Data Safety · How FolioSort protects your files
Letting an app loose on decades of irreplaceable photos is an act of trust. FolioSort is engineered so that trust never has to be blind: every operation is copy-first, hash-verified, reviewed before anything is removed, and undoable after. Files go to the Trash — never oblivion — and nothing ever leaves your computer.
Photo cleanup tools ask you to point them at the most irreplaceable files you own — then move, rename and delete them by the thousand. One bad match in a duplicate scan, one dropped Wi-Fi connection during a move to the NAS, one crash halfway through an operation, and a "cleanup" becomes a loss you discover years later.
Most tools handle the happy path. The difference is what happens on the unhappy one.
Every operation is built backwards from one rule: at no point in time may there ever be fewer than one verified copy of your photo. Copies land and are checksum-verified before a source is removed. Deletions are re-verified at the moment they happen, not just when they were scanned. Interrupted runs and interrupted undos resume safely instead of leaving debris.
And because everything runs on your computer, there's no cloud outage, sync conflict or account lockout between you and your files.
The guarantees
The unhappy paths
Nothing is lost. Sources are only removed after their copy is verified, so an interrupted run leaves originals in place. Run it again — finished files are recognised and skipped.
The half-written destination file is worthless — but your original is still at the source, untouched. FolioSort never trades a verified copy for an unverified one.
Undo the operation — every one writes its own undo batch. Removed files are still sitting in the Trash. Even an interrupted undo is safe to retry.
It almost certainly never got selected: only byte-identical copies are pre-selected, similar ones are opt-in, you reviewed the list — and it was re-verified as identical at the moment of removal.
These are my kids' baby photos — I didn't want "probably fine", I wanted to understand exactly what would happen if the app crashed halfway. I pulled the plug on the NAS mid-move to test it. Everything was still there. That's when I let it run on the real archive.
The same copy-first, verified, undoable engine runs under every FolioSort tool — from a simple organize to a five-step automated workflow.
Copy-first sorting into dated folders by EXIF — with checksum verification on every file.
Explore the Organizer → Cleanup, guardedReviewed selections, conservative defaults, re-verification before the Trash, undo after.
Explore Duplicates → Automation, guardedMulti-step automated cleanup with the same guarantees — review pauses and per-step undo built in.
Explore Workflows →FAQ
Not without you seeing it first. Every feature that removes files — Duplicates, Blurry, Screenshots, Merge cleanup — shows you the full selection and waits for your confirmation before anything is applied. Removed files go to the system Trash or a folder you choose; FolioSort never permanently deletes a photo itself. The default Organizer mode is copy, which touches nothing at the source.
You lose no files. FolioSort copies first and only removes a source file after the destination copy has been written and hash-verified. An interrupted run leaves your originals in place — you just run it again, and already-transferred files are recognised and skipped.
Yes — this path is specifically hardened. When moving to a network share or external drive, FolioSort verifies the destination copy by checksum before the source is removed, so a dropped connection can never leave you with zero copies of a photo. If the network fails mid-transfer, the original stays where it was. See the NAS guide for the full workflow.
Every operation writes an undo record. Undo itself is non-destructive and retryable: if an undo is interrupted, nothing is lost and you can simply run it again. Each feature keeps its own isolated undo history, so undoing a duplicate cleanup can never disturb the results of an organize run.
The design assumes bugs can exist and defends against them. Cleanup features re-verify files immediately before trashing — a duplicate is re-checked to confirm it is still a byte-identical copy of a keeper that still exists at the moment of removal, not just when it was scanned. Symbolic links and folder junctions are guarded during traversal so an operation can never wander outside the folders you selected.
No. FolioSort runs 100% on your computer — no cloud processing, no account, no photo or face data ever leaves your machine. Even the AI Search features (Find a Person, Screenshots) run entirely on-device. The only network traffic is anonymous usage statistics, which contain no file names or personal data.
FolioSort verifies it for you: every transferred file is hash-checked against the original, and operations end with a full report of what was moved, copied, skipped and why. Merge writes a keep/skip report for every decision. And because removed files sit in the Trash, you can audit and recover anything before emptying it.
Point FolioSort at your real photos with confidence — copy-first, verified, reviewed and undoable at every step. Free to try, no account, nothing uploaded.