Privacy and network activity

Applies to: Photo Date Rescue for Windows, version 3.0.4. Last verified: 30 July 2026. Every statement on this page was checked against the shipping 3.0.4 build. If you are on an older or newer version, the behavior may differ — check What’s new for changes.

This page is the reference we cite from our comparison table. Each capability below has its own permanent link, so a claim about PDR can always be traced to the paragraph that supports it. Where the answer is “no” or “only partly”, this page says so in the same words the comparison uses.

PDR is sold on the promise that your photos never leave your computer. That promise is true, and this page exists to prove it rather than repeat it. Below is every connection the shipping 3.0.4 build makes to the outside world, where each one goes, and exactly what each one carries.

It is worth being blunt about the shape of the answer before you read the detail. Your photographs, your videos, your library, your filenames and your folder paths are not transmitted anywhere by PDR, and there is no code in the product that would do it. But PDR is not an offline application, and we will not describe it as one. A license key is required, the first activation needs a working internet connection, and there are five other occasions when PDR talks to a server. All five are listed here.

---

At a glance

---

What never leaves your computer

Your pictures, and everything PDR learns about them. Reading photos, working out dates, detecting faces, matching people, tagging subjects, transcribing speech in videos, turning coordinates into place names, building collages and writing the corrected copies are all done by your own processor on your own disks. There is no upload step in any of them, no cloud processing tier, no rendering service and no PDR-hosted storage. This is not a setting you switch on; there is nothing to switch, because there is no upload to disable.

Specifically, none of the following is ever transmitted:

• Photos and videos. No image or video content is sent anywhere, in any form, including thumbnails and previews.
• Your library. Corrected dates, people and face names, face measurements, places, albums, collages, carousels, family trees, captions and video transcripts stay in the database on your machine.
• Filenames, folder names and file paths. None of them appear in any message PDR sends.
• Your location history. Turning GPS coordinates into a country and a city is done against a place-name database shipped inside PDR. Your coordinates are not sent to a lookup service.
• Anything about how you use the app. See analytics, telemetry and crash reporting.

Limitations

• “Never uploaded” is not the same as “never online”. PDR makes the connections described in the rest of this page. They carry a license key, a machine identifier, a file count and version numbers. They do not carry anything about your photos.
• What you do with a photo after PDR is your own affair, and outside this promise. Dragging a photo into a browser, saving it into a synced OneDrive or Google Drive folder, or pointing a Fix at a synced folder will hand that file to whatever service owns that folder. That is the other program doing the work, not PDR, but the effect on your privacy is the same.
• PDR does not encrypt what it writes. Your photos, your library database, your logs and your reports are ordinary files. Anyone who can read the disk or the network share they sit on can read them. Windows permissions are what protect them.

---

License checks with our payment provider

This is the connection that stops PDR being an offline application. PDR has no account and no sign-in, but it does have a license key, and that key is checked against Lemon Squeezy, the payment provider that sold it to you. There are three moments when it happens:

• When you activate a key on this PC. This is the one that cannot be avoided — a first activation needs a working connection.
• When you refresh a license by hand.
• When you remove a license from this PC.

Starting PDR is not one of them. On an ordinary launch PDR reads the answer it already has — a small license record on your own disk, holding the result of the last successful check and the date it happened — and decides from that whether you are still inside the seven-day window below. It does not contact anybody. You can watch this for yourself: pull your network cable out and start PDR, and it opens normally.

What travels is your license key and an identifier for this device. The device identifier is a one-way hash of a machine ID, cut to 32 characters — not a hardware serial number, not your Windows account, and not anything that can be turned back into either. No email address, no file information and no photo information goes with it. Every one of these calls is given a hard time limit, so a slow or unreachable service cannot leave PDR hanging: five seconds for a re-check, eight for an activation or a removal.

Limitations

• The license key itself is what travels, not a hash of it. It has to be — the service has to recognize the key you bought. What is kept as a one-way fingerprint rather than in the clear is a different thing: PDR’s own license file on your PC, and the ownership marker written onto a Library Drive, both store a fingerprint of the key rather than the key.
• Your key is kept on this PC, in readable form. PDR stores it so it does not have to ask you for it again every time it needs to talk to the service. It is on your own disk, and it is removed when you deactivate — but it is stored as text, not encrypted, so anyone who can read your user profile can read your license key.
• Your license email is known to us, because you bought something. The provider records the email your key was sent to, and PDR keeps a copy of it locally so the license panel can show you which purchase this key belongs to. That is a receipt, not an account.
• PDR keeps working for seven days without reaching the service. After a successful check you can be offline for a week before the license is treated as expired. A lifetime license skips the check entirely. See working offline, and the seven-day grace.

---

The free-trial file counter

Free trials only. One of the trial allowances — the number of photos and videos you have fixed — is counted on a small service we run at updates.photodaterescue.com rather than on your PC, so that reinstalling does not reset it. Before a Fix run starts, PDR asks the service how many files you have already used. After the run, it tells the service how many more you just used.

