What this sitecollects about you.

This website

Page views, counted in aggregate

The site uses Vercel Web Analytics to count page views. It sets no cookies, writes nothing to local storage, and does not give you an identifier that follows you to other websites. That is not a claim taken from a vendor page: with the script running, this site’s own document.cookie and localStorage are both empty, and you can confirm that yourself in your browser’s developer tools right now.

There is no advertising network, no tag manager, no social tracking pixel, no session recording and no A/B testing tool. Nothing here is sold or shared with a data broker.

Nothing is loaded from anyone else

The typefaces are downloaded at build time and served from this domain, so your browser never asks Google for a font. The screenshots and the walkthrough video are served from here too. There are no embeds, no iframes and no external scripts beyond the analytics above. Loading this page does not tell any third party that you did — apart from the host serving it.

The host

The site is hosted on Vercel. As with any website anywhere, your IP address is necessarily involved in delivering the page to you, and the host keeps operational logs. That is a property of how the web works rather than a decision taken here, but it is still true, so it is written down.

If you email

The only contact point on this site is a plain mailto: link. There is no form and no signup box. If you write to contact@usekelvin.app, your message and your address arrive in an inbox and stay there. You are not added to a mailing list, because there isn’t one.

The application

Kelvin runs entirely on your Mac. There is no account, no upload, no telemetry and no crash reporting. Scenes are read by Apple’s Vision framework, part of macOS, so reading a photograph needs no network and nothing is downloaded to do it. A released build makes two kinds of outbound request, both described below and both on by default: the update check, and place-name lookups for photographs that carry GPS coordinates.

On a Mac with Apple Intelligence turned on (macOS 27 and later), Kelvin also asks Apple’s on-device model three questions about the scene: is it indoors, is any sky visible, and what kind of light is it. That model runs on your Mac, and Kelvin never uses Apple’s cloud model, so this adds no network request.

Account required

None

Photographs uploaded

None

Usage telemetry

None

Crash reporting

None

Network requests, released builds

Update check, place names — both on by default

The update check

A released build keeps itself current with Sparkle, the standard macOS updater. It checks automatically, about once an hour, and asks before it installs anything. When a newer version exists you see the standard “a new version is available” sheet and decide. Settings ▸ General has two switches, one for checking and one for installing without asking. Turning off the first means no update request is made until you choose Check for Updates yourself.

This has moved twice, and both moves are worth stating plainly. Version 0.1.0 asked first; from 0.2.0 the app installed what it found on quit, because an alpha that only updates the people who said yes to a dialog leaves known-bad versions running in the field. From 0.8.2 it asks again — a silent install on quit meant nobody ever saw an update happen, and one release was stuck in the Dock unable to quit at all, so the update that fixed it could never install itself. Checking stays on by default; installing is yours to say yes to.

The check itself is a request to this domain for a few kilobytes of XML describing the newest version. Like any web request, the server end sees an IP address. No photograph, no filename, no account and no identifier travels with it, there is nothing about your library in the reply, and the file is the same one for everybody who asks.

Place names

If a photograph carries GPS coordinates, Kelvin asks Apple what that place is called, so the filmstrip can group a shoot under a town rather than under a pair of numbers. The panel can also show a small still map of the spot, fetched from Apple the same way. The coordinate goes; the photograph does not. No pixels, no filename and no identifier travel with it. The coordinate is rounded to about 110 metres before it is sent, and each place is looked up once, not once per frame.

It has been on by default since version 0.3.0. The switch is in Settings ▸ Scene reading, under Network. With it off, no coordinate leaves your Mac, not for names and not for maps, and the filmstrip shows degrees instead. The names already looked up are kept in a small file beside your edits. Turning the switch off offers to forget them.

A coordinate is still a revealing thing to send, because home is a place people photograph a lot. That is why it is rounded and switchable, and why it is written down here.

Your originals, and your metadata

Original files are never written to. Edits are stored separately as small JSON recipes, so the file your camera wrote stays exactly as your camera wrote it.

From version 0.4.0 Kelvin also keeps a cache of things it would otherwise re-read from your photographs on every launch — filmstrip thumbnails, capture dates and the rest of the camera header. It lives in ~/Library/Caches on your own Mac, it never leaves it, and deleting it is always safe: everything in it rebuilds from the originals. It is what makes a shoot on a network drive open at a reasonable speed.

One thing here is worth reading properly. Exported photographs carry their original metadata by default, and that includes the location the photograph was taken. It is on by default, because quietly destroying something you might need later is the worse mistake. It does mean an exported file can tell someone where you were standing. One switch in the export options removes it, and if you are publishing photographs taken at home you should use it.