Elegant Photo Cleaner collects nothing: no photo, no file name and no hash ever leaves your machine. Turn the internet off and see for yourself — the app keeps working in full, and an automated test fails the build if a network client ever shows up in the code.
Elegant Photo Cleaner collects nothing. Your photos are analyzed on your computer and never leave it.
It reads the folders you point it at, computes mathematical signatures for each photo (dHash, pHash, Hamming distance, Laplacian variance, EXIF data), groups the look-alikes into stacks and shows why two photos are together. All locally, on your machine's CPU and with Windows' own codecs.
There is no upload. There is no server of ours. There is no user account. You can turn off the internet and the app keeps working entirely — that is the simplest way to verify this policy.
This is not just a text promise: the repository has an architecture test that sweeps every shipping source file (engine, app and design system) and fails the build if HttpClient, WebClient or Socket shows up anywhere. There is no network client in the product — not because we promised, but because an automatic gate does not let one in.
No analytics, no trackers and no third-party SDK inside the app. (For the website that publishes this policy, see "This website" below.)
All of them go through Windows' own API (Windows.Services.Store), and none transmits content or metadata from your files. There are five, and only these:
If the Store is unavailable, the app keeps the access already granted (fail-open): a network failure never locks your work.
There are also links the app may open in your Store app — and a link is not a connection of ours: the Store is the one that navigates, if and when you click. They are the product page, the reviews page (when the dialog in item 5 is not available on this version of Windows), and a search for the codec extension your machine is missing (for example, "HEIF Image Extensions", when you have HEIC photos and Windows cannot open them).
The app contains no other network client — no HTTP, no self-updater. Updates are delivered by the Microsoft Store. The package asks for a single permission, runFullTrust, and no network capability.
This policy is also published at elegantfe.com/privacy-photo. The section below is about the WEBSITE only — the app itself still has no telemetry whatsoever.
The website is a static presentation page hosted by a third-party hosting provider. It uses Google Analytics to measure audience in aggregate (which pages are visited and where visits come from), which may involve Google cookies and identifiers — see Google's privacy policy for details. We do not use this data to identify you, we do not sell data, and there are no other third-party pixels. Your browser also stores your language preference (in localStorage), which stays on your device, and the hosting provider keeps its own access logs, as any web server does. When you arrive, a discreet notice lets you accept measurement or stick to the essentials, and the choice can be changed at any time.
In %AppData%\ElegantPhoto (the folder your Windows profile may carry — small, readable, versioned files):
Elegantsettings.json — language, theme, text scale, "reduce motion", the folders you chose to analyze, the similarity step and the rule for which photo stays.pins.json — your decision: which photos you pinned to keep and which classes of evidence you already reviewed. A human decision never lives in the catalog alone, precisely so it survives any self-healing of the database.journal/<run>.jsonl — the undo journal. It records, BEFORE any file moves, what is about to happen: the paths going to the Recycle Bin, which file stays in their place, and the real outcome of each item. It is what makes a clean-up undoable, including on the next launch.postsweep-undo.json — the from→to of the after-clean-up offers (organize by date, rename from EXIF), written before the batch for the same reason.license.dat — the first-use date and whether a purchase happened.growth.json — a count of distinct days of use, used once to decide whether the review invitation appears.window.json, suite.json, undo-offer.json — window size and position, suite notices already dismissed, and undo offers already declined.logs\app.log — a local diagnostic log: error type, message, stack and the context the code itself names. It is rotated by size (~1 MB) and never leaves this computer. The app shows you its path in the "About" window so you can open and read it.In %LocalAppData%\ElegantPhoto (the LOCAL folder, never synced to any server):
catalog.db — the catalog of your collection, in SQLite. Per photo it holds: the path, the size, the modification date, EXIF facts (dimensions, camera, capture date, orientation), the hashes (SHA-256 and a hash of the first 16 KB), the perceptual signatures and a 32×32 grayscale proof strip (about 1 KB) derived from the image — that strip is what makes "the same photo, rotated" recognizable. It is a mathematical reduction, not a viewable copy of your photo.thumbs\ — the 128 px thumbnails (JPEG, ~4 KB each) the grid shows, so the app does not re-decode your whole collection every time you scroll.Why the catalog lives in %LocalAppData% and not in %AppData%: %AppData% is the folder corporate networks sync to a server, and a tens-of-megabytes catalog of your collection has no business leaving your machine — besides, a WAL-mode database over a network folder is an invitation to corruption.
Both folders are disposable. The catalog and the thumbnails are rebuildable: deleting them costs no photo at all — it costs one new scan. You can erase everything at any time by uninstalling the app or deleting those folders.
When the app is installed from the Microsoft Store, it writes two small files to %LOCALAPPDATA%\Publishers\b511j8cvt05p6\ElegantSuite\ — a folder Windows grants to apps from the same publisher, readable only by them. They are written whether or not another Elegant app is installed, because the folder exists precisely so that a sibling can read them later. On an unpackaged build nothing is written there at all. The two files are:
No FILE path leaves there — only folder paths. The sibling needs to know "this folder holds N repeated photos"; it does not need to know which ones. It is local, rebuildable cache that goes into neither backup nor roaming.
In the other direction, the app reads from that same folder, when present, the hash database Elegant File Explorer already computed — only to avoid recomputing what was already computed. Opportunistic reading: absent or unreadable, the app does the math itself and nobody notices.
Only the ones you ask for, and always where you choose:
.efephoto) and the CSV report, when you click export;efephoto://v1/run?job=scan), a text report written next to the scanned folder. That mode only reads — there is no activation verb, protocol or command line in this app that deletes anything.Nothing is overwritten: a name clash gets a suffix.
Elegant Photo Cleaner never alters the content of a photo of yours. The only destructive verb in the product is sending files to the Windows Recycle Bin, and it only happens from a plan that was displayed, reviewed class by class and approved by you. Permanent deletion does not exist in the app — not as a hidden option, not as a checkbox. The only deletion calls that exist in the sources touch the app's own log and its own configuration files — none of them touches a photo of yours —, and they sit in an allowlist commented one by one, which an architecture test checks on every build. Any new call fails the build.
Two caveats, stated because they are true:
And undo depends on the files still being in the Recycle Bin: if you emptied it, no feature can bring them back — and the app says so instead of pretending.
The app is not directed at children and collects no data from anyone, minors included.
Since we do not collect, store or process any personal data of yours, there is nothing to request, correct, export or delete from us. Purchase and installation data stay with Microsoft, under the Microsoft Privacy Statement.
If this policy changes, the date at the top is updated and the new version is published on the product page and shipped with the app. A change that started collecting any data would be announced prominently — but the product's commitment is to collect nothing.