TLS protects the wire; it does not protect the server

"Encrypted" is one word covering at least three separate technical claims, and a service that satisfies one of them has said nothing about the other two. Knowing which claim is being made, and which is being left unsaid, is most of what there is to understand about this topic.

In transit: the part the padlock actually covers

When a browser shows a padlock, it means the connection uses TLS - the traffic between your device and the server is encrypted while it travels. Anyone intercepting the connection on the network in between, at a coffee shop router or an ISP, sees only ciphertext. This is close to universal now; a service without it would be conspicuous. It is also the easiest of the three claims to satisfy, because it happens automatically the moment a site is served over HTTPS, and it says nothing at all about what happens after the request lands.

At rest: the part that depends on the server operator

Encryption at rest means the stored file - sitting on a disk in a data centre - is encrypted rather than saved as plain bytes. If someone stole the physical drive, or accessed the storage layer through a misconfigured permission, they would get ciphertext rather than your photo, provided they did not also have the key.

This is where the claim gets genuinely variable. Object storage encrypted with a key the same provider manages defends against a narrower set of threats than the same storage encrypted with a key the application holds separately, because a single compromised account can potentially reach both the data and the key in the first case. Most services that say "encrypted at rest" mean the provider-managed version, which is a real protection against physical theft and a much weaker one against a compromised application account. What a breach at a rating tool would actually expose depends heavily on which version of "at rest" was actually in place.

In use: the claim almost nobody can make

The third state is the one that matters for a scoring service specifically, and it is the one no privacy page phrases the same way: at some point, to produce a score, the image has to be decrypted and handed to a model as plain pixels. There is no way around this with current inference methods. Fully homomorphic encryption - computing on data that stays encrypted the whole time - exists in research and is far too slow for the volume any consumer rating tool needs. So "in use," the photo is briefly unencrypted in the memory of whatever machine is running inference, and that window is real no matter how good the at-rest and in-transit stories are.

The honest version of a privacy claim for an image-scoring tool acknowledges this window rather than implying that encryption removes the need for anyone to ever see the pixels. A service can still minimise the window - process in memory, avoid writing the decrypted bytes to disk, discard them the moment scoring finishes - and that practice is worth more than any encryption badge, because it is the part that actually addresses the moment of real exposure.

Reading a claim correctly

When a policy says "your data is encrypted," ask which of the three states it is describing, because the sentence usually means only the first two. Rate Cock is transparent about this distinction rather than letting "encrypted" do work it cannot do: transit and storage are encrypted, and the brief window where the model actually reads the pixels is acknowledged rather than glossed over. A human judge sidesteps the in-use question entirely, since a person looking at a photo was never encrypted in the first place; what a commissioned human review involves is a different set of tradeoffs, not a safer version of this one. The method Measure My Cock uses to record data faces the same three-state distinction, since any recorded figure has to exist unencrypted at the moment it is captured. Whether the storage layer even matters as much as people assume is itself something Penis Rater's scoring coverage touches on from the accuracy side rather than the privacy one. Encryption is necessary and almost universal now; it is also frequently used to answer a question the reader was not actually asking, and what happens to an upload end to end is the fuller picture worth reading alongside it.