Private Progress Photo Apps: Where Your Photos Actually Go

Nearly every progress photo app on the App Store says your photos stay on your phone. Six of the six I looked at say some version of it. The claim is usually true, and it is also usually not the whole story: an app can keep every photo on your device and still tell Google which screens you opened, how many photos you have and when you hit the paywall.

So I stopped reading the marketing and read the receipts instead: each app's App Privacy label on the App Store, and each app's own published privacy policy. Those two are the commitments. The listing is an ad.

Full disclosure: I make Then & Now, which is one of the six. That's also why this post sticks to quoting each app's own published words and linking them, so you can check every line yourself. If you want a straight ranking on features rather than privacy, that's my best progress photo app for iPhone roundup instead — this post is only about where the photos go.

---

Quick answer

The three different things "private" means

When a progress photo app says it's private, it's usually saying one of these, and they're not the same:

1. Your photos aren't on our servers. Almost always true, and the easiest promise to keep, because storing other people's body photos is expensive and a liability. It says nothing about anything else.
2. There's no account. Also common, and genuinely useful: with no sign-up there's no database with your email next to your photos. But an app with no account can still have an analytics SDK.
3. We collect nothing at all. Rare. This is the one Apple's "Data Not Collected" label means, and it's the one worth looking for.

A progress photo of your body is about as personal as a photo gets. The gap between the first promise and the third is the thing to actually check.

What I checked, and when

For each app I looked at two sources, both published by the developer:

• The App Privacy label on its App Store page, which the developer fills in and Apple shows under "App Privacy". Apple notes on every one of them that the information "has not been verified by Apple".
• The privacy policy linked from that same page.

Everything below was checked on October 20, 2026, in the US App Store. Labels and policies change; the links go to the live sources so you can see today's version. Apps are in order of how little leaves your phone. If something here is out of date or I've read a policy wrong, tell me and I'll correct it.

App	What its listing claims	Its App Privacy label	What its own policy adds
Then & Now	"Your photos never leave your device. No accounts."	Data Not Collected	No analytics, ads or third-party SDKs; iCloud Sync to your iCloud, on by default
PhotoProgress	"Sin cuentas · Sin servidores · Sin nube · Sin tracking"	Data Not Collected	Policy matches the label
Metamorph	"Your photos stay on your device or iCloud"	Data Not Collected	Policy says it collects "anonymous usage analytics such as screen views and button taps"
FrameJourney	"Private by Design. Your photos stay on your device."	Data Not Linked to You	Uses Firebase Analytics (Google); logs album created, photo saved, timelapse exported
Body Progress Photo Tracker	"PRIVATE BY DEFAULT. Your progress photos stay on your device."	Data Linked to You	Firebase Analytics and Crashlytics; photos and measurements explicitly excluded from reports
Progress Pics: Body Check	"a private, local-first progress photo app"	Data Used to Track You	Google Mobile Ads banners in the free version, plus Firebase and Sentry diagnostics

App by app

Then & Now — Data Not Collected

Then & Now is mine, so treat the description as what I've committed to in public rather than an independent review. Its App Store listing opens with "Your photos never leave your device. No accounts. No sign-ups. No uploads to third-party servers," and its App Privacy label is Data Not Collected.

What the privacy policy commits to, in its own words: there's no account and no servers of its own, Mahalo Mochi never receives your photos or data, and the app has "no analytics, advertising or tracking code". Albums live on your iPhone and, with iCloud Sync on (the default), in your own iCloud under your own Apple Account. Any album locks with Face ID, Touch ID or your passcode, and photos are re-saved without their original metadata, so a photo's location isn't kept.

Three things I'd rather say myself than have you find:

• iCloud Sync is on by default. Your photos go to your iCloud Drive and your albums to your private iCloud database. That's Apple's storage under your account, not mine — I can't see any of it — but it is a cloud, and you can turn it off under More → "Backup" if you'd rather it weren't.
• The voice timer uses Apple's speech recognition. Depending on your iPhone, the audio for "Now" and "Redo" may be processed on the device or by Apple. Then & Now keeps none of it, but Apple's framework is in the loop while the timer is on.
• This website isn't the app. These pages use Vercel Web Analytics, which counts page views without cookies and without identifying you. No Google Analytics, no ad trackers. The app itself has nothing.

