Privacy Policy

Last updated: 2026-05-01

ColorWander ("we", "the app") is built by an independent developer (Bryant / chenzhenghao94@gmail.com) and is designed to process photos entirely on your device. This page explains what data the app touches, what leaves your device, and what does not.

Data we handle on-device only

Photos you pick — The app reads the single photo you select (via PHPickerViewController) to extract its palette, EXIF time / GPS, and dominant colors. The pixel data is used only to render the exported card.
EXIF metadata — Capture time and GPS coordinates (if present) are read from the photo's EXIF block and used to produce the caption. If GPS is present we may run a reverse-geocode lookup to translate it into a city name (see below).
Offline city fallback — If online reverse-geocoding fails, the app can match the GPS coordinate against a bundled city list to produce a city-level label. This lookup runs locally and sends nothing off-device.
Scene classification (Vision) — When a photo has no GPS but the Location caption is enabled, the app runs Apple's on-device Vision scene classifier over the picked photo to produce a fallback label (e.g. "beach", "indoor"). The Vision model is bundled in iOS, runs locally, and neither the photo nor the label leaves your device.
Gallery items — When you tap "Save", the rendered card image (a JPEG) and a small JSON metadata record (caption, layout, aspect ratio, dominant color hex, city name) are written to your device's sandboxed Documents/ directory. These do not leave the device.
Preferences — Language, appearance (light/dark/system), and similar flags are stored in UserDefaults (also on-device).

Data we send off-device

CoreLocation reverse-geocoding — If your photo has GPS EXIF and you keep the Location caption enabled, the app asks Apple's CLGeocoder (and, as a fallback, MapKit's local search) to convert the coordinates into a locality string. Per Apple's documentation these requests go to Apple servers; ColorWander never sees your coordinates after you pick the photo and receives only the text returned by Apple.
OpenStreetMap Nominatim fallback — When Apple's services fail to resolve a coordinate (which happens on some Chinese carrier networks for overseas coordinates), the app falls back to Nominatim — the OpenStreetMap community's public reverse-geocoding service. The request may go directly to Nominatim or through a first-party HTTPS proxy that forwards the same request and caches short-lived responses. Only the photo's GPS coordinate is sent, over HTTPS, with an identifying User-Agent header as required by Nominatim's usage policy. Nominatim is a last resort, not the primary path.

Data we do NOT collect

No accounts, no sign-in, no email subscription.
No analytics SDK, no crash reporter, no third-party tracking.
The app's own analytics events (export_completed, caption_literary_enabled, layout_switched, etc.) are emitted to Apple's OSLog on-device only. They are never transmitted to our or any other server. You can view them in Console.app if you're curious.
No advertising ID, no fingerprinting, no IDFA.
No account backend, user database, analytics server, or tracking server.

Permissions we request

Permission	What for
Photo Library (read)	Read the photo you pick to build a card.
Photo Library (write)	Save the exported card to your Photos when you tap "Save to Photos".
Camera (optional)	Take a photo to turn into a card. Declined → app continues; you just can't take a new photo in-app.

Third-party fonts

ColorWander bundles the open-source LXGW WenKai (霞鹜文楷) font by lxgw, licensed under the SIL Open Font License 1.1. Attribution is in Settings → Acknowledgements. The font file is a static resource and does not phone home.

Third-party data

ColorWander bundles a subset derived from the GeoNames cities1000 gazetteer, licensed under Creative Commons Attribution 4.0. Attribution is in Settings → Acknowledgements. The city list is a static resource and does not phone home.

Children

ColorWander is rated 4+ and does not knowingly collect data from anyone. There is no data collection to age-gate.

Your rights

Because the app holds no data about you off-device, there is nothing to export, correct, or delete on a server. To delete your local data, uninstall the app — iOS will remove the Documents sandbox and UserDefaults with it.

Changes

If this policy materially changes, the version date at the top will update and the app's Settings → About will surface a new policy URL. For meaningful changes (e.g. adding any off-device data flow), a release note will also call it out.

Contact

Questions or concerns: chenzhenghao94@gmail.com