Nine kinds of photo clutter and what each is worth. How the app decides which frame out of sixteen is the one to keep. Ten screens. The five-pass pipeline that makes a 48,000-photo library tractable on a phone. And a straight list of the parts that might not work.
Most things that eat a disk are easy to reason about because they come back. A cache refills, a build folder rebuilds, a download can be downloaded again. Photos invert every part of that: they are simultaneously the largest thing on the device and the only thing on it that is genuinely irreplaceable. One wrong tap costs a person something no amount of freed space buys back.
So the product cannot be a bulk deleter. It has to be a culling assistant — what photographers have always done with a loupe and a grease pencil, done automatically for a library nobody has the evening to sit with. The core move is not “delete these forty photos”. It is “of these forty, this one is the keeper, and here is why”. The space is a consequence of the judgement, not the pitch.
The thesis in one line: the app never asks you to choose what to lose. It shows you what it would keep, and asks you to disagree.
Biggest reclaim first — not alphabetically, and not by how clever the detector is. Figures are modelled on a 48,000-asset, 214 GB library: a heavy but ordinary six-year iPhone history.
| Category | How it’s found, on device | Reclaim | Confidence |
|---|---|---|---|
| Near-duplicate setsBursts, retries, “one more with everyone looking” | Perceptual hash buckets by time and place, then Vision feature-print distance inside each bucket | 61 GB | High — the maths is unambiguous |
| Screen recordingsThe worst bytes-per-item in any library | A media subtype flag on the asset, not a guess | 23 GB | Certain |
| Long-tail videoThe 22-minute school concert nobody replays | Duration × bitrate ranked by bytes, flagged when never favourited, edited or filed | 18 GB | Medium — needs your eyes |
| Expired screenshotsReceipts, codes, maps, boarding passes, memes | Screenshot subtype, then Vision’s utility flag plus on-device text recognition to sort receipt from meme from keepsake | 9 GB | High |
| Technically failed framesPocket shots, motion blur, lens-cap black | Laplacian sharpness variance, luminance clipping, face capture quality when a face is present | 6 GB | High for the extremes only |
| Recently DeletedAlready “deleted”, still on disk for 30 days | The system’s own Recently Deleted collection, surfaced on day one | 5 GB | Certain |
| Forwarded mediaSaved out of chat apps | Non-camera source, absent EXIF camera fields, text-dense with a low aesthetic score | 4 GB | Medium |
| Exact duplicatesRe-downloads, AirDrop round-trips, re-saves | Byte length, then a hash of the first and last 64 KB, then a full hash only on collision | 3 GB | Certain |
| Motionless Live PhotosA still with three wasted seconds welded on | Frame-to-frame difference across the motion component below a threshold | 2 GB | Medium — offered as “flatten”, not delete |
Reclaim figures overlap slightly — a blurry frame inside a burst is counted once, in the set that claims it first. The app reconciles overlaps before it shows a total, because a headline number you can’t actually reach is the fastest way to lose someone’s trust.
Grouping similar photos is solved arithmetic. Picking the best one is a taste judgement, and taste is where the app either earns its place or gets deleted in week two.
Favourited. Edited. Cropped. Placed in an album. Set as a Memory key photo. Shared. These outrank every algorithm in the app — if you touched a frame, it wins its group by default, and Keeper says so rather than pretending it scored well.
Sharpness by Laplacian variance on the subject region, not the whole frame. Exposure clipping at both ends. Resolution and format, so a ProRAW original beats its shared JPEG. Vision’s aesthetics score. Face capture quality, eyes-open and expression from landmarks, weighted by face size.
Most faces present, because the group shot with everyone in it is usually the reason the burst exists. Widest framing when the rest are crops of it. Latest in the burst, because the last frame is usually the one you waited for.
Ties do not get resolved silently. When the top two frames land within a few points of each other, Keeper says “these two are close” and pre-selects neither. A confident wrong answer costs more trust than an honest shrug.
A capacity headline, rows sorted by payoff, a pre-selection you can argue with, and one confirmation that itemises exactly what leaves.
Phones are for the sweep categories. A 27-inch display is where you can see sixteen frames at once and settle a set in two seconds. Same engine, same index, a genuinely different posture.
The sidebar collapses to a popover and the contact sheet gets the room. Apple Pencil strikes through a frame to reject it and circles one to promote it — the grease-pencil gesture the whole interface is built around, and the one input where the metaphor is literal.
On a Mac the photo library is a single package you can size, back up and copy before touching. That makes the desktop the safest place to run a large first session, and the natural home for the escrow export that writes originals to an external disk.
