"Private by default" is easy to say and hard to make specific. So here's the specific version: when you capture a photo in a SeeMyChange Journey, it's encrypted and stored on your device. It is not uploaded anywhere as part of that process. Not to align it, not to back it up, not for any reason — unless you take a separate, explicit action that does one of two things.
The two things that can leave your device
First: if you turn on encrypted backup, a copy — already encrypted before it leaves your phone — goes to your own Google Drive. SeeMyChange's servers are never part of that path; it's your device talking directly to your own Drive account. Second: if you choose to publish to the optional Community feed, one sanitized, watermarked derivative of a single photo you pick is sent — never the original file, and never the rest of that Journey.
Alignment happens on your device, not a server
The camera-alignment step — matching a new photo's framing to your last one — runs locally, on your phone, before you ever save or compare anything. There's no round trip to a server to do that matching, which also means it works without depending on a network connection.
Track your own change, privately.
Get the app on Google PlayOne category is blocked entirely, not just by a setting
Baby & Child journeys can't be published to Community at all — not accidentally, not by toggling something. It's blocked at the account level, as a deliberate design decision, not a preference you could change.
Why this level of specificity matters
A privacy claim that isn't specific enough to be wrong isn't really a claim — it's a mood. Being exact about what leaves your device, when, and why, is what makes “private by default” something you can actually check, not just something you have to trust.
