itfanatic

PrivacyFirst Photo Organizer

It knows who is in your photos. Nobody else does.

Point it at your photo folders. Machine learning finds every face and groups the same person together on its own; you put a name to a group, and it recognises that person through the rest of your library — getting better each time you confirm one. The names are written back into the files themselves, so Lightroom, digiKam and Windows all read them. None of it ever leaves your computer — the recognition runs on your processor, not on somebody's server.

One-time purchase. No account, nothing uploaded — ever. Buying opens Stripe’s secure checkout — they take the payment and are the seller of record.

  • 100% offline
  • No account, no cloud
  • macOS, Windows & Linux
  • One-time purchase
The Organizer view: a grid of photographs with a filter ribbon above and a details panel on the right

Every other tool wants your photos on its servers first

That is the deal on offer nearly everywhere: hand over twenty years of family pictures, and in return something will sort them. This does the same work on hardware you already own.

Nothing leaves your machine

No accounts, no telemetry, no crash reporting, no update check. The recognition runs on your own processor. You can pull the network cable out and it behaves identically.

Your folders stay your folders

It never copies or imports your library. A project points at the folders you already have and keeps what it learns in its own small database alongside. Delete the project and your photos are untouched.

No seat count, no lock-in

This licence is yours, not a seat on someone else's server — no seat count, and no server that can be switched off in three years and take your library's organisation with it.

How it works

Four steps from a folder of chaos to a searchable library

  1. Create a project and add your photo folders. Nothing is copied and nothing is moved — you are pointing at what you already have.
  2. Press Process New Files. It reads the photos: faces, capture dates, places, quality, colours, duplicates and events. You can keep using the app while it runs.
  3. Name the groups. The faces are already sorted by who they appear to be. Type a name per group; after a few, press Classify unassigned and it starts tagging the rest itself, improving as you confirm its guesses.
  4. Use the library — browse by person, folder or trip, filter by anything it worked out, and press Write All New Data when you want it saved into the photo files themselves.

Watch the four-minute tour — and a short video for each feature

The Identify People page, showing clusters of detected faces waiting to be named
Identify People. Each tile is a group of faces the app believes belong to one person — you name the group, not the photographs. That is the whole reason this takes an evening rather than a winter.

What you get

The parts you will actually use, rather than a feature matrix.

Face grouping that learns

Detects and clusters faces across the whole library. Name a handful of groups and it classifies the remainder, including the awkward ones — profiles, sunglasses, twenty years apart.

Filters that stack

Person, date, place, camera, orientation, quality, colour, event, tag. Combine them and the grid narrows as you go — "photos of Anna in Lisbon that came out sharp" is three clicks.

Events and places

Groups a run of photographs into the trip or occasion it actually was, and turns GPS coordinates into place names using a local database — no lookup service involved.

Duplicate finder

Finds true duplicates and near-duplicates — the burst of eleven near-identical shots — and shows them side by side so you keep the good one deliberately.

Write-back to your files

Names, captions and your own tags are written into the photographs themselves as standard metadata, so every other program that reads tags can see them. Your work is not trapped in this app.

Optional local extras

Object detection for 80 everyday things, a local language model that writes a sentence describing each photo, and bigger place databases. Downloads you start yourself — never automatic.

Your own tags

The words only you know — receipt, Anna's wedding, to print. Tag one photo or a whole selection at once, tidy them up in the tag editor, and find them again with a filter. They go into the files as ordinary keywords.

Black & white and retro copies

Five black & white mixes, sepia, selenium and cyanotype toning, faded film, a warm ’70s grade and cross-processing — with optional grain, a vignette or an instant-photo frame. Before and after, side by side; your originals are never touched.

Light or dark

A dark theme that keeps your photos the brightest thing on the screen, and a light one for a bright room. The size of the app's own text and controls is adjustable too.

The part that matters

The tags go into your photos, not into a database you can't leave

Most organisers keep everything they know inside their own catalogue. Stop using the program and the work evaporates. This writes names, captions and keywords into the image files as standard metadata — so Lightroom, digiKam, Photos and Windows Explorer all read the same names, and so does whatever you switch to in ten years.

