Founder-signed · Plain English · Verifiable
A founder-signed commitment, not a privacy policy. Below is the deal — what JogIt does with your photos, your voice, and your face data, and what it never does.
I built JogIt because I was uncomfortable with Google and Apple having copies of photos of my family.
Not because either company is going to do something nefarious tomorrow — they probably aren't. Because the deal kept changing without me being asked. Photos uploaded "for backup" became inputs to a machine learning pipeline. Faces I never tagged got recognized anyway. The privacy policy got an email update I didn't read. The price went up.
JogIt is what I wanted instead. A photo search engine that runs on the phone I already paid for, costs $6.99 once, and is small enough that you can read its entire network behavior in a single afternoon.
The rest of this page is what I promise about your photos, your voice, and your face data. Each commitment is something you can verify yourself — not because you should have to, but because being able to verify it is the point.
JogIt analyzes your photos on your device, using Apple's Vision framework on iOS and Google's ML Kit on Android. The vision model (a quantized MobileCLIP variant) runs on your device's neural engine. Your photos are inputs to that model. They are never inputs to a server.
How you can verify this. Install JogIt. Open a network monitor — Proxyman, Charles Proxy, or mitmproxy — on the same Wi-Fi network as your phone. Run a search. The number of outbound requests JogIt makes during search should be zero. If you see one, that's a bug, and it's a bug we treat as a launch blocker — see How JogIt Works for the full guide.
When you tap the microphone and speak, the speech-to-text transcription runs on your device using Apple's SFSpeechRecognizer with requiresOnDeviceRecognition set to true, or Android's createOnDeviceSpeechRecognizer. The audio of you speaking does not leave the device. The transcription does not leave the device. The audio file is held in memory only during capture and is dropped the moment transcription completes — it is never written to disk.
If your device or language doesn't support on-device speech recognition, the microphone button isn't shown at all. There is no fallback to a cloud speech service. Ever.
JogIt detects faces on-device using MobileFaceNet. When you tag a face by name, what's stored is a 512-number embedding — a math fingerprint of that face. The original face image is never saved separately. The fingerprint cannot be reverse-engineered into the original face image, by us or anyone else.
The fingerprints, the names, and the search index all live in an SQLCipher-encrypted database on your device. The encryption key lives in the OS secure enclave (iOS Keychain / Android Keystore). If your phone is stolen and someone manages to extract the file, what they have is encrypted noise.
When you delete JogIt, every byte of this is removed. No "deactivation." No 30-day grace period. No copies elsewhere — because there are no copies elsewhere.
JogIt makes money one way: you buy it once, for $6.99, after 25 free searches. That's the whole business model. There is no ad network, no data broker, no VC-funded pivot waiting to monetize the user base differently. JogIt LLC is a Maine corporation owned by one person — me — and it does not raise outside capital that would change this.
No account, no email, no profile. Install. Use. That's the whole user model.
This is the one I take most seriously, because it's the one that has been broken by every cloud photo service in the last fifteen years.
If JogIt ever does change anything material about the commitments on this page — if a future version of the app needed to make a network request during search, or if we ever decided to introduce account-based features — you will hear about it from us before it happens, you will have the option to export and delete every byte of data JogIt has stored on your device, and the previous version of the app will continue to work for as long as your OS supports it.
This is a promise, not a Terms of Service that can be updated by email.
Jack Heitger · Founder, JogIt LLC
Berwick, Maine · May 2026