The message contains your license key and a number. That is the whole message. No filenames, no folder paths, no dates, no photo information, no device details. The service stores the count against a one-way hash of your key, so the key itself is not kept there. The request is given a four-second time limit.

A paid license sends nothing here at all. Paid plans are uncapped, so there is no count to keep, and this connection never happens.

Limitations

• A free-trial Fix cannot run offline. If PDR cannot reach the counter before a run, the run is refused rather than allowed. That is deliberate — an allowance that can be bypassed by unplugging the network is not an allowance — but it means the offline promise applies to paid licenses and not to trials. See running with no account.
• Only the file count is on the server. The other eight trial allowances are counted in the database on this PC. See what the free trial allows.
• The key travels in the clear to this service, as it does to the payment provider. It is hashed for storage at the far end, not for transmission.

---

The license panel’s device and subscription screens

Opening these screens sends your license key to a server we run. The license panel has screens for the devices your key is activated on and for the state of your subscription. They are not answered by your PC. Each time you open one, PDR posts your license key to our own service at updates.photodaterescue.com and shows you what comes back. Removing a device sends your key and the identifier of the device being removed, after you have retyped your key to confirm.

We list this separately from the trial counter because it is a different message to the same host, it happens on a paid license as well as a trial, and it is worth knowing that opening a settings screen is a network action. As everywhere else on this page, the message carries your key and device identifiers and nothing about your photos.

Limitations

• These screens need a connection. What they show is what the service reports, not something this PC worked out, so with no network there is nothing to show.
• Removing a device is a request to us, not a local change. It asks the service to free the slot. It does not reach out to the other computer, and it does not delete anything on it.
• Your key is retyped in full to confirm a device change. That is a deliberate check that the person making the change is the license holder, and it means your key is on screen at that moment. Do not do it on a shared screen.

---

Checking for updates, and downloading them

PDR checks for a newer version on its own, and downloads one without asking. Ten seconds after the window appears, and then once every four hours while PDR is open, it asks updates.photodaterescue.com for the current version file. The request carries a version number. It does not carry your license key, your machine identifier or anything about your library.

If a newer version exists, the download starts immediately in the background. You are not asked first. When it finishes you get a notice offering to restart and apply it, and if you choose not to, it is applied silently the next time you close PDR. We would rather you knew that than discovered it, so it is stated here plainly and repeated on how updates arrive.

Limitations

• There is no switch to turn the update check off. No setting disables it, no setting changes the four-hour interval, and no setting turns the automatic download back into a prompt. If you need PDR not to reach the network, the only lever is your firewall.
• An automatic download uses your connection without warning. On a metered or slow connection, a release can start downloading while you are working. You are told when it has finished, not when it has started.
• The check happens whether or not you are licensed. It is not tied to your plan and it is not tied to a trial.

---

Optional AI model downloads

Downloads to you, never uploads from you. PDR’s AI features are switched off until you turn them on. When you do, the model file each one needs is fetched once and kept on your disk. From then on that feature works with no network at all, and your photographs are never sent anywhere to be analyzed — the model runs on your processor, against files that never move.

These are the models, and where each is fetched from:

Face detection and face matching are the exception: those models are shipped inside PDR and are loaded from your own disk, so they never involve a download at all.

Limitations

• The download is a request to a third party, and they see it. Hugging Face and GitHub are ordinary file hosts. They see a request for a file from your internet connection, as any download does. They are not told who you are, they receive nothing about your photos, and PDR sends them no license key.
• The captions model is much bigger than PDR’s own dialog claims. The confirmation box says about 150 MB; the real figure is around 700 MB. That is a known defect in 3.0.4, and it matters most if you are on a metered connection. Every download shows a progress bar and none starts until you press the button that needs it.
• Two further models sit in the build and are never fetched. PDR carries the plumbing for AI face restoration and AI upscaling, but those controls are switched off in 3.0.4. Because nothing can reach them, nothing downloads them. They are not on the list above for that reason.
• You can delete them. Removing an installed model puts that feature back to needing a download next time. The AI features can also simply be left off, which is how PDR arrives.

---

Send to Phone, and the server it opens

Your photos go to your phone across your own wi-fi, not through anybody’s service. Send to Phone starts a small web server on this PC and shows you a QR code. Your phone, on the same network, scans it and pulls the files straight off the machine. There is no account, no upload and no intermediary. This is the one feature in PDR that listens for incoming connections, so it deserves to be described exactly.

What it does

• The server listens on a port chosen at the moment you start the share, on your local network only.
• The address in the QR code contains a 128-bit random token. Without that token every address on the server returns “not found”, so another device on the same wi-fi cannot reach your files by guessing.
• Only the files in that one share are reachable, and each is addressed by a random identifier rather than by its path. A request cannot ask for any other file on your disk.
• The share stops after fifteen minutes, and stops immediately when you close the window. One share at a time.

Limitations

• Anyone on that network who has the link can download those files. The token protects you from guessing, not from sharing. Treat the QR code as the key it is, and do not start a share on a network you do not trust.
• The connection is plain HTTP, not HTTPS. Someone able to watch traffic on that network could see the photos in transit. On a home wi-fi that is a narrow risk; on a hotel or café network it is not.
• Up to 200 files in one share. Beyond that, split it.

