Your photos. Your hardware. No surprises.
DPFAS (Differentiate Pictures For Auto-Sync) is an early-stage project asking one question: can photo sorting, search and sharing work without handing your pictures, or the metadata about your life, to a cloud provider? We are building the answer in the open, and we want your view on the hard parts.
The problem
Cloud services now count every photo against a paid quota, so keeping your own memories becomes a subscription. They also hold the metadata: who is in your pictures, where, and when. And "private" is whatever the provider says it is this year. We think your privacy should depend on the strength of your own password, not on a provider's policy.
Three principles, and how each is met
Privacy
- Analysis happens on your devices. Faces, private content and seasons are detected on your phone, or on your own server. Photos are never sent to a cloud AI service.
- Closed by default. No telemetry, no cloud APIs, no third-party sign-in. Pilot users may opt in to share usage signals, and only then.
- Faces are biometric data. Under GDPR they need special care. Our reading of European Data Protection Board guidance is that storage is only compatible when the data subject holds the key, so that is what we design for.
- Sensitive pictures stay apart. Pictures detected as private are tagged on the device and kept in a separate view behind an unlock. App data is excluded from Android's automatic cloud backup.
- Sharing is per photo and per person. The owner sets the terms; nothing is shared by default. Designed, not yet built.
Self-hosted
- A small server program runs at home. Python and Postgres in Docker, on a NAS, a spare PC or, later, a Raspberry Pi-class device. It is kept resource-light on purpose.
- The phone finds it by itself. On your Wi-Fi it connects to your server without an account. Away from home it will use an encrypted WireGuard tunnel, not a public web address.
- No server required to start. The app is useful on its own; the server adds backup and a bigger screen.
- Your files stay yours. Originals remain ordinary image files on your disk; metadata lives in an open database. We use open standards such as CalDAV and CardDAV for contacts and require no second app.
- No store gatekeeper. The Android app is installed as an APK, not through Google Play.
No surprise costs
- Storage is your own disk. There is no quota to fill and no price rise on your memories. You pay for the hardware you choose and its electricity, visibly and once.
- No account with us. Nothing to cancel, throttle or lock, and we cannot hold your data hostage because we do not hold it.
- Prices are stated before you commit. Pricing is undecided; the rule is that any price is shown up front and never triggered by a usage threshold. Any future paid service, such as rented storage, shows its full price before you opt in.
- No licensing traps. By policy the project depends only on MIT or Apache-2.0 licensed components. The project's own licence is not chosen yet; the intent is free and open-source software.
- Self-hosting has real costs too. Hardware and setup time are not free. We count them as costs and work to shrink them.
Two more that guide every feature
- You decide. Sorting, deleting, syncing and sharing are suggestions you confirm, never silent defaults.
- Intuitive and motivated. The app explains why it asks, so tagging feels like rediscovering your photos, not a chore.
Questions we want to discuss
We do not consider these solved. Tell us where we are wrong; each link opens an email to us.
- Who owns a photo of ten people, and who may share it? The photographer, the subjects and the uploader all have a claim. We are testing owner-set terms. Discuss
- Can you search for a person without a central database of faces? Finding someone across photos is useful and sensitive. Discuss
- How can an event accept pictures from strangers without becoming responsible for what they upload? Open, and partly a legal question. Discuss
- Can lending your spare disk to others be safe, fair and reliable enough to replace the cloud? Encrypted storage swapped between people you choose is an idea, not yet a design. Discuss
- What may software learn about you to be helpful, and who should see it? Learning your habits makes it better and is also what privacy forbids. Discuss
- Should an AI suggest what you delete? Freeing space is useful; forgetting is permanent. We insist you approve every deletion. Discuss
What it does
- Finds and sorts. Detected faces, private content and season become tags you can search and correct. Your corrections teach it your preferences.
- Finds people. Search for one person across photos and, later, video clips.
- Syncs automatically. Phone and home server keep each other up to date in the background.
- Shares with control. Event albums that guests join with a QR code, with the best pictures curated into one album.
- Helps you clean up. It suggests near-duplicates and poor shots to remove; you approve each one.
Status
Built by one developer. There is no public release yet.
| Stage | What |
|---|---|
| Working prototype | Android app: photo browser, fullscreen swipe and zoom, on-device face, private-content and season detection, tag screens and search, first-run setup. |
| Prototype | Home server with a web interface; phone and server find each other on the home network. |
| In development | Two-way phone-to-server sync; correction screens; background batch processing. |
| Designed, not built | Sharing terms and event albums; secure access away from home; person search in video. |
| Research | Shared storage network; rented storage paid by lent disk space. |
Android only for now; iOS is kept in mind but not planned. "DPFAS" is a working title and may change.
How it differs from Immich, Syncthing and ownCloud
These are mature, widely used projects; DPFAS is an early prototype. The difference is in the approach, not maturity.
| Project | What it is | DPFAS difference |
|---|---|---|
| Immich | Self-hosted photo library with server-side machine learning, shared albums and partner sharing. | Phone-first: detection runs on the phone, and a user without a server is fully supported. Per-photo ownership terms instead of album-level sharing. Learns each household's own corrections. |
| Syncthing | Continuous folder sync between devices, with no server and no knowledge of what the files contain. | Understands the pictures. Sync is selective by tag, person or photo, and it helps you decide what to delete. |
| ownCloud and Nextcloud | General self-hosted file sync and sharing platforms. | Purpose-built for photos and video: curation and rediscovery of forgotten pictures, not generic file storage. |
| Google Photos | Cloud service; the provider holds files and metadata and charges by quota. | You own both the files and the metadata, with no quota. |
Who it is for
- Private users and families: keep a lifetime of photos and find the people and moments in them.
- Photographers: cull and tag large shoots on the phone, keep ownership of originals, and control how each image is shared.
- Companies and municipalities: photo archives on hardware the organisation controls, with sharing rules and a GDPR-aligned design. Not yet offered; pilots are welcome.
- Event organisers: guests contribute through a QR code.
- Investors and partners: the principles above are the foundation; the Android app is the first thing that can be offered under them. Pricing is undecided. Write to us for the technical and business documentation.
Contribute
Help is welcome in Kotlin and Android, Python and FastAPI, Postgres with vector search, on-device ML models (ONNX), security review, GDPR expertise, translation and UX. Development is test-driven and every design decision is documented.
write to info@dpfas.eu to get started.
Try the Android app
Leave your email to be invited to the first test builds. We use it for that and nothing else.
What this site records
For each visit to this page we log the time, the page requested, the visitor's country and the browser's user-agent text, to count visits and see where interest comes from. The visit log holds no IP address. IP addresses are processed only transiently, to deliver the page and to rate-limit the login and sign-up forms, and are not written to the visit log or passed on to the site software. We set no cookies and load no third-party trackers. Logs are deleted after about 90 days. Country lookup uses IP geolocation by DB-IP.