Privacy and network activity

Applies to: Photo Date Rescue for Windows, version 3.0.11. Last verified: 17 September 2026. Every statement on this page was checked against the shipping 3.0.11 build. If you are on an older or newer version, the behavior may differ — check What’s new for changes.

This page is the reference we cite from our comparison table. Each capability below has its own permanent link, so a claim about PDR can always be traced to the paragraph that supports it. Where the answer is “no” or “only partly”, this page says so in the same words the comparison uses.

PDR is sold on the promise that your photos never leave your computer. That promise is true, and this page exists to prove it rather than repeat it. Below is every connection the shipping 3.0.11 build makes to the outside world, where each one goes, and exactly what each one carries.

It is worth being blunt about the shape of the answer before you read the detail. Your photographs, your videos, your library, your filenames and your folder paths are not transmitted anywhere by PDR, and there is no code in the product that would do it. But PDR is not an offline application, and we will not describe it as one. A license key is required, the first activation needs a working internet connection, and there are five other occasions when PDR talks to a server. All five are listed here.

---

At a glance

---

What never leaves your computer

Your pictures, and everything PDR learns about them. Reading photos, working out dates, detecting faces, matching people, tagging subjects, transcribing speech in videos, turning coordinates into place names, building collages and writing the corrected copies are all done by your own processor on your own disks. There is no upload step in any of them, no cloud processing tier, no rendering service and no PDR-hosted storage. This is not a setting you switch on; there is nothing to switch, because there is no upload to disable.

Specifically, none of the following is ever transmitted:

• Photos and videos. No image or video content is sent anywhere, in any form, including thumbnails and previews.
• Your library. Corrected dates, people and face names, face measurements, places, albums, collages, carousels, family trees, captions and video transcripts stay in the database on your machine.
• Filenames, folder names and file paths. None of them appear in any message PDR sends.
• Your location history. Turning GPS coordinates into a country and a city is done against a place-name database shipped inside PDR. Your coordinates are not sent to a lookup service.
• Anything about how you use the app. See analytics, telemetry and crash reporting.

Limitations

• “Never uploaded” is not the same as “never online”. PDR makes the connections described in the rest of this page. They carry a license key, a machine identifier, a file count and version numbers. They do not carry anything about your photos.
• What you do with a photo after PDR is your own affair, and outside this promise. Dragging a photo into a browser, saving it into a synced OneDrive or Google Drive folder, or pointing a Fix at a synced folder will hand that file to whatever service owns that folder. That is the other program doing the work, not PDR, but the effect on your privacy is the same.
• PDR does not encrypt what it writes. Your photos, your library database, your logs and your reports are ordinary files. Anyone who can read the disk or the network share they sit on can read them. Windows permissions are what protect them.

---

License checks with our payment provider

This is the connection that stops PDR being an offline application. PDR has no account and no sign-in, but it does have a license key, and that key is checked against Lemon Squeezy, the payment provider that sold it to you. There are three moments when it happens:

• When you activate a key on this PC. This is the one that cannot be avoided — a first activation needs a working connection.
• When you refresh a license by hand.
• When you remove a license from this PC.

Starting PDR is not one of them. On an ordinary launch PDR reads the answer it already has — a small license record on your own disk, holding the result of the last successful check and the date it happened — and decides from that whether you are still inside the seven-day window below. It does not contact anybody. You can watch this for yourself: pull your network cable out and start PDR, and it opens normally.

What travels is your license key and an identifier for this device. The device identifier is a one-way hash of a machine ID, cut to 32 characters — not a hardware serial number, not your Windows account, and not anything that can be turned back into either. No email address, no file information and no photo information goes with it. Every one of these calls is given a hard time limit, so a slow or unreachable service cannot leave PDR hanging: five seconds for a re-check, eight for an activation or a removal.

Limitations

• The license key itself is what travels, not a hash of it. It has to be — the service has to recognize the key you bought. What is kept as a one-way fingerprint rather than in the clear is a different thing: PDR’s own license file on your PC, and the ownership marker written onto a Library Drive, both store a fingerprint of the key rather than the key.
• Your key is kept on this PC, in readable form. PDR stores it so it does not have to ask you for it again every time it needs to talk to the service. It is on your own disk, and it is removed when you deactivate — but it is stored as text, not encrypted, so anyone who can read your Windows user account’s files can read your license key. It is stored once for the installation rather than once per profile — that is what lets one license cover all three without burning three device slots, and it also means switching profile does not put the key out of anyone’s reach.
• Your license email is known to us, because you bought something. The provider records the email your key was sent to, and PDR keeps a copy of it locally so the license panel can show you which purchase this key belongs to. That is a receipt, not an account.
• PDR keeps working for seven days without reaching the service. After a successful check you can be offline for a week before the license is treated as expired. A lifetime license skips the check entirely. See working offline, and the seven-day grace.

