Some event galleries offer a way to find the photographs you appear in: you point at one photo that shows you, and the others are found by comparing faces. This page explains exactly what that does, because comparing faces is handling biometric information and you are entitled to know how it is handled before you agree to it.
The short version
- The comparison runs on your own phone or computer. The numbers describing your face are computed there, used there, and never sent to us or to anyone else.
- Nothing about your identity reaches us. The measurements are made on your device and saved there, encrypted, so that searching again is quick; they expire after three months and withdrawing erases them at once. Our server stores only where faces appear in each photo - coordinates, never whose face it is: nothing is cut out of the photographs themselves, and the cut-outs stored until 22 September 2026 have been deleted.
- We do not hold a database of faces, and none is being built. We cannot search for you, and neither can anyone else.
- It is off unless you switch it on. You are asked separately, for this and nothing else, and you can decline without losing anything.
What is actually processed
Two separate things happen, in two separate places. When any photo is uploaded to a gallery, the same Google service that screens uploads for prohibited content also records where faces appear in it: rectangles and a confidence score, stored with the photo. Nothing is cut out of the photograph itself, and the cut-outs stored until 22 September 2026 have been deleted; your phone compares faces in the same pictures the gallery already shows you. That is location, not identity - it says a face is here, never whose it is, and Google offers no way to tell. Then, when you choose a photo of yourself, your browser measures the face in it and turns those measurements into a list of numbers, sometimes called a face template. It does the same for the faces at the stored positions in the other photographs and compares the lists. Photographs whose numbers are close enough are shown to you as yours.
That list of numbers is biometric information, and it is the reason this page exists. It is created on your device and stays on your device. It is never transmitted, and there is no copy of it anywhere else. Because measuring a large album takes a phone several minutes, the lists are saved on that device, encrypted under a key made on it and never readable outside it, so a later search does not repeat the work; they cover the other faces in the photographs your device looked at as well as your own, which is why they are kept where only you can reach them, expire on their own, and go the moment you withdraw. The stored face positions are not biometric information: a rectangle cannot identify anyone. Nothing is measured from the photographs on our side, and nothing is cut out of them to be measured from later.
How long anything is kept
The templates are kept on the device that made them, for three months at most, and only there. Nothing about them exists on our side, so there is nothing for us to keep, hand over or lose. They go earlier than that in three cases: you withdraw your agreement, you clear this site's data in your browser, or the storage runs out and the oldest are dropped. Three months is not an arbitrary round number: an event gallery closes to guests about three months after the event, so a measurement older than that describes photographs you can no longer open. Alongside them your device keeps three small things that are not measurements: which photos you confirmed as you, which results you marked as not you, and what your last search found. They go when you withdraw, together with the rest. Face positions are kept with the photo they belong to and are deleted with it. The cut-outs that used to be kept beside them were destroyed on 22 September 2026, in every project, ahead of the photographs they came from.
What we do keep is the record that you agreed: the date, the version of the wording you saw, the two confirmations you ticked, and the country the request came from. That record contains no biometric data. It is kept while the gallery exists and is deleted with the rest of the event data under the retention periods in the Privacy Policy.
Who it is available to
You must be 18 or older, and you may only search for yourself. Both are confirmations you give before the feature runs, and both are recorded. The feature is not offered to anyone signed in with a code shared between several people, because a shared code is not one person and there would be nobody whose agreement it was.
It is not offered at all to visitors in Illinois, Texas, Colorado, Washington, the European Economic Area, the United Kingdom, Switzerland or Russia, and it is not offered where we cannot tell where a request came from. This is decided on our servers, not in your browser, and it applies whatever the organiser of an event has asked for.
Withdrawing
You can withdraw at any time from the same place in the gallery where you started. Withdrawing switches the feature off for you and records that you asked.
Withdrawing erases the measurements saved on this device, straight away rather than at the next visit. It does not delete anything on our side, because nothing measured from your face was ever stored by us or sent to us. So withdrawal reaches everything there is: what your own device kept, and nothing anywhere else, because there is nothing anywhere else. Withdrawing on one device does not empty another one you searched from; use the same page there.
Third parties
One, and not at search time. Google Cloud Vision, which already screens every upload, also detects face positions when a photo is uploaded - it receives the photo, returns rectangles, and provides no identity. The search itself involves nobody: the comparison runs in your browser and the software is served from this site, so no outside service learns that you used the feature, when, or on which event. We do not sell, lease, trade or otherwise profit from biometric information, and we do not disclose it, which is straightforward given that we never receive any.
Questions about this page: [email protected]