Nami

Nami - Face Recognition Photo Gallery (early preview)

⚠️ Sailjail permissions updated (0.8.0): please read "sandbox permissions" section

Please read carefully the description

Nami is a privacy-first face recognition photo gallery for Sailfish OS. It scans your photo gallery, detects faces, and lets you tag and group photos by person, entirely on your device.

⚠️ This is a preliminary, experimental release (v0.8.0). Expect rough edges.

Source code: https://github.com/nicosouv/harbour-nami

About this project

This app is written by a human developer with an LLMs (Claude and Mistral Vibe). It is also an experiment: testing how to package a Sailfish OS app together with its ML models fully bundled, so it runs 100% offline out of the box.

ML models

The models are NOT downloaded at runtime. They are fetched during the CI build (SHA-256 checksum-verified) and shipped inside the RPM. Both come from the OpenCV Model Zoo:

- YuNet (face detection, MIT license)
Source: https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet
Direct file: https://media.githubusercontent.com/media/opencv/opencv_zoo/main/models/face_detection_yunet/face_detection_yunet_2023mar.onnx
- SFace (face recognition, Apache-2.0 license)
Source: https://github.com/opencv/opencv_zoo/tree/main/models/face_recognition_sface
Direct file: https://media.githubusercontent.com/media/opencv/opencv_zoo/main/models/face_recognition_sface/face_recognition_sface_2021dec.onnx

Nami requests the following sandbox permissions:

- Pictures: to scan your photo gallery.
- Documents: only for the data export feature, nothing more.
- RemovableMedia: so you can add SD card folders to the scan list. Nami only ever reads the folders you explicitly whitelist in Settings.
- Contacts + Privileged: required to read your address book for the optional "link a person to a contact" feature. On current Sailfish OS version, the contacts database lives in privileged storage, and reading it from a sandboxed app requires the Privileged permission, the Contacts permission alone gives access to an empty store. This is the same approach used by other apps (e.g. Fernschreiber).

About contacts, to be fully transparent:
- Access is strictly read-only: Nami never creates, modifies or deletes contacts.
- Nami only stores the numeric ID and display name of contacts you explicitly link.
- If you are not comfortable with this, a privacy toggle in Settings ("Contacts integration") completely disables any contact reading, even though the permission is granted. All contact-related UI disappears.
- As with everything else, nothing ever leaves your device: the app makes no network requests at runtime.

Security, privacy & anonymity

- All face detection and recognition runs locally on your device (C++ / OpenCV DNN). No cloud, no external API.
- The app makes no network requests at runtime: photos, face embeddings and names never leave your phone.
- Model files are checksum-verified at build time so you get exactly the published OpenCV Zoo models.
- Only Pictures and Documents permissions are needed. Documents is required for the data export feature, nothing more

Data storage & deletion

- Face data: detected faces, biometric embeddings, the names you assign, and manual corrections is kept in a local SQLite database on the device only.
- The database is stored with owner-only file permissions (0600), so other user accounts or processes on the device cannot read it. Note: it is not encrypted, the security model relies on the device's own storage and lock-screen protection.
- The only app settings persisted are non-personal: the folder to scan, the recognition strictness threshold, and an internal embedding-format version. No names or biometric data are stored as settings.
- One-tap "Clear all data" (in Settings, with a confirmation) wipes every photo record, detected face, biometric embedding, person name and manual correction, then runs a database VACUUM to purge the deleted data from freed pages. It also deletes the cached face-crop images from disk.
- Data export: exports your local metadata (names, photo paths, detection dates and scores) as a readable JSON file, but never the raw biometric templates, since these have no human-readable value and shouldn't be reusable elsewhere

Feedback

This is an early version, if the app doesn't work for you or you dislike something about it, I'm genuinely open to constructive criticism.

Please report issues or ideas on GitHub: https://github.com/nicosouv/harbour-nami/issues