android build has no in-app switch for these two reports. You can stay offline - pending reports wait on the handset and only go out when a connection returns - or remove the app, after which a reinstall gets a fresh Firebase ID rather than the old one. Development builds send neither report.

Photos in iCloud

If a photo you picked is stored in iCloud rather than on the device, the system may download it so the app can use it. That transfer is handled by Apple's services under your own settings, not by Nine Pick.

Sharing you start

When you use the share sheet, the finished image goes to whoever you choose. How they store or repost it is outside this policy, so check the recipients and the content before you send.

Data leaving the device

Nine Pick does not operate cloud sync. Your drafts, crops, collection entries and exports live in the app's own sandbox on the device. On iPhone they can still travel with your iPhone backup, device migration or iCloud settings; those are Apple services, and the developer neither runs them nor can delete what they store. On Android the app opts out of both: cloud backup and device transfer are switched off for its data, so a Google One backup does not carry your collection.

Retention and deletion

Deleting a grid removes its local copy from the collection, and "Delete all" does the same to every entry in one go. Deleting the app removes its sandbox data, subject to your backup settings. Copies already saved to your photo library, sent through the share sheet, or held in a backup stay where they are until you delete them there.

Because there is no account and no developer endpoint, there is nothing for the developer to look up, restore or erase on your behalf. The Firebase reports in the Android build are the one thing held by someone else: removing the app ends that installation ID, and if you want the reports of a particular install acted on, email us with the app version and the rough date and we will put the request to Google.

Permissions and third-party components

Neither build uses the camera, microphone, location or contacts, and neither asks for permission to track you across apps or other developers' apps. Neither contains an advertising SDK.

Every permission a build declares, listed so you can check it against the store listing:

• iPhone: one usage description only — adding the finished grid to your photo library, used when you tap Save. None for the camera, microphone, location, contacts or tracking, and no network entitlement of its own.
• Android, requested at run time: photo write access, limited in the manifest to Android 9 and older — on Android 10 and newer the save goes through the system media store and needs nothing.
• Android, declared for you: internet access, which exists only so the two Firebase reports set out above can be sent; two companion permissions from the same libraries, for checking network connectivity and for scheduling those reports; and one signature-scoped receiver guard that the bundled AndroidX code adds and that no other app on the handset can hold.
• Android, taken out rather than left switched off: the advertising identifier permission, the two Ad Services permissions and the store install-referrer service are stripped from the merged manifest, so an installed copy declares none of them.

The iPhone build has no third-party analytics and no crash-reporting service: photo decoding, sharpness and face scoring, layout and rendering all run on Apple's own frameworks inside the app.

The Android build additionally contains two components from Google LLC, Firebase Crashlytics and Firebase Analytics, which are the reporting set out above. They are the only reason that build uses the network; the app makes no other requests, and no advertising identifier permission is declared.

Children

The app is not designed for children. Anyone under the age of digital consent in their country should use it with a parent or guardian, who can review this policy with them. The app asks no age and stores no profile, and the Firebase reports in the Android build carry no field that identifies a person.

Changes

If the app starts processing data differently, this policy is updated and its date changes. A material change to what is collected is announced in the app before it takes effect.

Contact

Operator: Beijing Blue Ocean Xinfan Technology Co., Ltd
Privacy and support email: howoo.bluesail@gmail.com

Please mention "Nine Pick" and what you would like done. We do not ask for unrelated personal details to answer an ordinary question.