Privacy
IP, time, path, size, and sometimes more
Every request leaves a log line, and the line often includes enough to link an upload to a device even when the image itself is gone.
Guides on Privacy: Three kinds of hidden labels in one file, Who could see it, how, and what each path costs to close, Soft delete, backups, caches and logs, Sometimes, and the policy clause that says so is easy to miss
When you upload, the server typically writes down your IP address, the time, the requested path, the size and often your browser's user agent. The image can be deleted the same day while that log line survives for months, in a system nobody thought of as photo storage.
What a typical access log line contains
A standard web server log entry records, at minimum, the requesting IP address, a timestamp, the path that was requested, the size of the request or response, and often a user agent string identifying the browser and device. That is not a guess about unusual setups: the Apache HTTP Server documentation defines exactly these fields in its Common Log Format, and its Combined Log Format adds the referring page and the user agent. For an upload endpoint specifically, the path might include a generated file identifier, which means the log line ties a specific IP address, at a specific second, to a specific uploaded file - even if the log never stores the file's contents. What an IP address alone can narrow down about a person is more than most people assume, and a log line is exactly where that address sits next to a timestamp and an action. European data protection law treats it accordingly: Recital 30 of the GDPR names "internet protocol addresses" among the online identifiers people may be associated with.
Application-level logging, layered on top of the web server's own logs, can go further: some services log request bodies for debugging, which for an upload endpoint can mean the log briefly or permanently contains a reference to the file itself, its metadata, or an error message quoting part of it.
Retention is a separate setting from the photo's own
This is the detail that catches people off guard. A service's privacy policy might describe photo retention carefully - deleted after processing, kept for thirty days, whatever the specific promise is - while saying nothing about log retention, because logs are typically owned by an infrastructure team working on a completely separate cadence from the product team who wrote that promise. Logs commonly persist for weeks or months for debugging and security purposes, on a schedule set by operational need rather than by the privacy policy's language about the photo. The photo can be genuinely gone while the log line that proves it once existed, from your IP, at that timestamp, is still sitting in a retention bucket nobody wrote a public sentence about.
Logs exist for a genuinely good reason
None of this makes logging itself a mistake. Access logs are how an operations team notices an outage, catches an abuse pattern, or reconstructs what happened during an incident, and a service with no logging at all would be worse at protecting users in exactly the moments logging matters most - a credential-stuffing attack, a sudden spike of abusive uploads, a bug silently corrupting files. The tension is not "logging bad," it is that a tool built for operational visibility doubles, without anyone deciding it should, as a record of who used the service and when, and the two purposes get almost no separate scrutiny in most privacy reviews.
Where logs travel
Logs are frequently shipped to a third-party monitoring or analytics platform rather than staying on the server that generated them, which means a log line can leave the primary company's infrastructure entirely, subject to whatever the monitoring vendor's own retention policy says. This is the same subprocessor pattern that shows up when inference itself runs on an external API, just applied to operational data instead of the model call.
What a careful policy addresses
A privacy policy worth trusting on this point says something specific about log retention, not just photo retention, and ideally distinguishes access logs from any application-level logging that might capture more. Rate Cock documents both: how long access logs are kept and that application logs are configured not to capture upload contents, which is the detail most policies skip entirely. The same distinction between "what we promise about the file" and "what our infrastructure quietly retains about the request" is worth applying to any service handling something you would not want traced back to you, including where a human reviewer's process leaves its own paper trail. Penis Rater's coverage of what a tool actually discloses touches this same gap between a product promise and an infrastructure default. It is a smaller concern for anything processed on-device rather than sent to a server at all, and what running inference locally does and does not protect is the fuller answer for anyone weighing that tradeoff, much as Measure My Cock's own data practices are worth reading for the same reason before trusting any single sentence about deletion.