---

The free-trial file counter

Free trials only. One of the trial allowances — the number of photos and videos you have fixed — is counted on a small service we run at updates.photodaterescue.com rather than on your PC, so that reinstalling does not reset it. Before a Fix run starts, PDR asks the service how many files you have already used. After the run, it tells the service how many more you just used.

The message contains your license key and a number. That is the whole message. No filenames, no folder paths, no dates, no photo information, no device details. The service stores the count against a one-way hash of your key, so the key itself is not kept there. The request is given a four-second time limit.

A paid license sends nothing here at all. Paid plans are uncapped, so there is no count to keep, and this connection never happens.

Corrected 17 September 2026. This page used to say a free-trial Fix could not run offline, and that an unreachable counter meant a refused run. The product has always done the reverse: if the count does not come back inside the four seconds, the run goes ahead and is not counted. We have corrected the bullet below rather than leave a restriction on this page that PDR does not impose.

Limitations

• A free-trial Fix reaches for this service before every run, but does not depend on it. If PDR cannot reach the counter the run goes ahead, uncounted, rather than being refused. So the allowance is a fair-use limit rather than a hard wall, and the offline promise is weaker on a trial rather than absent. See running with no account and running a trial Fix with no connection.
• Only the file count is on the server. The other eight trial allowances are counted in the database on this PC, which is also why a free trial is held to a single profile: each profile has its own database, so a second one would hand you a second set of those eight. Extra profiles come with a paid plan, and a paid plan has no allowances to multiply. See what the free trial allows.
• The key travels in the clear to this service, as it does to the payment provider. It is hashed for storage at the far end, not for transmission.

---

The license panel’s device and subscription screens

Opening these screens sends your license key to a server we run. The license panel has screens for the devices your key is activated on and for the state of your subscription. They are not answered by your PC. Each time you open one, PDR posts your license key to our own service at updates.photodaterescue.com and shows you what comes back. Removing a device sends your key and the identifier of the device being removed, after you have retyped your key to confirm.

We list this separately from the trial counter because it is a different message to the same host, it happens on a paid license as well as a trial, and it is worth knowing that opening a settings screen is a network action. As everywhere else on this page, the message carries your key and device identifiers and nothing about your photos.

The same screens are where a subscription is cancelled or resumed, where an offer to stay is accepted, and where an upgrade to a lifetime license is started. Each of those is another message to the same service carrying the same key. We mention them by name because they are the ones that change what you are paying, and because it should be clear that the button is a request to us rather than something your PC settles by itself.

Limitations

• These screens need a connection. What they show is what the service reports, not something this PC worked out, so with no network there is nothing to show.
• Removing a device is a request to us, not a local change. It asks the service to free the slot. It does not reach out to the other computer, and it does not delete anything on it.
• Your key is retyped in full to confirm a device change. That is a deliberate check that the person making the change is the license holder, and it means your key is on screen at that moment. Do not do it on a shared screen.

---

Checking for updates, and downloading them

PDR checks for a newer version on its own, and downloads one without asking. Ten seconds after the window appears, and then once every four hours while PDR is open, it asks updates.photodaterescue.com for the current version file. The request carries a version number. It does not carry your license key, your machine identifier or anything about your library.

If a newer version exists, the download starts immediately in the background. You are not asked first. When it finishes you get a notice offering to restart and apply it, and if you choose not to, it is applied silently the next time you close PDR. We would rather you knew that than discovered it, so it is stated here plainly and repeated on how updates arrive.

Limitations

• There is no switch to turn the update check off. No setting disables it, no setting changes the four-hour interval, and no setting turns the automatic download back into a prompt. If you need PDR not to reach the network, the only lever is your firewall.
• An automatic download uses your connection without warning. On a metered or slow connection, a release can start downloading while you are working. You are told when it has finished, not when it has started.
• The check happens whether or not you are licensed. It is not tied to your plan and it is not tied to a trial.

---

Optional AI model downloads

Downloads to you, never uploads from you. PDR’s AI features are switched off until you turn them on. When you do, the model file each one needs is fetched once and kept on your disk. From then on that feature works with no network at all, and your photographs are never sent anywhere to be analyzed — the model runs on your processor, against files that never move.

These are the models, and where each is fetched from:

Face detection and face matching are the exception: those models are shipped inside PDR and are loaded from your own disk, so they never involve a download at all.

