I wrote the engine on the native Apple stack, running on the Neural Engine, on device. Your frames are not uploaded anywhere to be looked at, because they never leave the machine in the first place. That was a design constraint before it was a marketing line: I did not want to hand a client gallery to a server, and I would not ask you to either.
Kepla is strictly read only on the card. It does not delete, move, rename, or write a reject flag to your files. If it is wrong, nothing has been lost, which is the only honest way to ship a first pass.