Numbered because they genuinely are a sequence: each pass is an order of magnitude more expensive than the last and only runs on what survived the one before. That funnel is the entire reason a 48,000-asset library is tractable on a phone.
One fetch pass reads creation date, modification date, media subtype, burst identifier, favourite flag, location, dimensions and resource byte sizes. No pixels are decoded. This alone resolves screen recordings, screenshots, Recently Deleted, exact-duplicate candidates and everything size-ranked.
Comparing every photo to every other photo is 1.1 billion comparisons and a non-starter. Instead: a 64-bit difference hash from a 32×32 thumbnail, bucketed by time window and coarse geohash. Two photos only become candidates if they were taken near each other in time or place and their hashes are close. Typical libraries collapse to a few thousand groups.
Vision feature prints on a 360px thumbnail, then pairwise distance within each bucket to split a “sunset” bucket from a “sunset with the dog in it” bucket. Running this across the whole library would need roughly 400 MB of resident float vectors; running it inside buckets needs a few tens of megabytes, and the prints are discarded after clustering.
Sharpness, exposure, aesthetics, face detection, capture quality and text recognition run only on frames that landed in a group of two or more, plus the blur candidates. That is typically 15–20% of the library rather than all of it.
Groups, scores and decisions go into a SwiftData store in the app container. A library change observer keeps it live: new photos are scored in minutes, not by a full rescan. On iOS the full pass runs as a background processing task while charging, so it costs no foreground time at all.
A KeeperKit Swift package holds the models, pipeline and scoring engine; the three platform targets are SwiftUI on top of it. XcodeGen from a project manifest, SwiftFormat and SwiftLint as pre-build phases with warnings as errors, and no third-party runtime dependencies.
The pipeline takes a photo-library protocol, so tests run against a synthetic fixture library with known duplicate groups and known correct keepers. Scoring gets a regression suite so a weighting change can’t silently start picking different frames.
Decimal GB, same as the Storage screen. Where iCloud optimisation means local bytes and library bytes differ, both are shown — a headline number you can’t verify against Settings is a bug report waiting to happen.
Every photo app makes the promise, and the promise is worth nothing because the user can’t check it. Keeper’s version is structural, and a curious person can verify it in about ninety seconds.
The app ships without the network client entitlement. There is no socket to open. Settings prints the entitlement list verbatim, and the docs show the codesign command to confirm it against the shipped binary.
No analytics SDK, no crash reporter, no remote config, no A/B framework — the four things that quietly turn a private app into a telemetry pipe. Vision, Core ML, PhotoKit, Foundation.
Feature prints, aesthetics scoring, face detection and text recognition all run through the Neural Engine on hardware the user owns. No model downloads, no server-side inference, no “improve the product” opt-out buried in onboarding.
Hashes, feature prints and thumbnails live in the app container under complete-unless-open data protection — readable only while the device is unlocked. Never a shared group container, never iCloud, never a temp directory. One button wipes and re-derives.
Keeper holds read access for its entire working life. Write access is exercised exactly once per session — the deletion you confirmed — through the system’s own dialog, which the app cannot suppress or auto-dismiss.
All fourteen App Store privacy categories answered “no”. Sold once, no subscription, no account, no sign-in — nothing to have an account with.
One honest asterisk. Keeper needs full library access to work; Limited Photos Access can’t, because you cannot find duplicates among photos you aren’t allowed to see. The app explains that in one sentence at the permission prompt instead of nagging past a partial grant.
Written down now rather than discovered in month three.
Ordered so each phase ships something useful on its own. If we stop after phase two, there is still a real app on the store.
A command-line tool over KeeperKit: enumerate, bucket, feature-print, cluster, print groups and timings. No UI. The only question it answers is whether stages 2 and 3 hold up at 48,000 assets on phone-class silicon — and if they don’t, everything downstream changes.
Home, near-duplicate sets, screen recordings, screenshots, exact duplicates, Recently Deleted. The confirm sheet, the receipt, undo, the session log. macOS three-pane with full keyboard culling. This is the shippable product and it accounts for roughly 100 of the 131 GB.
Blurred and dark frames, long-tail video, forwarded media, motionless Live Photos, the escrow export, iPad Pencil gestures.
Chapters behind its switch, near-duplicate video, and local learning from overrides. Each gated on the phase before it being stable — none is worth destabilising a working app for.
Phase one is self-contained and needs no UI. It either validates the funnel timings in an afternoon, or tells us the whole approach needs rethinking before a single screen gets built.
Designing a cleanup app for something irreplaceable forced a handful of rules that generalise well beyond photos. They’re written up separately.