The long version,
including the gaps

What the gallery is

A Windows program that reads folders you already have — your Pictures folder, an external drive, the OneDrive or Dropbox directory a sync client already keeps on this PC — and builds an index beside itself, never inside them. Nothing is moved, renamed, re-encoded or written to. The index is a single file in the program's own folder under %LOCALAPPDATA%.

On top of that index sits a picture-understanding model that runs on this machine. It turns each picture into 512 numbers and turns your sentence into 512 numbers, and the answer is the pictures whose numbers point the same way. That is the whole trick, and it is why you can ask for “snow on a mountain” without anybody having tagged anything.

What it is not: it searches nothing on the internet. There is no account, no sign-in, no catalogue and no cloud side — the word “cloud” here only ever means a folder your own sync client already put on your own disk. It is also not an editor: there is no crop, no exposure, no export, no sidecar, and no feature that writes to a photograph.

Finding a picture

Five tools share one index, and each answers a different shape of question.

• Describe it. Type a phrase and the grid re-orders so the closest matches come first, judged on what is in the frame rather than the filename. It ranks rather than filters, so a phrase that only half worked leaves you scrolling instead of staring at an empty grid.
• More like this one. Press S on an open picture, or right-click a tile, and the grid becomes the 48 nearest to it. The panel keeps the picture it is matching against on screen, because the grid it came from has gone.
• Tags. Every indexed picture is scored against a fixed vocabulary of fifty concepts and keeps at most five, and only those that clearly stand out from that picture's own average — a picture that matches nothing stays untagged rather than being given a bad label. They arrive as a cloud of chips you click to filter. They are not shown per picture, cannot be edited, and cannot be added to.
• Groups. Sorts the whole library into visual themes — twelve by default, anything from two to sixty-four — and names each from that same vocabulary. Deterministic, so an unchanged library gives the same groups twice.
• Duplicates and oddities. Near-duplicates rather than identical files: the re-encoded, resized and re-exported copies a checksum walks straight past, shown side by side with a match percentage. Also the pictures least like everything else you own. Nothing is deleted, moved or merged — it is a review aid, and which copy to keep is a judgement you make by looking.

Two one-time steps, and neither happens on its own. The model is a 438 MB download you start by pressing a button, and then the library has to be indexed by pressing another. Adding pictures later does not index them — until you run it again, the new ones are invisible to all five tools, and a search will not show them. The five tools also replace one another rather than stacking: you cannot search inside a tag. Ordinary filters — date, folder, camera, size — do narrow any of their results.

Sources and scanning

Point it at a folder and it indexes what is there, leaving the files where they are with the names you gave them. Attach a folder that already contains one of your sources and the two collapse into one rather than counting everything twice — and the tags and vectors of the folder underneath survive the merge.

It will also go and find the folders your sync clients already keep: OneDrive personal and work, including a second signed-in account; every linked Dropbox; the Google Drive virtual drive on whatever letter it landed on; and iCloud Photos and iCloud Drive separately. This is detection, not integration — no account, no sign-in, no API call, nothing uploaded. It finds folders, on your disk, that another program put there.

Files that live only in the cloud are catalogued from the directory entry alone and never opened, so pointing it at a 200 GB OneDrive downloads nothing. Those rows carry no dimensions, date or location until the file is actually on this PC, and the scanner marks them to be re-read the moment it is. Drawing previews for them is a separate switch, off by default, because turning it on costs a full download per thumbnail.

A rescan reads nothing it does not have to: matching size and modification time means the file is not opened at all. And if a scan of an attached folder comes back empty while the index holds rows for it, nothing is deleted — that is what an unplugged drive looks like, and absence is not an instruction to forget.

Filters and the query language

Everything the index knows is a filter, and the choices are built from your own library rather than from a fixed list — the camera menu contains the cameras you own, commonest first.