PhotoProgress — Data Not Collected

PhotoProgress, by Eitan Camhi, is the one app here whose claim and label line up with nothing left over. Its listing (in Spanish) says "100% privada — Tus fotos nunca salen de tu teléfono", under a list reading "Sin cuentas · Sin servidores · Sin nube · Sin tracking": no accounts, no servers, no cloud, no tracking. Its App Privacy label is Data Not Collected, and its policy doesn't walk that back.

Worth knowing before you download it: the listing is in Spanish, the free plan stops at 25 photos and one active category, and it has no ratings yet. But on the one question this post is about, its answer is clean.

Metamorph — Data Not Collected on the label, analytics in the policy

Metamorph (listed as "Body Progress Pics: Metamorph", by Tiny Ideas Pty Ltd) is the closest app to mine and a good one. Its listing says "Built for privacy: Your photos stay on your device or iCloud — we don't store, or even have access to your photos," and its App Privacy label is Data Not Collected.

Its privacy policy makes the photo promise even more strongly — "We will not share your photos with anyone (we have designed Metamorph so that this is impossible for us to do)" — and then, under "What we do collect", lists "Anonymous usage statistics", "Anonymous usage analytics such as screen views and button taps" and "Anonymous crash reports".

Both of those are Tiny Ideas' own published statements, and they don't say the same thing. I'm not going to tell you which one is the mistake; I'd just read them together before deciding the label settles it. Nothing in either suggests your photos go anywhere. More on the app itself in Then & Now vs Metamorph.

FrameJourney — Data Not Linked to You

FrameJourney: Progress Photos, by Stepan Petrov, puts "• Private by Design / Your photos stay on your device. No account required" in its listing. Its App Privacy label is Data Not Linked to You, covering Usage Data and Product Interaction collected for Analytics.

Its privacy policy, last updated 1 June 2026, is unusually frank about what that means. It says "We do not operate a backend server for storing your photos" and "We do not upload your photos to our servers" — and then, in section 3, "the App uses Firebase Analytics (Google)", logging events including "album created, photo saved, guide created, reminder enabled, timelapse exported" with parameters that "may include technical/device context" such as "album type, screen source, export format, FPS value, photo count, reminder frequency, and Premium status".

So the photos stay. What you do with them — how many you have, which album type, when you exported — goes to Google. That's a real distinction, and it's the one the listing's "Private by Design" doesn't make.

Body Progress Photo Tracker — Data Linked to You

Body Progress Photo Tracker leads with "PRIVATE BY DEFAULT — Your progress photos stay on your device. No account is required, and you can turn on Face ID lock for extra privacy." Its App Privacy label is Data Linked to You: Purchase History and Device ID and Product Interaction for Analytics, Device ID for App Functionality, and Crash Data for Diagnostics. "Linked to you" is Apple's phrase for data tied to your identity.

Its privacy policy (effective July 26, 2026, where the app is called "Progress Camera") says the app "does not upload your progress photos, project names, or comparison data to our servers", and confirms the analytics: "The App includes Google Firebase Analytics and Firebase Crashlytics."

Credit where it's due: this policy is the most specific of the six about what it keeps out of those reports — "We do not place progress photos, project names, body measurements, measurement values, exported images, or user-entered notes in Firebase events or crash reports" — and it says the app includes no third-party advertising SDKs and no cross-app tracking. If you want local photos and don't mind Google seeing your purchase funnel, it tells you exactly what that trade is.

Progress Pics: Body Check — Data Used to Track You

Progress Pics: Body Check, by GLOBALHASHTAG, describes itself in its listing as "a private, local-first progress photo app for tracking body changes over time", with "Private photo tracking: Keep core photo history on your device".

