Commercial disclosure: Totti publishes this page and is included in the table. We do not name any app “most private,” audit source code or verify developer declarations. On October 18, 2026, we read the App Privacy sections on the current U.S. App Store listings linked below. Apple states on those pages that developers provide the information, it has not been verified by Apple, and practices may vary by feature or age. All product names and trademarks belong to their respective owners; this comparison does not imply affiliation, sponsorship or endorsement.
Short answer: an App Store privacy label summarizes what a developer reports about data collection, linking and tracking. It is useful for comparison, but Apple says the information is not verified. “Data Not Collected” does not prove on-device processing, while “not linked to you” does not mean data never leaves the phone.

What do the current App Store privacy labels say?
| App | Headline declarations visible October 18, 2026 | Official source |
|---|---|---|
| Totti | Data Not Collected | App Store listing |
| Baby Pics | Identifiers used to track; identifiers linked; diagnostics not linked | App Store listing |
| Totsie | Identifiers used to track; identifiers linked; diagnostics not linked | App Store listing |
| LittleCam | Identifiers used to track; user content, identifiers, usage data and diagnostics not linked | App Store listing |
| NewPic | User content—photos or videos—linked to identity for app functionality | App Store listing |
| Remini | Identifiers used to track; contact information linked; user content, identifiers, usage data and diagnostics not linked | App Store listing |
| Picsart | Identifiers used to track; linked categories include purchases, contact information, user content, search history, identifiers, usage data and diagnostics | App Store listing |
| Canva | Identifiers used to track; linked categories include financial information, purchases, location, contact information, user content, search history, identifiers, usage data and diagnostics | App Store listing |
This table is a compact reading aid, not a verdict. Apps perform different jobs, and a broader editor may declare categories associated with accounts, collaboration, advertising or support that a narrower app does not. A label does not reveal how well an organization secures data, how promptly it deletes it or whether every policy promise is implemented correctly.
How was this privacy comparison made?
We opened each official U.S. App Store listing and recorded the visible top-level categories under Data Used to Track You, Data Linked to You, Data Not Linked to You or Data Not Collected. We did not infer a category from the app description, website copy, network behavior or another region's store page. We did not use ratings or user reviews as privacy evidence.
We then paraphrased the declared categories without converting them into a numerical score. A score would create false precision: “tracking,” “linked” and “not linked” describe different relationships, while the absence of a category can have more than one explanation. Only an app's developer can clarify implementation details, and only an independent technical and legal audit could test those claims.
The check is dated because declarations change when apps add analytics, advertising, accounts or new editing services. Treat this article as a reading guide. Before an upload, open the live listing and the current privacy policy yourself.
What do Apple's privacy-label terms mean in plain language?
What does “Data Used to Track You” mean?
In the label context, tracking concerns linking data from an app with data from other companies' apps, websites or offline properties for targeted advertising or advertising measurement, or sharing with a data broker. In the listings reviewed here, identifiers were the category most often shown under tracking. The label does not say that every user experiences every possible practice in every feature.
What does “Data Linked to You” mean?
It means the developer reports that collected data may be connected with identity, an account, a device or other identifying details. For a photo app, “User Content” may include photos or videos. Read the purpose headings on the live label—such as App Functionality or Analytics—because a top-level category alone does not explain why it is handled.
What does “Data Not Linked to You” mean?
It means the developer reports that data may be collected but is not linked to identity. It does not mean “not collected,” “never transmitted,” “anonymous under every circumstance” or “safe to publish.” Photos, identifiers, usage data and diagnostics can still matter even when a label categorizes them as not linked.
What does “Data Not Collected” mean—and not mean?
It is the developer's declaration that the app does not collect data under Apple's label framework. It does not prove that image processing occurs on the device. It does not independently verify retention, encryption, service-provider behavior or source code. For Totti, the live label and linked privacy policy should be read together, and users should ask the same processing and deletion questions they would ask of any image app.
Apple's framework also allows narrow optional-disclosure categories to be omitted only when all of Apple's criteria are met. That exception is conditional; it should not be interpreted as proof that no data is ever processed.
What deserves attention in each current label?
What does Totti declare?
Totti's developer-reported label displayed Data Not Collected. That is narrower than the declarations shown for the other listings in this comparison, but we do not translate it into “most private.” Apple explicitly says the information has not been verified. The label also does not establish whether a particular generation step is local or remote. Read the current policy and ask where an uploaded photo is processed.
