A photo book maker that never uploads your photos

When you add photos to an album, Kathaleaf reads them from your device, checks them, and stores them in your browser's own private storage on that device. Thumbnails, previews, the grouping of bursts and near-duplicates, sharpness scores and the date each photo was taken are all worked out locally. When you edit a photo, the edit is saved as instructions next to the untouched original; nothing is re-uploaded because nothing was uploaded in the first place.

The same is true at the end. The 300 dpi print file, including the conversion to CMYK for a press, is rendered by your browser and saved straight to your device. Importing from Google Drive goes directly between your browser and Google; Kathaleaf's servers are not in the middle. iPhone HEIC photos are decoded in the browser as well, so there is no conversion service to send them to.

That matters most for the photos people care about most: a wedding, a newborn, a parent who is no longer here. They stay where they already were. It also matters for the practical reason nobody mentions: uploading a few thousand full-resolution photos over a mobile connection takes hours and a lot of data. With Kathaleaf there is no upload step to wait for, so a large album is ready to sort as soon as the photos are read from your device.

Kathaleaf needs an account, and you sign in with Google or a passkey. The server keeps what an account needs and nothing about your pictures:

• your sign-in identity and active sessions;
• the consent you gave to the privacy notice;
• your passkeys, if you add any;
• if you turn backup on, encrypted data it cannot read (below).

Analytics are off unless you choose to allow them, and you can change that at any time from Cookie settings at the bottom of every page. The privacy policy lists every service provider and exactly what each one processes.

Keeping photos only in a browser has one real risk: clearing the browser's data, or uninstalling it, deletes them. Safari can also remove a site's storage if you don't open it for a week, unless the site is installed as an app. Kathaleaf warns you about this and offers two protections: install it as an app, and turn on the encrypted backup.

With backup on, your albums and print-quality copies of your photos are encrypted on your device before anything is sent, using a key that is made on your device and never sent to Kathaleaf. The server stores only the encrypted copies and the key in locked form. It is unlocked by your recovery code, by a passkey that supports it, or on a device where backup is already on. Kathaleaf holds none of those, so Kathaleaf cannot read your backup, and cannot recover it for you if you lose all of them.

We are also plain about the limit of any web app: this holds as long as the app code Kathaleaf serves to your browser is not altered. The privacy policy explains that in full.

An album lives on the device where you made it. Kathaleaf is built for one person on one device, so there is no shared editing; to carry on on a new computer, restore your backup there. In return you get a tool that works without uploading gigabytes over a mobile connection, that keeps working offline once installed, and that has nothing of yours to lose in a data breach.

When the book is done, the PDF is yours. Take it to any print shop or print it at home; the print guide lists the settings to ask for. The only time your photos leave your hands is when you choose to give that file to a printer.