Its App Privacy label is the strongest-worded one Apple has: Data Used to Track You, covering Location, Identifiers, Usage Data and Diagnostics — Apple's definition of which is data that "may be used to track you across apps and websites owned by other companies". The label also shows Data Linked to You collected for Third-Party Advertising, including Coarse Location, Device ID, Product Interaction and Advertising Data.

Its privacy policy, updated October 14, 2026, is consistent with that and explains it: "The free version of Progress Pics may display limited banner ads on selected in-app surfaces," and its list of third-party providers names "Google Mobile Ads and related Google advertising services", "Firebase Crashlytics and Firebase Performance Monitoring", "Sentry" and "RevenueCat". On the photos themselves it says the app "is designed to keep core check-in content on your device".

Both things are true at once: by its own account the photos stay local, and the free app around them is ad-supported with tracking enabled. "Local-first" is doing a lot of work in that listing.

Your own iCloud is not their cloud

This is where most of the confusion in this category lives, and it's worth being precise, because "no cloud" and "no their cloud" are very different promises.

If an app syncs through your iCloud, your photos go into your own iCloud Drive and your own private iCloud database, under your Apple Account. The developer has no access — not "promises not to look", but no technical way in, because it was never their storage. Apple runs it under its own privacy policy, and if you've turned on Advanced Data Protection, Apple encrypts it end to end. That's how Then & Now and Metamorph ("kept private on your device and in iCloud") both work, and how Progress describes itself too: "stored privately on your device and synced through your own iCloud".

If an app syncs through its own servers, your photos sit in a database someone else administers, backs up, and could be compelled to hand over or lose in a breach. That usually comes with an account, which is the tell: if an app asks you to sign up before it'll show you your own photos, your photos are on somebody's server.

And if an app does neither, your photos exist in exactly one place. That's the most private option and the most fragile one — delete the app and they're gone. There's a real trade here, and "private" doesn't automatically mean "best": I'd rather have my photos in my own iCloud with Advanced Data Protection on than on one phone with no backup.

How to check any app yourself, in about two minutes

You don't need me for this, and you shouldn't take my word for it anyway, since I'm selling one of the six.

1. Open the App Store page and scroll to "App Privacy". Read the heading, not the details: Data Not Collected means nothing leaves. Data Not Linked to You means something leaves but isn't tied to your identity. Data Linked to You means it is. Data Used to Track You means it may follow you across other companies' apps and websites.
2. Tap "Privacy Policy" under Information on that same page, and search the page for server, cloud, analytics, Firebase, advertising and third part. Thirty seconds of Cmd-F finds nearly everything that matters.
3. Check whether it needs an account. No sign-up is a good sign. A required sign-up means a server.
4. Compare the label to the policy. When the two disagree, as they do for one app in this post, that's worth knowing before you hand over photos of your body.
5. Then look for the lock. Face ID or Touch ID on the album matters for the much likelier risk: someone picking up your unlocked phone. Then & Now, Body Progress Photo Tracker and Metamorph all have it.

Apple's own Privacy Definitions and Examples page spells out what each label category means, if you want the precise wording.

Takeaway

Six apps, six variations of "your photos stay on your device", and all six are broadly telling the truth about the photos. The difference is everything around them: one app serves ads and says its data may track you across other companies' apps, two send usage analytics to Google, one has a label and a policy that disagree, and two collect nothing.

If nothing-leaves is the thing you actually want, that narrows to the apps carrying Data Not Collected — and then you check the policy to make sure it agrees with the label. Then & Now is built that way on purpose: no account, no servers, no analytics, your photos on your iPhone and in your own iCloud, Face ID on any album. You can read exactly what it keeps and where, and it's free to start.

If you'd rather compare on features than on privacy, the iPhone roundup ranks six apps on alignment, comparison views, measurements and price, and Then & Now vs your camera roll covers the free option you already have.

Labels and policies checked October 20, 2026, in the US App Store. Every quote links to the developer's own page; all of them can change without notice.