Important Totti disclosure: The App Store label and Totti's linked developer privacy policy do not currently align cleanly. The policy separately says baby photos and selected milestone text are processed by Replicate; profiles can include names, birth dates and milestones; optional Apple cloud backup can include profiles and images; and service-provider retention can extend beyond generation. Do not rely on the label alone. Review both live disclosures before uploading. This article does not determine which App Store privacy categories should apply.

What do Baby Pics and Totsie declare?
Both listings, from Burleigh Creative Apps, displayed identifiers used to track users, identifiers linked to identity for advertising or marketing, and diagnostics not linked to identity. Their feature sets differ, so do not assume identical behavior beyond what each listing declares. Read each separate policy and check whether an account, time-capsule feature or AI tool changes the applicable practice.
What does LittleCam declare?
LittleCam displayed identifiers used to track users. Its not-linked section listed photos or videos for app functionality, identifiers, product-interaction usage data and crash diagnostics. “Photos or Videos—not linked” is not the same as “photos remain on the device.” The important follow-up is where photos are sent, how long they remain and which processors receive them.
What does NewPic declare?
NewPic displayed user content—photos or videos—as data linked to identity for app functionality. Its app description separately makes an on-device-processing statement. Both are developer-provided. The combination is a reason to read the policy carefully and ask the developer how the label and description apply to the current version, not a reason for us to guess which statement controls.
What does Remini declare?
Remini displayed identifiers used to track users and an email address linked to identity for app functionality. Its not-linked categories included photos or videos, identifiers, usage data and performance diagnostics. That declaration fits a service that handles user content, but the label alone does not explain retention or whether generated details are kept.
What do Picsart and Canva declare?
These broad creative platforms displayed more linked categories than the baby-specific apps above. Picsart's listing included user content such as photos or videos within app functionality. Canva's listing included user content within several declared purposes. Their labels also cover wider product functions, so category count is not a fair stand-alone ranking. The relevant question is which declared practices apply to the exact photo, account and AI feature you plan to use.
What important privacy questions are missing from a label?
A label can tell you declared categories and relationships. It usually cannot give a complete operational answer to these questions:
- Does the photo remain on the iPhone, or is it uploaded to a server?
- Which company processes generation, enhancement, storage or moderation?
- How long are source photos, temporary files and generated images retained?
- Are uploads or outputs used to train, fine-tune or evaluate models?
- Can a parent delete the source, output, account and backups?
- What safeguards apply to a child's image in transit and at rest?
- Does signing in, using a trial or enabling collaboration change the data path?
- How does the service handle support requests that include screenshots?
A clear privacy policy should answer most of these. If it does not, contact the developer before uploading. Silence is not consent to assume the most reassuring architecture.
What should you ask before choosing an app?
- What exact job needs an upload? Crop and exposure may be possible without generative processing.
- Can you use a less sensitive source? Remove documents, addresses, hospital bands and location clues.
- Does the live policy name image retention? Look for specific periods rather than vague “as needed” wording.
- Does it explain training use? Find out whether uploads, outputs or feedback can improve models and whether an opt-out exists.
- Does it identify service providers? A photo may be handled by more than the company named on the App Store listing.
- Can you delete the data? Check the process before uploading, not only when you want to leave.
How can you reduce risk before uploading a baby photo?
Use the minimum necessary image. Crop out mail, medical notes, name plaques, school logos, house numbers and reflective surfaces. Turn off location sharing for the exported copy where appropriate. Do not upload passport photos, hospital documents or images with identity bands. Confirm that you have authority to use the image and any consent required by applicable law, court orders, agreements and platform terms.
Keep the real original outside the editing workflow. After generation, check whether the image invents or alters identifying features. Share with the smallest suitable audience and remove metadata or factual details you do not want redistributed. A privacy-conscious upload can still become an overexposed public post if the final sharing decision is careless.
Review the live information before using Totti
Totti is free to download for iPhone and includes optional in-app purchases. Its current App Store label is developer-reported and not independently verified; read the live label and privacy policy before uploading.
View Totti on the App StoreWhat is the bottom line?
Privacy labels make developer declarations easier to compare, but they are not security audits. Use them to identify follow-up questions, not to award a winner. The responsible sequence is live label, current privacy policy, processing and retention answers, minimal upload, parental permission and limited sharing. If the answers are unclear, do not submit the photo.