Biometric Information Policy

Some event galleries offer a way to find the photographs you appear in: you point at one photo that shows you, and the others are found by comparing faces. This page explains exactly what that does, because comparing faces is handling biometric information and you are entitled to know how it is handled before you agree to it.

The short version

• The comparison runs on your own phone or computer. The numbers describing your face are computed there, used there, and never sent to us or to anyone else.
• Nothing about your identity is stored. The measurements exist in your browser while the search runs and are gone when you close the page. Our server stores only where faces appear in each photo - coordinates, never whose face it is.
• We do not hold a database of faces, and none is being built. We cannot search for you, and neither can anyone else.
• It is off unless you switch it on. You are asked separately, for this and nothing else, and you can decline without losing anything.

What is actually processed

Two separate things happen, in two separate places. When any photo is uploaded to a gallery, the same Google service that screens uploads for prohibited content also records where faces appear in it: rectangles and a confidence score, stored with the photo. That is location, not identity - it says a face is here, never whose it is, and Google offers no way to tell. Then, when you choose a photo of yourself, your browser measures the face in it and turns those measurements into a list of numbers, sometimes called a face template. It does the same for the faces at the stored positions in the other photographs and compares the lists. Photographs whose numbers are close enough are shown to you as yours.

That list of numbers is biometric information, and it is the reason this page exists. It is created on your device, used there, and discarded there. It is never transmitted, and there is no copy of it anywhere else. The stored face positions are not biometric information: a rectangle cannot identify anyone.

How long anything is kept

The templates are kept for the duration of a single search. Closing the page, cancelling the search or navigating away destroys them, because they only ever existed in the memory of the page you had open. Face positions are kept with the photo they belong to and are deleted with it.

What we do keep is the record that you agreed: the date, the version of the wording you saw, the two confirmations you ticked, and the country the request came from. That record contains no biometric data. It is kept while the gallery exists and is deleted with the rest of the event data under the retention periods in the Privacy Policy.

Who it is available to

You must be 18 or older, and you may only search for yourself. Both are confirmations you give before the feature runs, and both are recorded. The feature is not offered to anyone signed in with a code shared between several people, because a shared code is not one person and there would be nobody whose agreement it was.

It is not offered at all to visitors in Illinois, Texas, the European Economic Area, the United Kingdom or Switzerland, and it is not offered where we cannot tell where a request came from. This is decided on our servers, not in your browser, and it applies whatever the organiser of an event has asked for.

Withdrawing

You can withdraw at any time from the same place in the gallery where you started. Withdrawing switches the feature off for you and records that you asked.

Withdrawing does not delete a face template, because there is no face template to delete. Nothing measured from your face was ever stored by us or sent to us, and whatever your browser created was destroyed when the search ended. We would rather say this plainly than let you assume we are deleting something.

Third parties

One, and not at search time. Google Cloud Vision, which already screens every upload, also detects face positions when a photo is uploaded - it receives the photo, returns rectangles, and provides no identity. The search itself involves nobody: the comparison runs in your browser and the software is served from this site, so no outside service learns that you used the feature, when, or on which event. We do not sell, lease, trade or otherwise profit from biometric information, and we do not disclose it, which is straightforward given that we never receive any.

Questions about this page: [email protected]