The photo stays; the result and telemetry may not

On-device inference is a genuine privacy improvement, and it is also a narrower one than the phrase suggests. The photo not leaving your phone is one specific promise, and it is easy to hear it as a promise about everything.

What "on-device" actually guarantees

When a model runs locally, the image is loaded into memory, processed by a model stored on the phone, and the result is computed without the pixels ever being sent anywhere. That is a real and checkable claim: a network monitor on the device can confirm no image-sized payload leaves during inference, which is the kind of thing a technically minded user can verify rather than take on faith. It removes an entire category of risk at once - no server ever holds the file, so there is nothing to breach, subpoena, or retain past its usefulness on that specific data point.

What it does not cover

The result is a separate payload from the photo, and most apps still send it somewhere: to sync across your devices, to populate a history you can review later, or simply because the app's backend expects a record of activity. A score, a verdict string, or a small metadata object is much smaller than an image and easy to overlook as "just a number," but it is still information about you tied to a timestamp and, usually, an account. Crash reporting is a second gap. If the app crashes during or near an inference call, many crash-reporting frameworks capture local state to help debug the failure, and that capture is not guaranteed to exclude whatever was in memory at the time, including the image itself in the worst case. Analytics is a third. Event tracking - "scored an image," "opened result screen," "session duration" - typically continues to run and typically continues to phone home, because analytics and inference are separate parts of the app built by separate teams with separate defaults.

None of these three make the on-device claim false. They make it a claim about one specific data flow, not about the app as a whole, and the difference matters if the reason you wanted on-device processing was to keep everything about the interaction private rather than just the file.

What to actually check

A privacy policy that says inference happens on-device should also say, separately, what the app does with the result: whether it syncs to an account, whether it is retained locally only, and whether analytics is scoped to exclude image-adjacent events. If it only addresses the image, that silence is informative. Where a model actually runs is the mechanical question behind this - the architecture that makes on-device possible in the first place - and is worth reading first if the distinction between server and device inference itself is unclear.

The model itself has to come from somewhere

On-device inference still requires the model to be on the device, and getting it there is its own small network event, separate from any single scoring session. The app downloads a model file, usually once, sometimes updated periodically as the vendor retrains it, and that download can be tracked - its size, its timing, and the fact that it happened at all - without the download itself containing anything about you. This is a minor point next to the image question, but it explains why an app can claim on-device processing and still show a "downloading model" step the first time you open it, and why that step needs its own network permission that has nothing to do with your photo.

Where this sits against the alternative

Server-side inference is the default for most tools because it allows a larger model and does not depend on the phone's hardware, and what actually happens to a photo once it reaches a server is the more common case worth understanding on its own terms. Rate Cock runs inference server-side like most comparable tools, which trades the on-device guarantee for a more capable model, a trade worth being aware of rather than assuming one approach is simply better. Running an open-weight model yourself removes the server question entirely rather than narrowing it, and that option is covered as a separate path by Measure My Cock's coverage of the hardware and software involved. A commissioned human reviewer is, by definition, not an on-device question at all - a person looking at your photo is a different kind of exposure, one Rate Penis's review coverage addresses directly. How different scoring tools compare on what they retain, on-device or not, is the kind of side-by-side Penis Rater's tools pages are built for.