• Pictures or video; landscape, portrait and square as three combinable boxes, with anything within 5% of square counted as square.
• File type chips with live counts, five size bands plus a custom range, and a video length range that leaves stills alone.
• Eight date ranges plus a custom from-and-to, on capture date where there is one and modified date otherwise, labelled so you know which you got.
• Camera, lens, ISO, aperture, focal length and exposure, once the camera-data pass has run.
• A folder filter with a searchable, counted, multi-select list of subfolders.
• A typed query language with eighteen fields, including rating>=75 — Windows stores stars on a 0–99 scale, and 75 is four of them.

The star rating your camera or Windows already wrote is searchable, but there is no way to set one: no star control, no favourite toggle, no shortcut. Similarly, the thirteen EXIF fields behind those filters have no screen that shows them for the picture you are looking at. Both are built and indexed; only the last inch of interface is missing.

Places and the map

Photographs carry the coordinates they were taken at, and the gallery reads them the awkward way — out of the degrees-minutes-seconds vector rather than the decimal fields Windows also offers, because those turn out to fill in the longitude and leave the latitude empty, which silently puts every one of your holidays on the equator.

Plotted, they cluster, they can be drawn as a heatmap or as a trail, and you can drag a box around a bay and the grid becomes what is inside it. Places are also a plain list of 25 km clusters with counts, which is the fastest way in if you would rather not touch a map at all.

There is no map behind it out of the box, and that is deliberate. The earlier build of this program hotlinked somebody else's tile servers, which none of their terms allow from a distributed application. So it ships with no provider: your pins, clusters and box-selection all work, on a plain coloured ground, until you paste in a provider you have the right to use. Place names are the same story — the coordinates are always yours and always shown, and turning them into “Lisbon” needs a geocoding service you configure. Neither is us, and neither is on until you do it.

Two things worth knowing before you rely on it: the map always plots the whole library rather than what the grid is currently showing, and the pin's “open in Google Maps” link goes to Google whatever tile provider you configured.

Scanning and importing

Importing works and is the best-tested thing in this half of the program. Point it at a memory card, a USB stick or a sync folder and it copies what is new, verifies every file byte-for-byte with a SHA-256 computed on write and re-read from disk, files it by date, and never deletes anything from the source. It will not import the same picture twice. Importing from a phone or camera over MTP is built too — but no phone has ever been plugged into it, and the one real bug found so far was found by reading the code rather than by using it.

Scanning is organised as projects: named folders that remember their own settings, with pages named and numbered so they sort correctly however many you make. The settings you choose are clamped to what the driver says the hardware can do, and if a page cannot be converted to the format you asked for it is kept in whatever the driver produced rather than thrown away — paper may already be back in the drawer.

No scanner has ever been connected to this program. Three driver stacks are written — WinRT, WIA and TWAIN — and every part above the driver call is covered by tests; every driver call below it is unproven. TWAIN is about 1,100 lines of hand-written interop that has never executed, and Windows does not ship the library it needs, so on most machines it will not even appear. The gallery may fairly be said to have scanning written; it may not be said to have been shown to scan. There is also no OCR and no PDF anywhere in it — a feeder run gives you a numbered set of image files, not a document.

And nothing here can be stopped once started: a two-thousand-file import has to be waited out. Cards and scanners are found when you press Look again, not when you plug them in.

What it sends

Nothing, by default, and there is no setting that changes that on its own. No telemetry, no analytics, no crash reporting, no update ping, no account and no sign-in — checked as an absence across the whole source tree rather than asserted. Your pictures are never uploaded anywhere, and neither is anything you type into the search box.

There are exactly six ways a byte can leave, and you start every one of them:

• The model download. 438 MB from Hugging Face when you press the button, each file verified against a checksum pinned in the source. Nothing of yours goes with the request.
• Map tiles from a provider you configured. Off until you do.
• Place names from a geocoding service you configured, sent a coordinate rounded onto a kilometre grid. Off until you do.
• Previews for online-only files, which is a download from your own cloud account. Off by default.
• The Microsoft Store, when you press the button offering the codec that would open a file.
• Google Maps, if you click the location link on an open picture.

The gallery has no account of its own and no sync of any kind. Nothing it does depends on a server of ours, and there is nothing for it to sign in to.