Nothing is written until you say so Every discovery lives in the project alone until you press Write All New Data. There is no background process quietly editing an irreplaceable library while you are still deciding whether you like the results.
The filter ribbon expanded above the photo grid, with person, date, place and quality filters
The filter ribbon. Everything the app worked out during processing becomes something you can filter on.

Before you pay anything

The trial is the real application

Not a demo, not a watermarked build, and not a fourteen-day clock. It will scan and organise up to 300 of your own photos so you can see exactly how it copes with your library, your faces and your filing habits. No account, no card, no sign-up.

What the trial does

  • Finds and groups every face in those 300 photos
  • Lets you name people and watch it classify the rest
  • Dates, places, events, quality, colours, duplicates
  • The full Organizer, filters, inspector and viewer

What it will not do

The trial is read-only. It shows you everything it found, but it will not write tags back to your files, rename, move, delete, export or make copies of anything — black & white and retro copies included. Buying is what unlocks writing.

This is deliberate, and it cuts both ways: it means the trial can never modify your library while you are still making up your mind, so there is no "undo my trial" to worry about.

Downloads

Every download is the same application. An installer puts it where your system keeps programs; a portable build runs from wherever you unpack it and writes nothing to system folders. Either is a full copy — the choice changes nothing about the app.

Windows

Version 1.1.3 · 64-bit, Windows 10 or 11.

The Microsoft Store copy installs and updates through the Store, under its own version number — what it does and does not cover.

Take the zipped installer if your browser or mail gateway blocks a bare .exe — same file, inside a .zip.

Windows will warn you — this is expected Microsoft Edge may hold the download first, with “Make sure you trust … before you open it”. Open the arrow beside Delete and choose Keep anyway; the file is not saved until you do. Then a blue “Windows protected your PC” panel appears the first time you run it. Both are SmartScreen saying it has not seen this download often enough to recognise it — there is no scan result behind it. Two clicks get past the panel: More info, then Run anyway. The guide shows all three screens.
The first start is slower — also expected The first time the app opens, Windows checks each of its files before letting it run. Depending on the computer, that can take a minute or a little more. Later starts skip it.

Mac · Apple Silicon

Version 1.1.3 · macOS 26, on an M1 or later Mac.

The Mac App Store copy is paid for up front, with no free trial, and updates through the Store — what it does and does not cover.

Not sure? Apple menu → About This Mac.

Mac · Intel

Version 1.1.3 · macOS 26, on an Intel Mac.

The two Mac builds do not substitute for each other.

Linux

Version 1.1.3 · glibc 2.35+ — Ubuntu 22.04+, Debian 12+, Fedora 36+, RHEL 9+.

One file — make it executable first A downloaded AppImage will not run until you allow it to. Either chmod +x it, or open its Properties and turn on Executable as Program — older file managers call it Allow executing file as program. Then run it; there is nothing to install. A file manager's Properties panel: a Permissions row reading Read and Write, and below it an Executable as Program switch turned on.

Two features are unavailable on Linux — see what differs by platform.

Apple Silicon and Intel are separate builds and are not interchangeable — they are two columns above for that reason, so neither can be taken by accident. Every file is published with a SHA-256 checksum and a detached GPG signature: how to check them.

About the security warnings. Every download is signed by us, and your system will still warn you the first time you run one. Those two facts sit together more often than people expect — what an operating system trusts is not "signed", it is "signed by someone it was told to trust in advance".

  • Windows — the installer and the application carry an Authenticode signature, but a self-signed one, so SmartScreen will still say the publisher is unknown. If Edge holds the download, choose Delete ▾ → Keep anyway; when the installer runs, choose More info → Run anyway. The signature is not decoration: it proves the file has not been altered since we built it. What it cannot do is introduce us to Microsoft, and we have chosen not to buy a certificate that would, so this prompt is here to stay rather than something we are about to fix.
  • macOS — both Mac builds are signed with an Apple Developer ID and notarized by Apple, so in the usual case they open normally. If macOS does say it cannot check the app, right-click (or Control-click) it and choose Open, then confirm. One thing worth knowing before you look: because this is an individual Apple developer account, the signature names the person who makes the app rather than ITFanatic. The two are the same party — see the Impressum.
  • Linux — nothing on a Linux desktop checks a signature, so there is no prompt and no reassurance either. The published SHA-256 next to each download is the way to verify you got the file we built, and a detached GPG signature sits beside it — see below. ⚠️ Corrected 2026-09-13: this said the signature was the AppImage's alone. It is on every download, Windows included; one signing step covers all of them.