Limitations

• The download is a request to a third party, and they see it. Hugging Face and GitHub are ordinary file hosts. They see a request for a file from your internet connection, as any download does. They are not told who you are, they receive nothing about your photos, and PDR sends them no license key.
• The subject tagging figure was wrong until 3.0.11, and wrong by more than half. Four screens inside PDR — the offer card, the AI tab in Search & Discovery and two places in Settings — called this download “~300 MB”. It is 605,799,029 bytes, which is 577.73 MB. All four quote the measured size in 3.0.11, and so does the progress card you now see while it runs, so nothing in PDR and nothing on this page disagrees about it any more. On a metered connection, 577.73 MB is the figure to decide on.
• The captions model is much bigger than PDR’s own dialog claims. The confirmation box says about 150 MB; the real figure is around 700 MB. That is a known defect, still present in 3.0.11, and it matters most if you are on a metered connection. Every download shows a progress bar and none starts until you press the button that needs it.
• Face restoration and photo upscaling are not on this list, and this page has been wrong about them twice today. The first version said they were never fetched. We then corrected that to say Settings has an install card for each, which was worse: the Photo Enhancement cards are part of the Viewer feature that is switched off in 3.0.11, so they are not on the screen and a shipping build cannot download either file. They are off the table above because in this version they genuinely never leave Hugging Face. Corrected 17 September 2026.
• You can delete what has been fetched. Removing an installed model puts that feature back to needing a download next time. The AI features can also simply be left off, which is how PDR arrives.

---

Reading a page aloud, and where the voice comes from

The voice is Windows’, not ours, and almost every one of them speaks on your own computer. From 3.0.11 PDR’s five long information pages have a Listen player. It hands the text of the page you are looking at to the speech engine already built into Windows. PDR runs no speech service, has no voice of its own, and sends nothing to us: there is no PDR server in this feature at all.

Windows itself is the part that can go online. Most Windows voices are installed on the machine and speak with no connection whatsoever. Windows can also offer voices that it synthesizes over the internet, and if you pick one of those, the text of that page goes from Windows to Microsoft — not from PDR, and not to us, but it leaves your computer all the same. PDR says so on the player while such a voice is selected, in as many words, rather than leaving you to work it out. Choose any other voice and nothing leaves.

Limitations

• What is read is PDR’s own writing, never your library. The five pages are About PDR, Getting Started, Best Practices, What Happens Next and the Quick Tour. No photograph, filename, folder path, caption, person’s name or date from your own library is read aloud or handed to the speech engine, because no page that shows those has a player on it.
• An online voice is Windows’ arrangement with Microsoft, and their privacy terms govern it, not ours. We can tell you it is happening and we do. We cannot tell you what Microsoft retains.
• PDR cannot install, remove or update a voice. The list is whatever your copy of Windows has. Which voices exist, and whether any of them are the online kind, is decided in Windows’ own Speech settings.
• Nothing is recorded. There is no microphone use anywhere in this feature and no audio file is written to disk. The only things stored are your chosen voice, speed, highlighting preference and where you dragged the player to, in PDR’s own settings on this machine.

---

Send to Phone, and the server it opens

Your photos go to your phone across your own wi-fi, not through anybody’s service. Send to Phone starts a small web server on this PC and shows you a QR code. Your phone, on the same network, scans it and pulls the files straight off the machine. There is no account, no upload and no intermediary. This is the one feature in PDR that listens for incoming connections, so it deserves to be described exactly.

What it does

• The server takes whatever port Windows hands it at the moment you start the share, and it accepts connections on every network the PC is attached to. The address in the QR code is this machine’s own address on your wi-fi.
• The address in the QR code contains a 128-bit random token. Without that token every address on the server returns “not found”, so another device on the same wi-fi cannot reach your files by guessing.
• Only the files in that one share are reachable, and each is addressed by a random identifier rather than by its path. A request cannot ask for any other file on your disk.
• The share stops after fifteen minutes, and stops immediately when you close the window. One share at a time.

Limitations

• Anyone on that network who has the link can download those files. The token protects you from guessing, not from sharing. Treat the QR code as the key it is, and do not start a share on a network you do not trust.
• The connection is plain HTTP, not HTTPS. Someone able to watch traffic on that network could see the photos in transit. On a home wi-fi that is a narrow risk; on a hotel or café network it is not.
• Up to 200 files in one share. Beyond that, split it.

---

Sending a problem report to support

Nothing is sent unless you send it. PDR has no crash reporter and no automatic diagnostics. When you report a problem, PDR writes a diagnostic file into your Documents folder, opens your own mail app with a message already written, and shows you the file so you can attach it. You read it, you decide, and you press send. If you close the mail window, nothing has left your machine.

