What you should see
Raza Songs should connect only to your own devices: your Mac and iPhone on the local network, and your own Tailscale devices if you've turned on remote access. Raza Photos should do the same, plus requests to Apple Maps for map tiles and place-name lookups. Nothing should go to Raza Software, and nothing should go to an analytics or advertising domain, because there is no telemetry. When the App Store installs or updates an app, that traffic is the App Store's, not the app's.
Check 1, on your iPhone: App Privacy Report (five minutes)
On iOS 15.2 or later, open Settings → Privacy & Security → App Privacy Report and turn it on. Use the apps for a while, then open App Network Activity and find Raza Photos or Raza Songs. Apple documents that the report lists the web domains an app contacted over the past seven days. You should see none that belong to us. Raza Photos may list Apple's map domains, because of the map view. Apple: About App Privacy Report →
Check 2, on your Mac: a network monitor
Install a network monitor such as Little Snitch, or the free, open-source LuLu, and launch the app. Each outgoing connection asks you to allow or deny it. Deny everything outside your local network and use the apps normally: browsing, playing, editing and saving metadata all work. You'll be asked about Apple Maps in Raza Photos, and that's the only exception.
Disconnect the router from the internet and use the apps at home. Browsing and playing work the same, with one difference: Raza Photos can't load map tiles or place names without a connection.
Check 3, for the technical: capture the traffic
If you'd rather see the packets, capture on the Mac's network interface or on a mirrored port of your router, using Wireshark or tcpdump, and look at the destinations. You should see mDNS announcements (UDP port 5353 to 224.0.0.251 and ff02::fb), connections to the other devices on your local network, and for Raza Photos, Apple Maps. There should be no connections to any domain of ours, because we don't have any servers to receive them. Because traffic between your devices is always encrypted with TLS 1.3, a capture shows who is talking to whom and how much, not the contents.
What these checks can't prove
They show where data goes. They can't show what the code does with it locally, because the apps aren't open source. If where it goes is the question you care about, these checks answer it. If you need to inspect the code itself, that is a fair line to draw, and we'd rather say so than pretend otherwise.
Found something unexpected?
Please email us with what you saw: razaphotos@outlook.com or razamusic@outlook.com. We'd rather hear about it than have you wonder.