栖是一款完全在设备端运行的应用：它把你的一张照片和这张照片自带的信息，做成一件可以留下的作品。我们的隐私原则只有一条：我们没有服务器，也看不到你的任何东西。你的照片不会被上传到任何地方。
不收集任何数据。栖没有服务器、没有账号系统、没有广告、没有任何第三方 SDK，也没有统计与埋点。我们不收集、不存储你的任何个人信息或使用数据，也没有任何途径可以读取它们。
在你授权后，栖读取你挑选的那一张照片，用 Apple 提供的端侧框架（Vision、Photos、AVFoundation、Core Image 等）在本机完成主体识别、主色提取与作品渲染。照片不上传，不接任何云端生成服务。
作品上的文字全部来自计算与查表——节气、时辰、干支、传统色名、诗句匹配，都是在本机用内置的数据算出来或查出来的，不是由模型生成的。
我们不改动你的照片。栖不调色、不加噪、不加滤镜：物件是给照片做一个框或一个邻座，照片本身分毫不动。
如果你选的照片自带 GPS 坐标，栖会在本机读取它。坐标有两个用途，都在这台设备上完成，都不联网。
一、写在作品上的那个地点。坐标会被约到约十公里见方的格子中心，只保留这个粗值。
二、认出地标。栖内置一张地标表（例如爱晚亭、黄鹤楼、西湖），每一条自带半径。这一步要用到未经约化的原始度数——十公里的格子里，黄鹤楼和长江大桥是同一个点。原始度数只在这一次比对时存在于内存中，用完即弃：既不落盘，也不外传。
认出地标时，作品上写的是地名（例如「长沙 · 爱晚亭」）；认不出就退回粗坐标（例如 28.15°N 113.05°E）；照片没带坐标时，这一行什么也不写。
栖还会读取画面里出现的文字（例如匾额上的字），只用来跟上面那张地标表比对。文字识别在本机完成，识别出来的文字不保存、不外传。
设置里另有一个默认关闭的「补全城市名」开关。开启后，那个已经约化过的粗坐标会送到 Apple 的地名服务（CLGeocoder）换回一个城市名——这是栖唯一一次联网，送出去的只有粗坐标，照片本身仍然不上传，并受 Apple 隐私政策约束。
栖不记录定位历史，也不建立用户画像。
车票与拍立得这两件物件会印出拍摄器材，例如「iPhone 13 Pro · 26mm」。这两项来自照片自己带着的信息（EXIF 的机型与等效焦距），读取它不联网。设置里可以关掉；照片里没写这两项时，作品上也不会出现。
你的作品——包括栖为它保存的那份照片副本、实况照片的那段动态、以及诗句与记事——只存在你设备上的应用沙盒内，不同步、不备份到我们这里（我们没有可供备份的地方）。
在 App 内可以随时删除单件作品；作品详情里也可以只收掉实况的那段动态而保留作品本身。删除 App 会一并删除它保存的全部数据。你相册里的原始照片不受任何影响。
栖不含广告，也不含任何第三方 SDK。若日后加入 App 内购买，交易全部由 Apple 的 App Store 处理，我们看不到也不存储你的支付信息，购买状态由 Apple 的 StoreKit 在设备上校验。
栖不收集任何人的个人信息，也包括儿童。
如有疑问，请联系：liming.job112@gmail.com
本政策如有更新，会发布在本页面。
Dwell runs entirely on your device: it turns one of your photographs, together with the information that photograph already carries, into a keepsake. Our privacy principle is a single sentence: we have no servers, and we cannot see anything of yours. Your photos are never uploaded anywhere.
None. Dwell has no server, no accounts, no advertising, no third-party SDKs, and no analytics. We do not collect or store any personal information or usage data, and we have no means of reading any.
With your permission, Dwell reads the single photo you choose and uses Apple's on-device frameworks (Vision, Photos, AVFoundation, Core Image) to recognise its subject, extract its dominant colour, and render the work locally. Photos are not uploaded and no cloud generation service is used.
Every line of text on a work comes from computation and lookup — solar terms, traditional hours, sexagenary years, traditional colour names, poem matching — performed on your device against bundled data. Nothing is generated by a model.
We do not alter your photograph. Dwell applies no colour grading, grain, or filters: the object provides a frame or a companion for the photo; the photo itself is left untouched.
If your photo carries GPS coordinates, Dwell reads them on your device. They are used for two things, both performed locally, neither requiring the network.
1. The place printed on a work. The coordinate is rounded to the centre of a cell roughly ten kilometres across, and only that coarse value is kept.
2. Recognising a landmark. Dwell ships a table of landmarks — Aiwan Pavilion, the Yellow Crane Tower, West Lake and others — each with its own radius. This step needs the unrounded degrees: inside a ten-kilometre cell, the Yellow Crane Tower and the Yangtze River Bridge are the same point. The exact degrees exist only in memory for that one comparison and are discarded immediately — never written to disk, never sent anywhere.
When a landmark is recognised, the work names it (for example “Changsha · Aiwan Pavilion”). When none is, the work falls back to the coarse coordinate (for example 28.15°N 113.05°E). When the photo carries no coordinate at all, the line is left out.
Dwell also reads text that appears in the picture — the characters on a plaque, say — solely to compare it against that same landmark table. Text recognition runs on your device; the recognised text is not stored and never leaves it.
Settings contain a separate default-off “Add city names” switch. When on, the already-rounded coarse coordinate is sent to Apple's geocoding service (CLGeocoder) in exchange for a city name — this is the only time Dwell uses the network. Only the coarse coordinate is sent; the photo is still never uploaded. Apple's handling is governed by Apple's Privacy Policy.
Dwell keeps no location history and builds no user profile.
Two of the objects — the ticket and the Polaroid — can print the camera that took the photo, for example “iPhone 13 Pro · 26mm”. Both values come from the photo's own metadata (EXIF model and 35mm-equivalent focal length); reading them requires no network. You can turn this off in Settings, and nothing is printed when the photo does not carry it.
Your works — including the copy of the photo Dwell keeps for them, the motion clip of a Live Photo, and the poem and record text — are stored only in the app's sandbox on your device. Nothing is synced or backed up to us, because there is nowhere for us to back it up to.
You can delete any single work from inside the app, or drop only the Live Photo motion while keeping the work. Deleting the app deletes everything it stored. The original photo in your library is never affected.
Dwell contains no advertising and no third-party SDKs. If in-app purchases are added in future, transactions are handled entirely by Apple's App Store; we never see or store your payment information, and purchase status is verified on-device by Apple's StoreKit.
Dwell collects no personal information from anyone, including children.
Questions? Email liming.job112@gmail.com.
Updates to this policy will be posted on this page.