Verifying a release. Every release is signed with the same GPG key, published at itfanatic.com/release-key.asc (uid releases@itfanatic.com) — a different host from the download itself, so a compromised downloads bucket cannot also hand you a matching key.

  • Import it: curl -fsSL https://itfanatic.com/release-key.asc | gpg --import
  • Check the fingerprint reads exactly 1A50 0CD8 A965 DF29 A108  E40A B373 44E4 387F 38E8 — gpg --fingerprint releases@itfanatic.com.
  • Verify with gpg --verify <file>.asc <file>. A line reading "Good signature from "ITFanatic (release signing) <releases@itfanatic.com>"" is what you're looking for.
  • Expect a warning too, and it is not a failure: gpg will also print WARNING: This key is not certified with a trusted signature! That only means you personally haven't vouched for our key in your own web of trust — true for almost everyone who has never met us. A "Good signature" line plus a fingerprint that matches the one above is the actual proof; the warning appears even when both are correct, and disappears only if you locally sign our key yourself.
FileSHA-256
PrivacyFirstPhotoOrganizer-windows-x64-setup.exe
Windows installer
40cbac84d24303ac96db05508bba732976b52bbe4aa534ba1bae2b4c94034450
.sha256 · .asc
PrivacyFirstPhotoOrganizer-windows-x64-setup.exe.zip
Windows installer, zipped
b191bc211f856408f6189e2531eaf3590e04c400f0223fe03b4c26be672cf4e6
.sha256 · .asc
PrivacyFirstPhotoOrganizer-windows-x64.zip
Windows portable
b91332cb50694b4a3ed941ba71055d4e15531f3503c6770d69345948b59b5b9f
.sha256 · .asc
PrivacyFirstPhotoOrganizer-linux-x86_64.AppImage
Linux AppImage
136725b6a12246f30063847c3a5345e3e9ea469702bf3dd985e5e2123c732f43
.sha256 · .asc
PrivacyFirstPhotoOrganizer-linux-x86_64.tar.gz
Linux portable
138995e270e4a19ce8bdc568bb494cdb9b8363ef1aa48765a0ba6e395328cd10
.sha256 · .asc
PrivacyFirstPhotoOrganizer-macos-silicon.dmg
macOS installer · Apple Silicon
e0b9d493c3cc36db02317c3ffbd67bfed7cd905628c40489f5c898c55998b50b
.sha256 · .asc
PrivacyFirstPhotoOrganizer-macos-silicon.zip
macOS portable · Apple Silicon
3941d132674ffe698d520b9db2266ca58ed483c16b07be6f4e469198a28ec612
.sha256 · .asc
PrivacyFirstPhotoOrganizer-macos-x86_64.dmg
macOS installer · Intel
6dbe375f1f4f38d8781d4bae61a9e0dc2065bb993c05f27f9551ce855cfff80e
.sha256 · .asc
PrivacyFirstPhotoOrganizer-macos-x86_64.zip
macOS portable · Intel
8b030acfa66267372c0405589dd6f9e18a2bb6884e2d06c7e7be9c3d31ba85f8
.sha256 · .asc

Includes open-source components, some under the GNU Lesser General Public License. Source code and licences.

Pricing

One payment. Every 1.x release. Yours offline, forever.

Full version
€24.99 one-time · VAT included

One payment. The licence is a file you keep — it works offline, on every computer you own, with no activation server that could one day stop answering.

Card, Apple Pay or Google Pay. Secure checkout by Stripe, who are the seller of record and handle VAT. We never see your card details.

PayPal — or a card or local payment method — through Paddle’s checkout. Paddle are the seller of record for that purchase and handle VAT. Same licence file, same terms.