That message is not empty, and you should know what is in it before you send it. It carries your description, your app version, your Windows version, your processor and memory, your license status and the email your license was sold to, and the last two hundred lines of PDR’s log. Those log lines routinely contain the full paths of files and folders you have been working with. See what PDR writes to your own disk for what that means, and what the diagnostic contains for the full list.

Limitations

• PDR cannot attach the file for you. Opening a pre-written email is as far as it goes; you drag the diagnostic in yourself. That is a limitation of how mail links work, and it is also the reason nothing can be sent without you seeing it.
• Delivery is your mail app’s business, not PDR’s. Whatever mail service you use handles the message from that point, under its own privacy terms.
• Edit the message if you would rather not send part of it. It is a normal email in your normal mail app before it is sent. Deleting the log section still leaves us your description and your system details.

---

What PDR writes to your own disk, and what it reveals

These files stay on your machine, and they are not private from anyone using it. Nothing here is transmitted. But “local” is not the same as “invisible”, and four of the things PDR writes contain more about you than people expect.

• The activity log records what PDR did, and it names files and folders in full as it goes. Anyone who opens it can see where your photos live and what they are called.
• Fix reports and the catalog written at your destination list the files in a run, with original names, new names and locations. They are readable in any text editor or spreadsheet.
• A subtitle file beside any video you caption. Transcribe holiday.mp4 and PDR silently writes holiday.vtt into the same folder, containing everything that was said. It is plain text, it sits in your own folders rather than PDR’s, and PDR does not tell you it is there. See captions for a home video.
• A diagnostic file, created only when you report a problem, bundles the log and a system-information summary that includes your license status and your license email. It is written into your Documents folder and it is left there afterwards.

Limitations

• None of it is encrypted, and none of it is hidden. Another person with an account on this PC, or with access to a backup of it, can read all of it.
• Old diagnostics are not cleaned up. Each report writes a new, separately named file into Documents and PDR never deletes them. Delete them yourself when you no longer need them.
• Settings › Privacy & Security is about what is on screen, not what is on disk. Its switches hide captions and video transcripts from view. They do not remove anything, and they have no effect on the network.
• The ownership marker on a Library Drive is a check, not a lock. Reconnecting a library needs the same license key that set it up, which stops somebody else’s copy of PDR opening your library. The photos on that drive are ordinary files and anyone holding it can still open them. See where your files are stored, and who can reach them.

---

Analytics, telemetry and crash reporting

There are none. The shipping build contains no analytics package, no usage tracker, no product-metrics library, no advertising identifier, no session recorder, no A/B testing service and no crash reporter that sends anything anywhere. We do not know how many photos you have fixed, which features you use, how long you keep the app open or whether you ever opened a particular screen. Not because we switched the reporting off, but because it was never built.

The word “telemetry” does appear inside PDR, describing the timings it records while converting files. Those timings are written to a file on your disk next to the run they came from, and that is where they stop.

Limitations

• Windows is still Windows. The operating system’s own reporting is outside PDR’s control and is governed by your Windows privacy settings, not by ours.
• The connections on this page are still connections. Our servers receive requests, and a request necessarily reveals that a machine at your internet address asked for something. That is unavoidable for a license check and an update check; it is not analytics, but it is not nothing either.
• The absence is not enforced by a setting. There is no “disable telemetry” switch in PDR, because there is nothing for it to switch. If a future release ever added reporting, this page and the comparison table would change together and the “last verified” date above would move with them.

---

Known gaps in 3.0.11

Collected in one place, because these are the things a reader choosing a private photo tool most needs to know, and because the same ones appear against PDR on our comparison page:

1. PDR is not usable with no online step at all. A license key is required and the first activation needs the internet. There is no account and no sign-in, and your photos never leave — but the promise is “nothing uploaded”, not “never connects”. See license checks.
2. A free trial makes one network request a paid license does not. The file allowance is counted on our side, so a trial asks for the count before each run. The run is not blocked when that request fails, but it is still a connection a paid copy never makes. See the free-trial file counter.
3. Updates download without asking, and there is no way to stop them. No setting disables the check, changes its interval, or turns the automatic download back into a prompt. See checking for updates.
4. Logs, reports and diagnostics disclose your file paths, and diagnostics disclose your license email. They stay on your disk, unencrypted, until you delete them. See what PDR writes to your own disk.
5. Send to Phone serves over plain HTTP. Safe enough on a home network, not something to start on a public one. See Send to Phone.

Our full privacy policy governs anything not covered here.

---

How to check this page is still true

Every claim here describes behavior you can observe in the shipping build. If something on this page does not match what PDR does on your machine, that is a defect in one of the two, and we want to know: contact support. Tell us the anchor — for example /help/privacy-network#summary — and we will either correct the software or correct the page.