Finding your photos by face

This page explains a feature that is not yet available in ShareCam. It is published in advance so the rules are clear before anything is switched on.

What the feature does

At a big event, your photos are scattered across hundreds of shots taken by other people. This feature lets you find the ones you appear in: you take a selfie, and your phone compares it against the photos in that one event album.

What data is created

To compare faces, your phone turns your selfie into a face signature — a set of numbers describing the geometry of your face. Under Illinois law this is a "scan of face geometry"; under EU law it is biometric data. We treat it as sensitive personal data in every country, regardless of what the local law requires.

Where it is processed

Entirely on your own device. The face signature is never uploaded to ShareCam's servers, never sent to a third party, and never leaves your phone. We do not have a copy of it and could not produce one if asked.

We want to be straight with you about one thing: processing on the device is a genuine privacy protection, but courts have not accepted it as a complete legal answer. That is exactly why the feature is opt-in, why it is off by default, and why it is unavailable in the places listed below.

Retention and destruction schedule

• The face signature exists only while the search is running.
• It is destroyed as soon as results are shown, and in every case when you close the album, at the latest within 24 hours of being created.
• Nothing derived from your face is written to our database, our file storage, our logs, or our backups.
• The selfie you take for the search is not saved to the album unless you explicitly upload it as a photo.

Who it is shared with

No one. Not the event host, not other guests, not advertisers, not any analytics or AI-training provider. There is nothing to share, because the signature never reaches us.

Saying no, and changing your mind

• The feature is off unless you turn it on. Nothing happens to your face until you tap the button and take a selfie.
• Declining does not affect the album. You can still join, upload, browse and download exactly as before. We will never make album access conditional on this.
• You are never scanned because someone else opted in. Only the person who starts a search has their own face processed.
• There is nothing to delete afterwards, because nothing is kept.

Where the feature is not offered

The feature is switched off for users in Illinois, Texas and Washington in the United States. Those states have specific biometric privacy statutes, and we would rather withhold a convenience feature than operate in a grey area.

The event host's role

A host can turn this feature off for their whole event, and it stays off until they turn it on. A host can never see anyone's face signature, cannot search for a specific guest, and cannot obtain a list of who appears in which photo.

Questions

Write to [email protected] and a human will answer. If you are in the EU/EEA or the UK you also have the rights described in our Privacy Policy.