Face data
How face search works, and what we keep.
Face search is the part of Pixinoid that touches biometric data, so here's exactly what happens to a face, in plain language. If anything here is unclear, ask us.
Optional
Organisers can turn it off for any album.
Consent first
Guests agree before the camera opens.
Selfie never stored
Used for one search, then deleted.
Deleted with the album
Face templates go when the album does.
What happens when a guest takes a selfie
- 1The guest taps Find My Photos on an album that has face search on.
- 2A consent screen explains what will happen. Nothing runs unless they agree.
- 3Their phone's live camera opens. Uploading a picture from the gallery isn't possible, so nobody can search with someone else's photo.
- 4The selfie is sent once to search that album's faces, and deleted straight after.
- 5Pixinoid shows the photos that matched and remembers that list on this phone for 30 days.
What we keep, and for how long
| Data | Kept for | Why |
|---|---|---|
| The selfie | Not kept | Used for one search, then deleted. |
| Which photos matched | 30 days | Tied to a random device identifier, not to a name, so the guest can come back to their photos. |
| Face templates from album photos | Until the album is deleted | Needed so guests can search. Deleting the album deletes all of them. |
| The photos themselves | Until the organiser deletes them | Read-only after the plan ends, until deleted. |
What organisers control
- Turn face search on or off per album. With it off, guests browse instead.
- Show guests only the photos they're in, the whole album, or nothing (team only).
- Add a PIN, delete a single photo, or delete the album and all its face data.
Where faces are processed
Face matching runs on Amazon Rekognition in Amazon Web Services' Mumbai region. Each album has its own separate collection of face templates, so a search in one album can never find faces from another. Amazon processes this data only to provide the service to us.
Safeguards against misuse
- Searches are limited per phone and per album, and each album has a fixed allowance, so nobody can run thousands of searches.
- Results are only shown to the phone that searched. In albums that show guests only their own photos, a guest can open and download only the photos their selfie matched.
- Our terms forbid using face search to identify or track people who haven't agreed to it.
Want your face removed?
Ask the album's organiser to delete photos you're in, or write to privacy@pixinoid.com with the album link. We'll work with the organiser and reply within 30 days. You can also withdraw consent at any time by not using face search; there's nothing stored to withdraw for a selfie.
India's DPDP rules
India's Digital Personal Data Protection Rules treat facial images as personal data that needs clear, informed consent and deletion when it's no longer needed. Pixinoid is designed around exactly that: a consent screen before every first search, purpose-limited use and deletion with the album. Organisers remain responsible for consent from parents or guardians of guests under 18, and should turn face search off where they can't get it.