Problems with the payment? Please write to support@itfanatic.com and we will help.

Windows only. You unlock it inside the app and pay through your Microsoft account (PayPal is accepted there in many countries). It unlocks the Windows version on the PCs you sign in to with that account, not the Mac or Linux versions, and Microsoft handles payment and refunds. What's different in the Store

Apple Silicon Macs only, on macOS 26 or later. You pay up front through your Apple Account, with no free trial and no licence file. It covers the Mac App Store version on the Macs you sign in to with that account, not the downloads on this page, and Apple handles payment and refunds. What's different in the App Store

  • Licence file by email, usually within a minute
  • Every 1.x release — new features and fixes included
  • Install on all the computers you own
  • Works offline forever; no activation server to outlive
  • 30-day refund, no justification needed
  • No subscription, no renewal, nothing to cancel

What happens after you pay

  1. You get an email with your licence file attached — a small .lic — usually within a minute.
  2. In the app, open About → Import license… and choose that file.
  3. That is the entire activation. The app verifies the licence, stores it, and never contacts us again.

If the email has not arrived in a few minutes, check your spam folder first — then email support@itfanatic.com and we will re-send it.

Future major versions

Your licence covers every 1.x release. A future 2.0 will be a paid upgrade at a reduced price — and if you bought within 60 days before that release, we send you the new licence free, without you having to ask.

Said here rather than discovered later: an upgrade charge that arrives as a surprise is just a refund request with extra steps.

Buying through an app store

Some people would rather buy through the store their computer already signs them into. The Windows version is on the Microsoft Store: it installs as the same free trial and unlocks with a full-version purchase inside the Store, or with a licence file bought here. The Mac version is on the Mac App Store: it is paid for up front, with no free trial, and the purchase itself unlocks it — it does not take a licence file bought here.

A store purchase covers that store's own platform only: Windows for the Microsoft Store, and Apple Silicon Macs on macOS 26 or later for the Mac App Store. Buying here gets you the application on Windows, macOS and Linux, and a licence file that is yours to keep.

A store delivers its own updates on its own schedule, so the version it offers can differ from the downloads on this page.

Requirements

macOS macOS 26 — Apple Silicon and Intel, as two separate downloads
Windows Windows 10 or later, 64-bit — tested on Windows 10 and 11
Linux glibc 2.35 or newer — Ubuntu 22.04+, Debian 12+, Fedora 36+, RHEL 9+. Two features are unavailable — see below
Processor Any 64-bit CPU, 4 cores. On Windows and Linux, the built-in AI captions also need AVX2 — a maths instruction set Intel has shipped since 2013 (Core i3/i5/i7, 4th generation onward) and AMD since 2015 (every Ryzen has it). Any mainstream chip of the last decade qualifies; budget Celeron and Pentium laptop processors are the realistic exception — see below
Memory 8 GB
Disk space About 1.5 GB
Network Not required, at any point
Everything needed to recognise faces Ships inside the app — no separate download

What differs by platform

Nearly everything — every face, every duplicate, every event — runs on models that ship inside the app and works identically on all three systems. Three things depend on what your operating system provides, and one on how old your processor is. All four are worth knowing before you buy.

macOS Windows Linux
Camera RAW — NEF, CR2, CR3, ARW, DNG… Yes Needs Microsoft's free Raw Image Extension No
Text recognition — making receipts and documents searchable Yes Yes No
Writing tags into HEIC photos in place Yes No — you get a fully tagged JPEG copy No — you get a fully tagged JPEG copy
AI captions with the built-in model Yes Needs a CPU with AVX2 Needs a CPU with AVX2

Why. All three are jobs the operating system does, not the app. RAW decoding and text recognition use components Apple and Microsoft ship with the system and Linux has no equivalent of; the only freely available HEIC encoder is licensed in a way this product cannot bundle, and macOS already contains one.

