Why photo apps ask for your entire library

Since iOS 14, when an app asks for your photos you get three choices: allow all, select specific photos, or deny. Picking “select photos” feels like the obviously safer answer, and often it is. But it changes what the app can do in ways the permission dialog doesn’t explain.

What “limited access” actually does

With limited access, iOS doesn’t hand the app a filtered view of your library. It hands the app a completely separate, tiny library containing only the photos you picked. From the app’s side, those are the only photos that exist. It cannot see how many others you have, when they were taken, or that they’re there at all.

That’s a good design. The system does the filtering, so the app can’t cheat.

When limited access is exactly right

For most apps, it’s the correct choice, and you should use it:

• An app that needs a profile picture needs one photo.
• An editor needs the images you’re editing.
• A messaging app needs whatever you’re about to send.

If an app asks for your whole library to do one of these, that’s worth questioning. The permission should match the job.

Where it breaks down

The problem is a specific category of app: anything whose output is a statement about your library as a whole.

Consider “you took photos on 246 days this year.” There is no way to compute that from twenty selected photos. Neither is “your busiest day was March 14th,” or “you visited 31 distinct places,” or “screenshots were 22% of your library.” These aren’t features layered on top of individual photos — the library is the input. Give the app a sample and you get statistics about the sample, which are not statistics about your year.

This is the honest reason a recap app asks for full access, and it’s worth being suspicious when an app can’t explain its own version of this. “We need it to work better” is not a reason.

The question to ask instead

Full access sounds alarming because we’re used to a model where granting access means sending data somewhere. That’s the assumption worth interrogating, not the permission itself.

The useful questions are:

1. Does the analysis happen on the device, or on a server? If the app uploads, full access means a full copy of your library on someone else’s hardware. If it processes on-device, full access means the phone reads files that were already on the phone.
2. Does it need an account? An app with no login has no way to associate your library with an identity.
3. Does it work in airplane mode? This one is hard to fake. If the core feature works with the radios off, the processing is genuinely local.

That last one is a decent smoke test. Turn on airplane mode and see what still works.

You can change your mind

Whatever you grant, it’s reversible. Go to Settings → the app → Photos and switch to limited access or none. iOS also periodically reminds you which apps have full access and how many photos they’ve read, which is a useful prompt to reconsider.

For a recap app, revoking access typically means it keeps whatever it already computed but can’t update it. That’s the trade, and it should be stated plainly rather than buried.

Where WrappedMe lands

WrappedMe asks for full library access, and the reason is the one above: active-day streaks, category breakdowns and place counts are properties of the whole library or they’re nothing.

What it doesn’t do is upload any of it. The analysis runs on your iPhone with Vision and Apple Intelligence, there’s no account, and it works in airplane mode. We wrote up the technical detail in what on-device analysis really means, and the full FAQ covers permissions specifically.