Scope and contact
Pixel Porter is an iOS app that transfers Apple Photos media directly to the WebDAV server that you configure, for example a NAS (such as Synology) or Nextcloud. Without a configured server, the app works locally and transfers no media. There is no developer-operated photo synchronization backend in the reviewed app. You control the destination and its administration.
For questions about the app, contact Cyril Blum at apps@cblum.ch. This policy describes the reviewed source as of the date above; older installed versions may behave differently. The privacy notice for the cblum.ch website also applies when you visit its pages.
Photos, originals and metadata
With your permission, the app accesses Apple Photos to display, inspect, edit, synchronize, import, restore or delete media through Apple’s system interfaces. It processes original photo and video resources, filenames, asset identifiers, creation and modification dates, media sizes, camera information and other metadata available in the originals. Originals may contain location and other EXIF metadata; the app does not promise to remove it.
Edits made in the app (adjustments, crop, rotation, video trimming) are saved to Apple Photos as revertible edits and keep the original’s metadata. Photos you hide in Apple Photos are not uploaded. When you share files, the app exports them with the original metadata to the destination you choose in the iOS share sheet.
The app can request downloading originals stored in iCloud Photos. Apple then processes this under your Apple account and settings. Photo edits, imports and deletions may affect your shared iCloud Photos library and other connected devices. Full and limited photo permissions change which assets the app can inspect; automatic deletion mirroring is inhibited without full access.
What remains on your device
The app stores a synchronization database containing asset/resource identifiers, filenames and server-relative paths, sizes, dates, synchronization/deletion/offload state, device/library identity tokens and review preferences. Connection settings, server usernames, hostnames, ports, paths and preferences are stored locally in UserDefaults. Server passwords are stored in Apple’s Keychain and loaded into memory when needed; a username or hostname is not treated as a Keychain-only secret.
Temporary media files and previews may be written to app storage during upload, editing, import or restoration. Diagnostic activity logs are written locally and can contain filenames, server/path information, technical errors and synchronization activity. The in-memory log is bounded to 2,000 entries by default; the disk log has no verified automatic retention period or rotation. Clear logs from Settings when no longer needed. Do not assume uninstalling the app removes all Keychain entries or Apple-managed backups.
Transfers to your server
WebDAV sends selected originals and synchronization manifests directly to the local or remote endpoint you configure, using your server username/password for authentication. The server receives files, embedded metadata, device/library identifiers and technical request information such as your IP address. Remote access can carry this information beyond your home network. DNS, network and server operators may process technical connection metadata.
HTTPS is enabled by default and normal certificate validation is used unless you explicitly allow untrusted certificates. The settings also permit disabling HTTPS. Unencrypted HTTP exposes authentication and content to network interception; accepting an untrusted certificate reduces protection. Keep HTTPS enabled with a trusted certificate and a dedicated least-privilege server account.
Transport encryption is not end-to-end encryption against your server administrator and does not encrypt files stored on the server. Server administrators, applications or services with sufficient access can read and process the originals. For example, photo indexing on the server (such as Synology Photos) and any cloud/backup integrations of the server are separate from this app. Their retention, storage location and recipients depend on your own setup, not on the developer’s Hetzner website server.
Deletion, retention and backups
By default, manual review is required before propagating iPhone deletions to the server. Supported deletion mirroring moves files to a Server Bin; its default retention is 30 days and the setting can be changed. App-driven cleanup can permanently delete expired Bin items when it runs, and users can manually purge files sooner. Explicit permanent-deletion actions can bypass the Bin. This is not a guaranteed server-wide deletion deadline. Server snapshots, recycle bins, independently configured backups and previously exported/shared copies may retain additional copies.
Offloading removes copies from Apple Photos while keeping the app’s server copies outside normal deletion mirroring. Restoring requires available, intact files on the server. The reset workflow can either reset local synchronization records or permanently delete the entire configured server destination. Local reset alone does not delete server files or originals in Apple Photos. Synchronization is not an independent backup; verify a separate restorable copy before destructive actions.
You administer deletion and retention of your server files, server accounts, logs and backups. The developer cannot delete or inspect files on your server through this app. No fixed retention for your server files, provider snapshots or Apple backups has been verified. To stop future transfers, stop synchronization, revoke photo/network access as appropriate and revoke the server account’s access. Removing local app storage does not remove existing server copies.
Notifications, diagnostics and voluntary sharing
Optional reminders are local iOS notifications, subject to system permissions and delivery rules. The reviewed source contains no advertising SDK, analytics SDK or automatic developer crash-reporting service. System diagnostics and Apple services remain subject to your device settings.
Diagnostic log export uses the iOS share sheet. You choose the receiving app or person; review and redact filenames, paths and connection details before sharing. Sending support email voluntarily discloses its contents and contact metadata to the recipient and email providers. Do not include passwords or private photos.
Your choices and rights
You can change Photos access in iOS Settings, disable reminders, review sync/deletion settings, clear diagnostic logs, stop transfers and manage or delete data on your own server. Contact the address above for requests concerning correspondence or other information actually held by the app developer. Mandatory privacy rights under applicable law remain unaffected.
Use and liability notice
Use is at your own risk. To the fullest extent permitted by applicable law, the app is provided without warranties of accuracy, completeness, availability or fitness for a particular purpose. Liability for damage from use or unavailability, including data loss, lost profit and consequential damage, is excluded to that extent. Mandatory statutory rights and liability remain unaffected, including intentional misconduct, gross negligence and personal injury where exclusion is not permitted. Keep independent backups and verify restoration before deletion or offloading.