Find Me

Find Me — Biometric Data Policy

Version 1.0 · Last updated 20 August 2026

What this says, in plain words

  • The only biometric data we handle is face geometry: a list of numbers describing a face, computed from a photo so faces can be compared. We never collect fingerprints, voiceprints, or eye scans.
  • Your selfie: used once, then gone. The selfie you upload and the face numbers computed from it exist only in the server's working memory for your one search, and are deleted when the search ends. They are never saved to a database, file storage, or a log. As far as we know, no photo-finding service makes a stronger claim — and ours is enforced by how the system is built, not just by policy.
  • Faces in event albums are kept only while the host keeps the album connected — deleted within 30 days after the host removes the album or their account, and at most 12 months after the event's last activity.
  • We never sell biometric data or share it for value with anyone. It goes only to the cloud providers that store it for us — and to authorities only if the law compels disclosure.
  • Illinois residents: face search runs on an album only if the event host has confirmed they collected the written consents Illinois law requires.

1. What biometric data we handle

Find Me handles one kind of biometric data: Face Data — a numeric representation of face geometry (a vector "embedding") computed from a photograph, used solely to measure how similar two faces look. We handle Face Data from two sources:

  1. Guest Selfies — the photo a Guest uploads to search for themselves; and
  2. Album photos — the event photos in a Host's Google Drive folder, for each face detected in them (along with a small cropped image of each detected face).

We do not collect or handle fingerprints, voiceprints, retina or iris scans, hand scans, DNA, or gait data, and we do not scan faces from any source other than the two above.

Face Data cannot be reversed into the original photo, and we use it only for similarity comparison within the Event or Album it came from — never to identify people across events, build profiles, or verify identity.

2. The Selfie promise

When a Guest uploads a Selfie, its Face Data is computed in the server's working memory, compared against the Album's stored Face Data, and then discarded:

This is an architectural property of the system, verified in our engineering controls, not just a policy statement.

3. Retention and destruction schedule (all biometric data)

DataRetainedDestroyed
Guest Selfie + its Face DataWorking memory only, for one searchAutomatically at search completion or failure — never persisted
Album Face Data (embeddings + face crops)While the Album remains attached to the Service by its HostWithin 30 days after the Host detaches the Album or deletes their account; in any case no later than 12 months after the last activity on the associated Event (last album sync, edit, or guest search); or sooner on a verified request by the person whose face it is
Consent / attestation recordsNot biometric data — timestamps and text versions only; retention per the Privacy Policy—

Whichever trigger occurs first controls. Where a person in an Album photo asks to be removed (via the "In these photos? Opt out / report" address on our pages), we delete their face crops and Face Data for the identified photos promptly, independent of the Host.

Destruction method: deletion of the database records holding the embeddings and of the stored image objects (re-encodes, thumbnails, face crops) from primary systems, with deletion propagating through encrypted infrastructure backups within the backup rotation (no more than 35 days after primary deletion). Deleted Face Data is not archived.

4. No sale, no profit, no disclosure

We do not sell, lease, trade, or otherwise profit from biometric data, and we do not disclose it to anyone, except to the data processors that store and process it on our behalf under contract (AWS and DigitalOcean, listed in the Privacy Policy), or where disclosure is required by law or court order. We do not use biometric data to train face-recognition models, and we do not permit third parties to access it for their own purposes. If we ever charge for the Service or for access to photos, that fee is payment for the service — it is not a sale of, or profit from, biometric data: biometric data itself is never the subject of any transaction and is never exchanged for anything of value.

5. Consent

6. Illinois residents (BIPA)

For photographs of identifiable residents of Illinois, face search is available only where the Host has expressly represented and warranted that, for each such individual, the Host has (1) provided the written notice required by the Illinois Biometric Information Privacy Act — that biometric identifiers/information will be collected and stored, and the specific purpose and length of term of collection, storage, and use; (2) obtained a written release executed by the individual or, for a minor, their parent or legal guardian; and (3) kept records of those notices and releases. Absent that warranty, the Host must not attach the Album and we may disable face matching for it. This document is the written retention-and-destruction policy that BIPA Section 15(a) requires, and it is publicly available at a stable address.

7. Questions and requests

Email [opt-out/report email address] (the "In these photos? Opt out / report" link on our pages) or [privacy contact email]. Your data-protection rights and our response timelines are set out in the Privacy Policy.