PhotoFox Privacy Policy

Last updated: 13 October 2026

PhotoFox is a personal, self-hosted assistant operated for its owner's use. It helps the owner select media from Google Photos and, when explicitly requested, copy that media to the owner's Nextcloud at cloud.fox.co.nz.

Information PhotoFox accesses

With the owner's authorization, PhotoFox uses the Google Photos Picker API and the photospicker.mediaitems.readonly permission. It receives only the photos and videos the owner selects in Google's Picker, together with associated metadata such as filenames, media type, and capture time. PhotoFox does not enumerate the owner's Google Photos library or access unselected items.

PhotoFox also stores an OAuth refresh token so it can request short-lived access tokens for Picker sessions. The refresh token is kept as a private server-side credential and is not included in chat responses or application logs.

How information is used and shared

Selected media and metadata are used only to display a backup preview and, after the owner explicitly confirms a backup, transfer the selected media to the owner's configured Nextcloud account over HTTPS/WebDAV. PhotoFox does not sell or rent personal information, serve advertising, profile the owner, or use photos for analytics or model training.

Google processes authorization and Picker requests under Google's own privacy terms. The selected media is sent to the owner's Nextcloud service, where it is subject to that service's storage, backup, and administrator policies. Selection metadata returned in chat (such as filenames and capture dates) is processed by the OpenClaw model provider configured by the owner; photo and video bytes are not sent to that model provider by PhotoFox. PhotoFox does not intentionally share media with any other party.

Storage and retention

OAuth credentials are stored in access-restricted files on the self-hosted server. Active Picker selections and temporary media download URLs are held in service memory for up to one hour and are not intentionally persisted. PhotoFox does not retain a separate photo library. Files successfully uploaded to Nextcloud remain there until the owner deletes them using Nextcloud.

The owner can stop future access by revoking PhotoFox's authorization in their Google Account security settings and removing the local OAuth credential. The owner controls deletion of copies stored in Nextcloud.

Security and media limitations

PhotoFox uses HTTPS for Google and Nextcloud connections, limits its access to user-selected media, and requires explicit confirmation before uploading. No internet service can guarantee absolute security. Google's Picker download format may omit photo location metadata and may provide a transcoded video rendition.

Changes and contact

This policy may be updated if PhotoFox's handling of data changes. For privacy questions, use the support email shown on the PhotoFox Google authorization screen.