Privacy
Hashing identifies; it does not hide
Storing a hash instead of an image is described as privacy-preserving, and it is - unless the point of the hash is to recognise the same photo again.
Guides on Privacy: Who could see it, how, and what each path costs to close, Soft delete, backups, caches and logs, Sometimes, and the policy clause that says so is easy to miss
No, a hash of your photo is not anonymisation: a hash that lets a service recognise your image again still identifies it. "We only store a hash" can still be a real privacy win, depending on the kind of hash, but the word covers two very different mechanisms.
Two things called a hash
A cryptographic hash - SHA-256 is the common example - is designed so that changing a single pixel produces a completely different output, with no relationship between similar inputs and similar hashes. Its purpose is integrity checking: confirming a file has not been altered, or that two files are byte-for-byte identical. Two photos that are visually indistinguishable but differ by one recompression will hash to two completely unrelated strings.
A perceptual hash - the kind used for duplicate detection and content moderation - is designed to do the opposite. Similar images produce similar hashes on purpose, so the system can recognise a resized, recompressed, or lightly cropped version of a photo it has seen before. The mechanism behind this and the legitimate reasons a service runs it are covered in more detail elsewhere - deduplication, caching, and moderation are all real, unobjectionable uses.
Why "just a hash" undersells what it does
A cryptographic hash of your photo genuinely cannot be used to find your photo again unless someone already has the exact original file to compare against - it is close to one-way in the sense that matters for privacy, because there is no way to search for "images similar to this hash." A perceptual hash is close to one-way in the opposite sense that matters: it cannot easily be turned back into the image, but it absolutely can be used to recognise that image, or a near-duplicate of it, anywhere else the same hash shows up. That is the entire point of building one. Describing a perceptual hash with the same "we don't keep your image, just a hash" language used for cryptographic hashes blurs a distinction that changes what the retained data can actually do. The US Federal Trade Commission made the general point in a 2024 note from its Office of Technology: hashing "still creates a unique signature that can track a person or device over time."
The re-identification path
If a service keeps a perceptual hash after deleting the original photo, and that hash later matches a new upload from the same person, or leaks, or gets subpoenaed elsewhere, the "anonymous" record becomes a link between two events. This is the same structural problem a stored embedding creates: the photo is gone, but the fingerprint that lets the system recognise it again is not, and recognition is re-identification in everything but name. Whether that fingerprint could be pushed further, toward reconstructing something closer to the original image, is a related but distinct technical question from whether it can simply be matched.
What a policy should actually say
"We store a hash, not the image" is not a complete sentence for privacy purposes. A complete version names which kind of hash, what it is used for, and how long it is kept relative to how long the image itself is kept - if the hash outlives the image by a wide margin, the retention decision was made about the hash, and the image's short lifespan is doing less privacy work than it appears to. Claims about anonymised datasets deserve the same close reading, since "anonymised" and "hashed" both function as reassurance words that can mean several different things depending on which mechanism sits behind them.
Where the honest answer sits
Rate Cock describes what it retains after a scoring pass in its privacy documentation, and the useful test for any tool - this one included - is whether that documentation names the hash type rather than just the word "hash." A measurement service faces a related question about what identifies a repeat submission without keeping the original photo, and Measure My Cock's data practices are worth reading with the same distinction in mind. Comparing retention claims across tools side by side is the kind of groundwork Penis Rater's tool coverage is built to support, and a hashing claim is one of the details worth checking before assuming "no image stored" means "nothing identifying stored." None of this applies to a human reviewer in the same way, since a judge on Rate Penis is working from memory and notes rather than a machine-computed fingerprint, which is a different retention question with a different answer.