---

Sending a problem report to support

Nothing is sent unless you send it. PDR has no crash reporter and no automatic diagnostics. When you report a problem, PDR writes a diagnostic file into your Documents folder, opens your own mail app with a message already written, and shows you the file so you can attach it. You read it, you decide, and you press send. If you close the mail window, nothing has left your machine.

That message is not empty, and you should know what is in it before you send it. It carries your description, your app version, your Windows version, your processor and memory, your license status and the email your license was sold to, and the last two hundred lines of PDR’s log. Those log lines routinely contain the full paths of files and folders you have been working with. See what PDR writes to your own disk for what that means, and what the diagnostic contains for the full list.

Limitations

• PDR cannot attach the file for you. Opening a pre-written email is as far as it goes; you drag the diagnostic in yourself. That is a limitation of how mail links work, and it is also the reason nothing can be sent without you seeing it.
• Delivery is your mail app’s business, not PDR’s. Whatever mail service you use handles the message from that point, under its own privacy terms.
• Edit the message if you would rather not send part of it. It is a normal email in your normal mail app before it is sent. Deleting the log section still leaves us your description and your system details.

---

What PDR writes to your own disk, and what it reveals

These files stay on your machine, and they are not private from anyone using it. Nothing here is transmitted. But “local” is not the same as “invisible”, and four of the things PDR writes contain more about you than people expect.

• The activity log records what PDR did, and it names files and folders in full as it goes. Anyone who opens it can see where your photos live and what they are called.
• Fix reports and the catalog written at your destination list the files in a run, with original names, new names and locations. They are readable in any text editor or spreadsheet.
• A subtitle file beside any video you caption. Transcribe holiday.mp4 and PDR silently writes holiday.vtt into the same folder, containing everything that was said. It is plain text, it sits in your own folders rather than PDR’s, and PDR does not tell you it is there. See captions for a home video.
• A diagnostic file, created only when you report a problem, bundles the log and a system-information summary that includes your license status and your license email. It is written into your Documents folder and it is left there afterwards.

Limitations

• None of it is encrypted, and none of it is hidden. Another person with an account on this PC, or with access to a backup of it, can read all of it.
• Old diagnostics are not cleaned up. Each report writes a new, separately named file into Documents and PDR never deletes them. Delete them yourself when you no longer need them.
• Settings › Privacy & Security is about what is on screen, not what is on disk. Its switches hide captions and video transcripts from view. They do not remove anything, and they have no effect on the network.
• The ownership marker on a Library Drive is a check, not a lock. Reconnecting a library needs the same license key that set it up, which stops somebody else’s copy of PDR opening your library. The photos on that drive are ordinary files and anyone holding it can still open them. See where your files are stored, and who can reach them.

---

Analytics, telemetry and crash reporting

There are none. The shipping build contains no analytics package, no usage tracker, no product-metrics library, no advertising identifier, no session recorder, no A/B testing service and no crash reporter that sends anything anywhere. We do not know how many photos you have fixed, which features you use, how long you keep the app open or whether you ever opened a particular screen. Not because we switched the reporting off, but because it was never built.

The word “telemetry” does appear inside PDR, describing the timings it records while converting files. Those timings are written to a file on your disk next to the run they came from, and that is where they stop.

Limitations

• Windows is still Windows. The operating system’s own reporting is outside PDR’s control and is governed by your Windows privacy settings, not by ours.
• The connections on this page are still connections. Our servers receive requests, and a request necessarily reveals that a machine at your internet address asked for something. That is unavoidable for a license check and an update check; it is not analytics, but it is not nothing either.
• The absence is not enforced by a setting. There is no “disable telemetry” switch in PDR, because there is nothing for it to switch. If a future release ever added reporting, this page and the comparison table would change together and the “last verified” date above would move with them.

---

Known gaps in 3.0.4

Collected in one place, because these are the things a reader choosing a private photo tool most needs to know, and because the same ones appear against PDR on our comparison page:

1. PDR is not usable with no online step at all. A license key is required and the first activation needs the internet. There is no account and no sign-in, and your photos never leave — but the promise is “nothing uploaded”, not “never connects”. See license checks.
2. A free trial cannot run a Fix offline. The file allowance is counted on our side, so a trial run needs a connection to start. A paid license does not. See the free-trial file counter.
3. Updates download without asking, and there is no way to stop them. No setting disables the check, changes its interval, or turns the automatic download back into a prompt. See checking for updates.
4. Logs, reports and diagnostics disclose your file paths, and diagnostics disclose your license email. They stay on your disk, unencrypted, until you delete them. See what PDR writes to your own disk.
5. Send to Phone serves over plain HTTP. Safe enough on a home network, not something to start on a public one. See Send to Phone.

Our full privacy policy governs anything not covered here.

---

How to check this page is still true

Every claim here describes behavior you can observe in the shipping build. If something on this page does not match what PDR does on your machine, that is a defect in one of the two, and we want to know: contact support. Tell us the anchor — for example /help/privacy-network#summary — and we will either correct the software or correct the page.