Image-editing models are spread across providers with different input schemas, aspect ratios and prices.
The constraint
No backend: keys stay in the Keychain, the app asks before the first upload to each provider, and it never reads the photo library — saving is add-only.
The approach
An allow-listed model registry with no generic fallback between schemas, inputs downscaled on the device and sent inline instead of through a public upload, and a privacy cover that keeps photos out of the app-switcher snapshot.
The outcome
Submitted to App Review; not on the App Store yet.