What Portman2 does with your data

Do my photographs leave this machine?

Not by anything Portman2 does on its own. It reads the folders you point it at and leaves the files where they are; its catalogue, its thumbnails and the untouched original of anything you edit go into a cache folder of its own, on your disk. There is no account, nothing to sign into, and no service behind the application for a photograph to be uploaded to.

There are two ways a photograph can go somewhere, and both are switches you turn on yourself. The application's own web server can serve a library to the other devices on your network — see below, because it is worth understanding before you switch it on. And album synchronising can copy album membership to a QuMagie installation on a NAS whose address you type in yourself. Neither does anything until you ask it to, and neither involves this website or anybody who runs it.

What Portman2 sends to portmanphoto.com, and when

Three things, and they are different from each other in ways that matter, so they are listed separately rather than summarised.

1. The usage report — only if you said it may

The installer asks, once, whether this copy may say that it exists. The question is unticked when you meet it: leaving it that way is a complete answer, nothing is sent, and you are not asked again by the next release. If you allow it, this is the whole of what is sent:

• a random number generated on your machine, which identifies this installation and nothing about you — 128 random bits, never worked out from your computer's name or its network card
• the version of Portman2 that is running
• what Windows calls itself, as one line of text
• whether this is the first run after installing, or one of the daily checks

When it is sent, what is kept, and how to stop it

Once when you first run a newly installed version, and then at most once a day while you use it. Nothing is sent during the installation itself.

What the server keeps is one row per machine per day: which release, that random number, the line of text Windows calls itself, and whether it was the first run or a daily check. There is nowhere on that row for a network address and none is stored — the only place an address exists is in the request limiter's memory, for a few minutes, and it is written nowhere.

To stop it: Settings, then Privacy, and turn off "Let this copy say that it exists". That stops the reports rather than hiding the switch, and it throws the random number away, so turning it back on later is a new installation as far as the server is concerned. It is also the answer to "how do I say no" — you do not have to write to anybody.

A copy that was not put there by the installer — a build run out of a folder — has no answer stored beside it, sends nothing, and cannot be made to.

2. The version check — at every launch and once a day, and not covered by that switch

An installed copy asks this server whether there is a newer build: when it starts, and then once a day for as long as it is left open. It sends the platform, the release channel and the version it is running, in a web address. There is no identifier in it, no random number, and no body.

It is deliberately not behind the consent switch, and the reason is worth stating rather than leaving as a surprise: being told that the copy you are running has been superseded is not a report about you, and a person who declined to be counted should still hear that a fix exists. If it were folded into the same question, an unavoidable call would have become a reportable event.

What the server keeps of it is one line in its request log: the time, the path, the method, the answer's status code, and the query — so the log records that some copy of a particular version asked, and when. No address, no identifier, and nothing that ties two of those lines together as the same machine.

3. Downloading the installer — counted, and identifying nobody

Fetching the installer adds one row saying which build was fetched and when. There is a column on that row for an installation's random number and it is deliberately left empty, which is exactly what makes a download count different from the usage report: it needs no consent question in front of it, because there is nothing on the row to consent about.

No address is stored for a download either. As with any web server, the machine answering a request can see where it came from while it answers it; what Portman2's own tables record is above, and an address is not in any of them.

What is never sent

None of the three calls above carries any of the following, and there is nowhere on the server to put them:

• your name, your email address, or any account — there is no account
• the name of your computer, or the name you log in as
• any folder name, any file name, or any part of a path
• any photograph, any thumbnail, and any part of either
• how many photographs you have, how large your library is, or what is in it
• anything about your hardware beyond the one line Windows calls itself
• your network address, which is stored on none of the rows described above

Crash records stay on your disk

When Portman2 falls over, or a window stops answering, it writes a record of it into a folder inside its own cache: what happened, where in the code, which version, and what Windows calls itself. Anything in it that looks like a password or a key in a web address is replaced before it is written. The newest twenty are kept and each one is cut off if it grows past 64 KiB.

Nothing in Portman2 sends them. They are files on your own disk, which you can read, and delete, and which no part of the application uploads. This server does have somewhere to receive such a report, built and waiting, and no copy of Portman2 has ever posted to it — the half that would gather a report and ask you whether to send it is not written. If a report ever were sent, what the server would keep of it is settled and enforced by something that runs: the report itself is deleted after 180 days, and the thin row beside it — a version, a stack fingerprint and the dates — is kept, because the file is the part that can carry a household's folder names in it and the row cannot.

The library on the other screens in the house

Portman2 has a small web server of its own, so a phone or a laptop on the same network can browse a library in a browser. Nothing about it involves this website: the connection is from the other device straight to your own machine, and the photographs never travel further than your own network.

It is off until you switch it on, and then on per library — a library whose own switch is off is neither listed nor opened. What it is worth knowing before you switch it on is what it does not do:

• it listens on every network the machine is attached to, not a chosen one
• an access code is available and is off by default, so until you set one, anybody who can reach that machine on that port can browse the served libraries — and can make albums, fill them, and move photographs to the library's trash
• the connection is ordinary HTTP and is not encrypted, which is why this is a feature for a network you trust rather than one you share
• there is no pairing step and nobody is invited: you type the machine's name and a port number into the browser on the phone, and that is the whole of the setup

Other people's servers, and when Portman2 talks to them

Two, and only when you ask for the feature that needs them. Both are ordinary file downloads over the public internet, so the machine at the other end sees the request the way any web server would; nothing about your library is in either one.

• GitHub, to fetch the video tools when you choose to install them, and to fetch the object-detection model files the first time you turn detection on. Each downloaded file is checked against a known checksum before it is used.
• the QuMagie installation on your own NAS, at an address you type in yourself, if you switch album synchronising on.

Machine learning, exactly

There is no generative AI in Portman2 — nothing invents part of a photograph, and there is no button that says enhance. There is no face recognition and nothing that groups or names people.

What there is: a detector that can work out what the subject of a photograph is, so that selecting it is one click. It runs on your own machine, on your own graphics card, on a model file downloaded once from GitHub as above. No photograph, and nothing derived from one, is sent anywhere for it — the part of the application that does the detecting makes no network connection of any kind.

This website

It sets no cookies. Not analytics cookies, not preference cookies, not any: there is nothing on these pages to remember about you and nothing that remembers it. That is also why there is no banner asking you to accept anything — a banner would be asking permission for something that is not happening.

There is no analytics of any kind, no tag manager, no embedded video, no social buttons and no advertising. Nothing on any of these pages is fetched from another company's server — the stylesheet comes from this server and no typeface is requested from anywhere at all — and the pages carry no JavaScript, so they read correctly with scripting switched off entirely.

The only thing this site records about a visit is described above under the installer download. Reading these pages writes nothing.

How to say no

The usage report is the only thing that asks, and turning it off is one switch: Settings, then Privacy, then "Let this copy say that it exists". It takes effect immediately, and the random number that identified the installation is thrown away rather than kept in case you change your mind.

Declining in the installer has the same effect and is the same answer stored in the same place, which is why an upgrade does not ask you again.

The version check cannot be turned off, and the reason it is not behind that switch is above. If you would rather your machine did not make it, it is an outbound connection to this one hostname and your own firewall is the place to refuse it; refusing it costs nothing but being told about a newer build.