Privacy
Data region, jurisdiction and what it means for a photo
The country a file is stored in decides which rules govern it, and most services do not say, which is itself an answer.
Guides on Privacy: Who could see it, how, and what each path costs to close, Soft delete, backups, caches and logs, Sometimes, and the policy clause that says so is easy to miss
Where a photo is stored helps decide which law applies: the country holding the disk shapes who can compel access, what a breach obligates the company to disclose, and which regulator has authority. It is not the only factor - where the company operates matters too - but "where is my data stored" is not a technicality.
Why the region matters more than the encryption
A photo can be encrypted at rest and in transit and the jurisdiction question is still live, because encryption defends against unauthorised access, not against a lawful order directed at the company holding the key. Different countries have very different standards for what compels a company to hand over data, how much notice a user gets, and whether the request can be legally silenced. A data protection regime like the EU's, which grants specific individual rights - access, deletion, portability - turns mostly on where the company operates or where the data subject is, not simply where the server sits. Article 3 of the GDPR applies it to processing by an EU establishment "regardless of whether the processing itself takes place within the Union." Moving data out of the EU is a separate question: the European Commission's adequacy decision for the EU-US Data Privacy Framework, adopted on 10 July 2023, lets personal data flow freely only to US companies that participate in the framework.
Why services are vague about this
Multi-region cloud infrastructure, covered below, is a real reason some policies stay vague. It does not fully explain silence, though - a service can still name its primary storage region and its backup regions even if the picture has several parts, and choosing not to is itself informative about how much thought went into disclosure generally.
What to actually check
Look for the words "data residency," "data region," "stored in," or a specific cloud region name in the privacy policy or terms. A service naming a specific region - "primary storage in the EU," "servers located in the United States" - has given you something concrete to reason about. A service that describes only "industry-standard security measures" without ever locating the data has told you it either has not settled the question internally or does not think you will ask. A retention clause worth reading closely usually addresses region alongside duration, because the two questions are answered by the same underlying infrastructure decision.
Why multi-region infrastructure complicates the question further
A single company can genuinely have more than one honest answer to "where is the data," and not as an evasion. Primary storage might sit in one region for latency reasons, backups might replicate to a second region for disaster recovery, and inference might route to whichever data centre has spare capacity at the moment a request arrives. Each of those is a separate hop with its own jurisdiction, and a policy that only names the primary storage region has answered the easiest part of the question while leaving the backup and inference hops unaddressed. This is not a reason to give up on asking - it is a reason to expect a fuller answer than a single country name, and to treat a policy that lists more than one region as more credible than one that lists none at all.
Not legal advice, just the shape of the question
This post is not going to tell you which country's regime is strongest, because that answer depends on your own situation, changes as laws change, and is exactly the kind of claim that goes stale fastest in a piece like this. What stays true regardless of which regime you compare is that jurisdiction is a real variable, that it is set by infrastructure choices rather than by marketing language, and that a service willing to name its region has cleared a bar that plenty of services quietly skip. Rate Cock states its primary storage region directly in its policy rather than leaving the question to inference, which is the baseline this post is arguing every service handling this kind of photo should meet. The same question applies to a measurement record as much as to a rating: where Measure My Cock stores the data behind a recorded figure is worth the same check. A human-review service sidesteps some of this by keeping the file with a person rather than a server farm, though how a commissioned review is actually handled raises its own version of the same jurisdiction question once payment and communication are involved. Comparing tools on this basis specifically is a more useful exercise than comparing them on score alone, and it pairs naturally with checking what a breach at any of them would actually expose.