Occlude Offline Whitepaper

How to verify — by yourself — that your photos never leave your device.

Occlude's core promise is simple: photo redaction happens 100% on your device, and the app makes zero network requests of its own. This document explains exactly how that is achieved in code, and gives you step-by-step ways to verify it yourself.

1. What the app actually does

Text detection uses Apple's Vision framework (VNRecognizeTextRequest) — runs locally, no server involved.
Redaction rendering uses Core Graphics / Core Image — pixels are burned locally.
Image loading uses ImageIO (CGImageSource) for downsampling — local decode only.
Saving writes the result to your photo library via Photos (PHPhotoLibrary, write-only permission).
Purchase / restore uses Apple's StoreKit — the only network traffic, initiated by Apple's system frameworks to Apple's servers, never by app code and never involving your photos.

2. Evidence in the build

2.1 No networking APIs in app code

The app's own source code does not instantiate URLSession, Network.framework, NWConnection, or any socket/HTTP API. A static search over the source tree for these symbols returns no hits outside Apple system frameworks.

2.2 Privacy manifest (zero collection)

PrivacyInfo.xcprivacy declares no collected data (NSPrivacyCollectedDataTypes is empty) and no tracking (NSPrivacyTracking = false). This is the same declaration shown on the App Store product page and enforced by Apple's app review.

2.3 Minimal permissions

The only permission requested is photo library write access (NSPhotoLibraryAddUsageDescription, .addOnly) — to save your exported image. The app never requests photo read access, location, camera, microphone, contacts, or network permissions.

3. Verify it yourself (10 minutes)

3.1 Packet capture

Run Charles Proxy or Proxyman on a Mac, install its CA certificate and configure your iPhone's proxy to point at it (or use the iOS Simulator with the proxy set on the Mac).
Launch Occlude, import a photo, run auto-detect, redact, export.
Observe: no requests appear during any of these steps. The only possible entries are Apple's App Store / api.appstoreconnect traffic if you tap "Restore Purchase" — that is StoreKit contacting Apple about your purchase, and it carries no image data.

3.2 Airplane mode

Enable Airplane Mode, then use the app end-to-end (import → detect → redact → save). Everything works. A genuinely cloud-dependent app would fail here.

3.3 iOS App Privacy Report

On iOS 15.2+: Settings → Privacy & Security → App Privacy Report, enable it, then use the app. Review Occlude's Network Activity section. The only entries, if any, are StoreKit domains — with zero data.

4. What this means for you

Your screenshots, documents, and photos are never uploaded, never processed on a server, never used for training, and never accessible to us or anyone else. Redaction is irreversible by design, and the output is stripped of EXIF/GPS metadata.

5. Scope & limitations

This guarantee covers the app as published. If the app is modified or sideloaded with different code, this document does not apply.
Apple's system services (StoreKit, system update checks) communicate with Apple's servers under Apple's privacy policy; they carry no photo data.