A bug report that tells me nothing about you

August 22, 2026 · Foldic development notes

Apple's privacy model is strict in a way I am glad about: I cannot reach into your device and look at what happened. So when Foldic gets something wrong, the only way I learn of it is if you tell me — and the real question stops being "how do I collect diagnostics" and becomes "what is a diagnostic report allowed to know about you?"

A log is more personal than it looks

Foldic keeps a plain-text log of what it did: which album it compared, which file it wrote, how long each took, what the filesystem said when something failed. One line is harmless. The whole file is a description of somebody's life — album titles are the names of children, trips, dead relatives, and the file names carry the same. Yet what I actually need is none of that: sizes, durations, error codes, and the order things happened in. The useful half and the private half sit on the same line.

Pseudonyms, not deletion

The obvious move is to strip the names out. I did not, because it would have cost me a bug I have already had to fix: an album title once aborted an entire scan on a customer's Mac, and the title was the bug — 502 bytes, padded with an invisible character to get past a spam filter, longer than the filesystem accepts as a folder name. Delete titles from reports, and that bug becomes unsolvable.

So every name becomes a short token, and a legend at the top of the report records only the shape of what it replaced — how many bytes, whether it was plain ASCII. I get to see that something was 502 bytes and not plain text. I never see what it said.

The token comes from the album's own identifier

My first attempt numbered them album#1, album#2 in order of appearance. That works for one report and breaks across two from the same person: the album that is #3 in the morning is #7 in the afternoon, and I cannot line them up.

Now the token is cut from the identifier Photos already gave the album — album-4C5010FC — stable across reports from the same device. It also covers albums deleted since: the log still mentions them, and Foldic's own record of where a deleted album's folder went is keyed by that same identifier, so even those get a token instead of leaking.

File names keep the identifier and lose the human part: IMG_8136-992A6B204A32.jpg becomes photo-992A6B204A32.jpg. The extension stays, because a HEIC, a MOV and a JPEG fail in different ways.

Two steps, because the order is not guessable

Getting the report to me turned out to be the fiddly part, for a reason that is invisible until you hit it: the share sheet can attach a file but cannot fill in a recipient. Not on iOS, not on macOS, not with any API. And the routes that can fill in an address — mailto:, Gmail's web compose — cannot carry an attachment.

My first version was a row of four buttons, and it was unusable: nothing said which to press or in what order. Now it is two numbered steps. Step one copies the address. Step two shares the report, and says in its own text to paste the address into the To field. That sentence is the whole trick — without it, people share the report and then sit in front of an empty recipient line.

What it does not promise

The redaction is best effort, and the app says so rather than claiming to be complete. Titles are exact, because Foldic knows them — but a title that is a single common word can still match text that was never a title, and a title under two characters is refused as a pattern outright, because it would match half the log.

Which is why the report is shown to you, in full, before it goes anywhere. That is the actual guarantee: a redaction whose result you can read is worth more than one that claims perfection and cannot be checked. And nothing is ever sent automatically, by any path, at any time.

Privacy first, then experience

The balance this screen tries to strike — enough for me to fix the bug, nothing that describes you — is the balance I want the whole app judged on. And the two turned out not to conflict: the report that tells me least about you is also the one that gets your problem fixed fastest, because the sizes, the timings and the error codes are all still there, readable in one pass.