AVX2 is the one to actually check. It stands for Advanced Vector Extensions 2 — a set of processor instructions for doing the same piece of maths on many numbers at once, which is what makes a caption model run at a usable speed. Intel has shipped it since 2013 (Haswell, the 4th-generation Core i3/i5/i7) and AMD since 2015, with every Ryzen chip including it. So any mainstream desktop or laptop processor from roughly the last decade has it, and the realistic exception is the budget Celeron and Pentium line, which is still sold in new low-cost laptops today without it. On a Windows or Linux computer without it, the built-in caption model cannot run, and the app says so rather than trying: Settings → Models & data warns you before you download a caption model, and Describe explains why instead of captioning. Everything else — faces, objects, quality, duplicates — is unaffected, and captioning through an Ollama server you run yourself still works on such a machine. The free trial will tell you before any money changes hands — that is the check, it costs nothing, and it is more reliable than reading a spec sheet. macOS has no such requirement: every Intel Mac that runs macOS 26 has AVX2, and Apple Silicon is not affected.

Nothing is silently lost on Linux. RAW files are still catalogued — which photos a project contains never depends on which computer scanned it — they simply are not decoded. Text recognition is greyed out with the reason in the tooltip, and no half-finished results are written, so a project moved to a Mac or PC later picks the work up cleanly.

Questions

Do my photos really never get uploaded?

Really. All the recognition runs locally on your processor, and the application makes no network calls while it works. There are no accounts, no analytics and no telemetry. The only thing that ever touches our systems is the purchase itself, which is a name and an email address so we can issue your licence.

What exactly does it write into my photos?

Standard metadata — person names, your own tags as keywords, and captions if you enable them — written into the image files themselves, so other programs can read them. Camera RAW files are never written to; their tags stay in the project. It happens only when you press Write All New Data or one of the explicit correction actions. Keep backups anyway; that is good advice about any program that edits an irreplaceable library.

Is the licence tied to one computer?

No. It is a file, there is no activation limit, and there is no online check. Install it on the machines you own. It is personal to you, though — your name and email are inside it, which is why sharing it is not on.

What happens if your company disappears?

Nothing happens to your copy. The licence is verified offline by the application itself, so there is no server whose shutdown could disable your software. That is a property of the design, not a promise about our longevity.

The download warns me it is unsafe. Is it?

No, and the warning is not a finding about the file. On Windows, SmartScreen is saying it does not recognise the download yet. It will also say Unknown publisher, and it says that about a signed installer: our certificate is one we issued ourselves, so it proves the bytes have not been altered since we built them, but it does not introduce us to Microsoft. Microsoft Edge runs the same check on the download itself: choose Delete ▾ → Keep anyway to save the file. When you run it, choose More info → Run anyway. Expect both again on each new version — the prompt follows how many people have downloaded a file, so a purchased certificate would fill in the publisher line without removing the screen. The user guide walks through it with screenshots, and every download is published with a checksum and a signature if you would rather check it yourself.

Can I get a refund?

Within 30 days, for any reason, without justifying it — see the refund policy. There is also a free trial of the real application, which is why refunds are rare enough that we can be relaxed about them.

How big a library can it handle?

Tens of thousands of photographs is ordinary. Processing is the slow part and it runs in the background while you carry on using the app; after that, browsing and filtering work against the project database and stay quick.

Try it on 300 of your own photos first

The trial is the real thing, read-only, with no account and no card. If it sorts your library the way you hoped, it is €24.99 to unlock writing.

Payment is handled by Stripe — the Buy button opens their secure checkout, and they are the seller of record. We never see your card details.

Support

The user guide covers the whole application, with screenshots, and answers most of what comes up. After that there are two places, and which one you want depends on whether your question is about the software or about your order.

Everything below is for the version from this website. If you got the app from the Microsoft Store or the Mac App Store, that store sold it to you and handles the purchase — its own support page says what that means. All support, by version →

Bugs and feature requests

github.com/bl305/privacyfirst_photo_organizer_support — a public tracker, so you can watch what happens to what you filed instead of wondering whether an email went anywhere.

It is public and permanent, so please leave out your licence file, your order reference and your email address, and check screenshots for faces, names and file paths before uploading them.

Purchases, licences and privacy

support@itfanatic.com — a licence that never arrived, a lost licence file, a refund, an invoice question, or a request to see or delete your data. A real person reads it.

These carry personal details by their nature, which is exactly why they belong in email rather than on a public tracker.