Private because it's yours.
Frameleaf runs on hardware you own. Nobody scans your library, trains on your photos or sells what's in them, because nobody else has them.
On your server.
No account needed
A self-hosted server works fully without a Frameleaf account, a licence or an internet connection.
Faces stay home
Face detection and recognition always run on your server. They are never offered in the cloud.
Search stays home
The smart search index is built locally, even when Frameleaf Cloud is linked.
Your own files
Originals are stored as ordinary files on your disks, so you can always walk away with them.
Locked, until you say so.
Locked items stay in their albums but disappear from the timeline, search, the map, memories and shares until you unlock this session with your PIN. A Locked or Revealed pill in the header always shows which state you're in.
Private inside your household too.
A family server holds everyone's photos. Frameleaf gives each person room for things that aren't for everyone.
Locked folder
Keep sensitive items behind a PIN, out of the timeline, search and shared views.
Sensitive content
Optional detection marks likely sensitive photos for your review before anything is hidden.
Hide people and tags
Suppress selected people or tags, such as medical or work content, from everyday browsing.
Separate libraries
Everyone has a private library. Sharing happens only through partners, albums, groups and links you create.
And when you use the cloud.
Frameleaf Cloud is built to see as little as possible.
A blind relay
Remote access passes encrypted traffic to your server without decrypting it. Your server's certificate key never leaves home.
Backups it can't read
Cloud backup lives in a bucket for your server alone. The storage provider encrypts every file with your key and never keeps it.
Encrypted before it leaves
Buddy backup encrypts media, file names and albums on your server. Your buddy and Frameleaf Cloud only see sizes and timing.
GPU jobs, by consent
Cloud GPU work runs only when you start it, with location and camera metadata removed. Nothing you send is used to train models. Faces and search are never sent.
Nothing phones home.
Telemetry is permanently off in Frameleaf. There is no setting and no flag that turns it on.
No analytics
The server, the web app and the phone apps include no third-party analytics. Crash reports from the apps are off unless you opt in, and never include photos, names or searches.
Update checks are opt-in
Off by default. When on, your server asks only Frameleaf's own servers and sends nothing that identifies it.
Downloads from Frameleaf only
Map tiles and AI models come from Frameleaf's hosts, and description models can run fully offline.
Local place names
Reverse geocoding runs inside your server's database. Your coordinates never go to an outside service.
Locked rules
Choose people, pets or tags whose photos stay hidden until you unlock. The rules themselves are visible only while unlocked.
Write-only secrets
Passwords and keys you give the server can be replaced but never read back, even by an administrator.
Don't take our word for it.
The Frameleaf Library community edition is open source under AGPLv3. Read the code that handles your photos.