Last updated: 26 August 2026
Pitop Viewer works without an account and collects no personal data. Your photos never leave your Mac. This page describes precisely the only three occasions on which the app talks to the outside world, and what this website does.
On startup, the app contacts viewer.pitop.fr/api/license.php and sends two things: a machine identifier and the version number. The server logs the date, that identifier and that version — nothing else.
The machine identifier is a random UUID generated once on first launch and stored in ~/Library/Application Support/com.pitop.viewer/machine-id. It is not derived from any hardware characteristic, contains nothing about you, and is not linked to any other data. Deleting it generates a new one.
The request exists to count active installs and see which versions are in use. If it fails, the app starts normally.
At most once a day, the app downloads viewer.pitop.fr/releases/latest.json to compare version numbers. A read-only request with no parameters.
When you view a photo containing GPS coordinates, the app sends those coordinates to Nominatim, the OpenStreetMap geocoding service, to get a readable place name. No image is transmitted — only a rounded latitude and longitude.
This is a third party: those coordinates therefore leave both your machine and our servers. They come from your personal photos and can reveal places you visit.
This feature is enabled by default. To turn it off: Settings › Reverse geocoding. Once disabled, no coordinates are sent at all. Results already obtained are kept locally (500 entries maximum) and are never sent back.
Nominatim's own privacy policy is published by the OpenStreetMap Foundation.
Your preferences, star ratings, albums, favourite folders, language and theme are stored locally by the app (built-in system web view storage). Nothing is synced or backed up online.
The app also keeps a disk cache of thumbnails and HEIC conversions in ~/Library/Caches/com.pitop.viewer/, plus a technical log in ~/Library/Logs/Pitop Viewer/. These files are never transmitted. You can delete them at any time.
Traffic on viewer.pitop.fr is measured by a counter we host ourselves, without cookies and without any third-party service. For each page view we record:
| Data | Detail |
|---|---|
| Date and time | — |
| Page visited | path only |
| Referring site | domain name only, never the full URL |
| Visitor identifier | SHA-256 hash of (IP address + browser + date + secret key), non-reversible and rotated daily |
| Region and country | derived locally from the IP address, which is then immediately discarded |
No IP address is retained. The visitor identifier changes every day, which makes tracking anyone across days impossible. Known bots are excluded from the count.
Open viewer.pitop.fr/api/hit.php?optout=1 once. A technical cookie named pitop-notrack is then set on the .pitop.fr domain for two years, and your visits stop being counted on any of our sites. This is the only cookie we set, and only if you explicitly ask for it. To reverse it: ?optin=1.
Traffic and launch logs rotate at 5 MB: beyond that, the oldest file is overwritten. No long-term retention is organised.
The data described above cannot identify you: we hold no name, no email address, no IP address and no stable identifier relating to you. We therefore cannot locate "your" data in order to hand it over or delete it — it does not exist in a form attributable to you.
For any question about this page, get in touch through the GitLab issue tracker.
Any change to these practices will be reflected here, with the date at the top updated. The app is open source, so you can verify every claim on this page in the code: gitlab.com/christophepicot/pitop-viewer.
