What never leaves your Mac
There is no cloud version of All Our Years, no account to create, and no server that stores anything about you or your family. Your archive's index, its thumbnails, and every insight it produces (event names, people, timelines) stay on your Mac's internal disk. All Our Years does not run analytics or usage tracking of any kind inside the app.
What the app sends over the network
The app works offline for its core job: reading your archive and showing it back to you. Three features make a network request, described below. Family Circle, if you turn it on, is covered separately.
1. Update check
The app periodically fetches static files from allouryears.com (the same appcast.xml an RSS reader would fetch) to see if a new version exists, and shows you the release notes before you install anything. Like any website visit, our CDN sees the request's IP address in its ordinary server logs. Nothing about your archive, your photos, or your usage is included in the request.
2. License activation and deactivation
When you paste a license key in Settings, All Our Years sends the key and a per-Mac instance identifier to Polar to activate that seat. Deactivating a seat (to move to a new Mac) sends the same two pieces of information. This happens once per Mac at activation, and again only if you deactivate. After activation, the app never calls home again to check the license, it stays unlocked offline.
3. Optional street-detail map layer
The world map is bundled inside the app and works offline. Only the optional "Street detail (online)" layer loads map tiles from a map provider when you zoom in close, which reveals the map area you are viewing to that provider. You can switch it off in the corner of the map. No photo, filename or anything else about your archive is included in the request.
Family Circle (optional)
Family Circle is an optional $49/year feature for sharing with relatives. It is off unless you turn it on. When it is on, the app sends end-to-end encrypted data to the relatives you choose to share with. Nothing is shared without it.
Apple Watch albums
The Apple Watch auto-syncing album option creates an album in your own Apple Photos library, which your own iCloud Photos account then syncs to your iPhone. That transfer is between your devices and Apple, not through us. The shareable watch face file is a file you send yourself.
This website
The website at allouryears.com uses Google Analytics to count visits and clicks on download links. The app itself contains no analytics. Google Analytics may set cookies and records standard information such as pages visited and approximate location. You can block it with your browser's settings or a content blocker.
Mac App Store version
If you get the app from the Mac App Store, Apple handles the purchase and the in-app unlock under Apple's own privacy policy. The app is otherwise the same.
Crash diagnostics
If All Our Years crashes, macOS may ask whether to send a diagnostic report, the same system prompt any Mac app can trigger. This is entirely opt-in and controlled by your macOS privacy settings, not by All Our Years. Reports stay on your Mac unless you choose to send them, and we only ever see one if you email it to us yourself.
Payments
All purchases are handled entirely by Polar, our merchant of record. We never see or store your card details. Polar's own privacy policy governs the checkout process, including whatever billing information they collect to process your payment.
Your photo drive
All Our Years opens your photo drive strictly read-only. It never writes to it, uploads from it, or sends any part of it anywhere, on any of the network requests above or otherwise.
Changes to this policy
If this policy changes, we'll update the date at the top of this page. Meaningful changes (anything that adds a new kind of network activity) will also be called out in the release notes for the version that introduces them.
Contact
Questions about any of this: support@allouryears.com.