IP, time, path, size, and sometimes more

Web servers log requests by default, as a basic operational habit rather than a deliberate privacy decision, and an upload to a rating tool is a request like any other. The image can be deleted the same day and the log line describing the moment it arrived can still exist months later, in a system nobody thought of as photo storage at all.

What a typical access log line contains

A standard web server log entry records, at minimum, the requesting IP address, a timestamp, the path that was requested, the size of the request or response, and often a user agent string identifying the browser and device. For an upload endpoint specifically, the path might include a generated file identifier, which means the log line ties a specific IP address, at a specific second, to a specific uploaded file - even if the log never stores the file's contents. What an IP address alone can narrow down about a person is more than most people assume, and a log line is exactly where that address sits next to a timestamp and an action.

Application-level logging, layered on top of the web server's own logs, can go further: some services log request bodies for debugging, which for an upload endpoint can mean the log briefly or permanently contains a reference to the file itself, its metadata, or an error message quoting part of it.

Retention is a separate setting from the photo's own

This is the detail that catches people off guard. A service's privacy policy might describe photo retention carefully - deleted after processing, kept for thirty days, whatever the specific promise is - while saying nothing about log retention, because logs are typically owned by an infrastructure team working on a completely separate cadence from the product team who wrote that promise. Logs commonly persist for weeks or months for debugging and security purposes, on a schedule set by operational need rather than by the privacy policy's language about the photo. The photo can be genuinely gone while the log line that proves it once existed, from your IP, at that timestamp, is still sitting in a retention bucket nobody wrote a public sentence about.

Logs exist for a genuinely good reason

None of this makes logging itself a mistake. Access logs are how an operations team notices an outage, catches an abuse pattern, or reconstructs what happened during an incident, and a service with no logging at all would be worse at protecting users in exactly the moments logging matters most - a credential-stuffing attack, a sudden spike of abusive uploads, a bug silently corrupting files. The tension is not "logging bad," it is that a tool built for operational visibility doubles, without anyone deciding it should, as a record of who used the service and when, and the two purposes get almost no separate scrutiny in most privacy reviews.

Where logs travel

Logs are frequently shipped to a third-party monitoring or analytics platform rather than staying on the server that generated them, which means a log line can leave the primary company's infrastructure entirely, subject to whatever the monitoring vendor's own retention policy says. This is the same subprocessor pattern that shows up when inference itself runs on an external API, just applied to operational data instead of the model call.

What a careful policy addresses

A privacy policy worth trusting on this point says something specific about log retention, not just photo retention, and ideally distinguishes access logs from any application-level logging that might capture more. Rate Cock documents both: how long access logs are kept and that application logs are configured not to capture upload contents, which is the detail most policies skip entirely. The same distinction between "what we promise about the file" and "what our infrastructure quietly retains about the request" is worth applying to any service handling something you would not want traced back to you, including where a human reviewer's process leaves its own paper trail. Penis Rater's coverage of what a tool actually discloses touches this same gap between a product promise and an infrastructure default. It is a smaller concern for anything processed on-device rather than sent to a server at all, and what running inference locally does and does not protect is the fuller answer for anyone weighing that tradeoff, much as Measure My Cock's own data practices are worth reading for the same reason before trusting any single sentence about deletion.