What you’re actually granting
When an app asks for your photos, iOS offers levels — and most people tap through the prompt without noticing there was a choice. You can see and change them any time in Settings › Privacy & Security › Photos.
| Level | What the app can do |
|---|---|
| None | Nothing. It can’t see your library at all. |
| Add Photos Only | Save new photos into your library, but never read it. |
| Limited Access | See only the specific photos you hand it, and nothing else. |
| Full Access | Read the entire library — every photo and video, plus the metadata attached to each one. |
“Plus the metadata” is the part worth pausing on. A photo carries more than an image: the date and time, often the GPS coordinates of where it was taken, the device, and the faces iOS has grouped. Full access to a photo library is a detailed record of where someone has been and who with — more revealing than most people’s messages.
That isn’t an argument against ever granting it. A tool that finds duplicates across your whole roll can’t work on a handful of photos you pick by hand; the categories it exists to find are defined by the library as a whole. It’s an argument for granting it deliberately, to a small number of apps, having checked them.
What iOS enforces, whatever the app claims
Two protections are built into the system rather than promised by the developer, and they’re the reason this category is safer than its reputation.
An app cannot delete your photos on its own. When any app asks to remove photos, iOS itself puts up the confirmation — a system alert naming how many items are about to go. The app can’t draw that alert, skip it, or answer it for you. So no cleaner, however aggressive its design, can quietly empty your library while you’re tapping through a tutorial.
Deletes go to Recently Deleted regardless. Photos removed by an app land in Photos › Albums › Recently Deleted exactly as they would if you deleted them in the Photos app, recoverable for 30 days. There is no way for a third-party app to permanently erase your photos in one step. Any app claiming it “securely wipes” your library is describing something iOS won’t let it do.
Together those mean the worst realistic accident — a bad suggestion you confirmed too quickly — is recoverable for a month. That’s worth knowing before you decide how nervous to be.
What iOS does not guarantee
One thing the system can’t promise you: that an app with full access won’t copy your photos to a server. Once an app can read the library, sending what it reads is an ordinary network request. Some cleaners genuinely need it — anything doing “AI” analysis in the cloud does — and some do it for reasons they don’t explain.
So check, don’t trust. Three ways, in order of effort:
- Read the App Store privacy card. On the listing, scroll to App Privacy. It’s declared by the developer, but it’s declared to Apple and it’s specific: “Data Not Collected” is a meaningful claim, and an app listing your photos or user content as collected has told you what it does.
- Try it in Airplane Mode. Turn the network off entirely and use the app. If a cleaner scans and sorts normally with no connection, it isn’t sending your library anywhere to do that work. It isn’t proof — an app could queue uploads for later — but an app that can’t function offline is certainly talking to a server.
- Watch what it asks for. A photo cleaner needs photo access. If it also wants contacts, location or an account with your email before it will do anything, ask why. An on-device tool has no reason to know who you are.
Check what your apps can see right now
Whatever you install next, this two-minute audit is worth doing today. Open Settings › Privacy & Security › Photos and you’ll see every app that has ever asked, with its current level. Anything you no longer use can be set to None on the spot; anything that only ever needed to save a picture can drop to Add Photos Only.
Going the other way, Limited Access is a good way to try an unfamiliar app — hand it thirty photos and see how it behaves before granting more. It does mean a cleaner can only work on what you’ve selected, so it’s a trial mode rather than a permanent setting for this kind of tool.
While you’re there, Settings › [your name] › Subscriptions is the other list worth a monthly glance. Which brings us to the risk that’s usually larger than the privacy one.
The risk that’s actually more common: the bill
In practice, far more people are harmed by a photo cleaner’s pricing than by its data handling — the three-day trial that converts to a weekly subscription, the paywall that appears only after a scan has told you how bad things are. Every price and billing period is listed on the App Store listing under In-App Purchases before you install, which is the number to trust rather than the one on the in-app screen. We’ve written that up separately in what to look for in a free photo cleaner.
Five checks before you install one
- Does it say where the work happens? On-device or in the cloud — a private tool says so plainly and can prove it in Airplane Mode.
- Does it need an account? An on-device cleaner has no reason to require a sign-up.
- What does the App Privacy card declare? Check it on the listing, not in the app’s marketing.
- What does it cost, on the listing? Read In-App Purchases before installing, not the paywall after.
- Are its deletes reversible? They should go to Recently Deleted, recoverable for 30 days — and iOS should be the one asking you to confirm.
Kept, against the same list
This guide is published by Kept, so measure it with the checks above rather than taking our word for it. Kept’s finding and sorting — including the face matching behind Clean by person — run entirely on your iPhone. There is no account and no login. No photo is uploaded; the only thing Kept sends is anonymous, optional usage statistics you can switch off. If your library is optimized to iCloud, originals download from Apple before they’re examined — that traffic is Apple’s own, not ours.
Deleting works exactly as described above: you confirm, iOS shows its own confirmation, and the photos go to Recently Deleted where they’re recoverable for 30 days. Kept never keeps a copy of anything. Cleaning by hand is free — up to 100 photos a day, every day. Pro is optional: it does the finding and sorting for you, with the price shown on the App Store before you pay. You can check every one of those claims with Airplane Mode and the App Store listing — which is the point of the list.