Privacy Policy
We never see your photo. This page lists what we do keep, why, and for how long.
Your photos
- Checked in your browser. The face check and the files you download are made on your device. A photo you choose on that device isn't uploaded to our server, and we never see it.
- While you sign in or pay, a copy of the photo waits in your browser tab's storage so you come back to the same photo. It stays on your device and goes away when you close the tab or after you download.
- Face measurements (where your eyes and chin are, for example) exist only in your browser while the page is open. We don't collect or keep them.
Sending a photo from your phone
On a computer you can choose "Use your phone" and scan the code it shows. Here is exactly what happens:
- Your phone encrypts the photo before it leaves the phone. The key that opens it is only in the link inside the code. That part of the link is never sent to our server.
- Our server stores only the encrypted file, for 15 minutes at most. It's deleted as soon as your computer has it, when you close the dialog or the page, or when the code expires.
- We can't open it. Only the computer that showed the code has the key. It opens the photo and checks it there, like a photo you choose on the computer.
- A cookie on your phone links it to the code it scanned, for 15 minutes, so no other phone can use the same code.
What we collect
- Downloads: when you use a credit, your credit history records that a photo was downloaded and when, for as long as your account exists. Not the photo. A separate download log is deleted after 90 days. Which document you chose is sent to our product analytics.
- Your IP address: only as a salted hash, never the address itself. It's kept with your sign-in session (deleted when the session ends) and in rate-limit counters (deleted a day after the limit window).
- Your account, if you make one: your email address and name from Google, your credit balance and your orders. Kept while your account exists.
- Payments: handled by our payment provider. We never see your card number.
- Feedback you send, with any screenshots: kept until we've dealt with it, and deleted with your account.
- Usage analytics: which pages are visited and which steps of the tool are used (for example, that a check finished and whether it passed, or that a photo arrived from a phone). Never the photo, the face measurements or the code's link.
Who we share it with
Only the services that run the site: hosting and storage (Cloudflare), the database (Neon), sign-in (Google), payments (Waffo), product analytics (PostHog), and error reports (Sentry). We don't sell personal information, and we don't use photos to train anything: we never receive them in a form we can open.
Biometric privacy
Because the face check runs only on your device and we never receive the measurements, or the photo in a form we can open, we don't collect biometric identifiers or biometric information. When you choose a photo you agree to the check running on your device. In baby mode, the parent or guardian confirms this before choosing a photo.
Your rights
Wherever you live, including under GDPR and CCPA, you can ask for a copy of your data, or for your account and data to be deleted. Email support@idphotopal.com from the address on your account.
Questions
Questions about this policy: support@idphotopal.com.