Privacy
Reading your photos
Catchall reads photos using Apple Intelligence, on Apple's Private Cloud Compute - Apple's secure servers built for exactly this. That's why reading needs a connection: your photos are sent to be read, and the results come back to your device.
Everything else - browsing, searching, editing, sorting - happens on your device and works offline.
Looked-up links
A field with the Looked-Up Link role is the one case where Catchall contacts a website while making records: to find, say, a film's IMDb page, it searches for the item's name. You can see which site a collection uses on its field, before a single photo is read. If no field has that role, no website is contacted.
Usage data
Settings → Privacy → Share Usage Data sends anonymous counts about how much work reading your photos takes, so Catchall can tell when people are running into Apple Intelligence limits.
It never includes photographs, record contents, names, location, or an account. There's nothing in it that identifies you or your device. Turn it off at any time, and anything still waiting to be sent is discarded.
iCloud
With sync on, your collections, records and photos are stored in your own iCloud account. Without it, they stay on your device.