Topic
Privacy
What happens to a photo you upload to an AI tool, and what to check before you do.
-
Incognito hides your history, not your upload
A private window stops your own device remembering. It does nothing about the server on the other end.
-
Three kinds of hidden labels in one file
Photo files carry several metadata formats that live in different places and are stripped differently.
-
A short document that answers most privacy questions
A model card names training data sources, evaluation and intended use; its absence from a rating tool is informative in itself.
-
Anonymisation of images is harder than of tables
A service that says it trains on anonymised images is making a claim that is difficult to make true for photographs, and worth reading closely.
-
Look at what the file says about you
Every platform has a way to show the metadata inside a photo, and reading it once is more instructive than any list of what might be there.
-
The sentence about how long they keep it, decoded
Retention clauses use a small set of phrasings, and each maps to a specific reality about where the file sits and for how long.
-
Third-party inference, subprocessors and a second privacy policy
Many tools call an external model API, so the file is seen by at least two organisations, and the second one's terms apply too.
-
Coordinates to a few metres, plus altitude and heading
Photo GPS is not a city name; it is a coordinate pair to a few metres, often with altitude and compass bearing, which locates a room.
-
The number is stored even when the photo is not
Results, timestamps and per-axis numbers are kept as account data, and a history of them says things about a person that a single one does not.
-
The device remembers even if you did not save anything
Logged-in sessions, autofilled emails and cached images persist on a borrowed or family device after you have closed the tab.
-
One upload, several near-copies left behind
Taking several frames to pick one leaves the others in your camera roll and cloud backup, where they persist after the chosen one is deleted.
-
Self-hosting removes the upload entirely
Open-weight vision models make it possible to score locally, which trades convenience and possibly quality for the removal of every server-side question.
-
A screenshot is a new file with its own metadata
Screenshotting a photo drops the original EXIF and writes fresh fields about your device and screen, which is less than before but not nothing.
-
Identifiability does not require a face
A photo can identify a person through marks, setting, metadata or linkage to an account, so 'no face' does not settle the question.
-
The phrases that should stop you
Some clauses are boilerplate; a few, in a tool that handles intimate images, are decisive, and they are easy to list.
-
Derived data outlives the file
Services often keep the model's numeric representation of a photo after deleting the photo, and whether that is personal data is a live question.
-
Everything else hangs off it
An account's email links uploads, results and payments across time, and a reused address links them to everything else that address touched.
-
IMG_4021.HEIC says more than it looks like
Default filenames encode device conventions and sequence, and a service that keeps original names keeps a small identifier you did not think about.
-
Some strip it, some keep it, and 'document' mode changes the answer
Sending a photo through a chat app usually recompresses and strips it, unless you send it as a file, in which case everything stays.
-
Blur can be partly undone; a crop cannot
Blurred and pixelated regions have been reconstructed in research, while cropped pixels are simply gone, which settles the choice.
-
Container differences that matter for what leaks
HEIC and JPEG store metadata differently, and conversion between them can drop, keep or rewrite fields in ways that are not obvious.
-
What stays on the device you used
The result page, the thumbnail and the URLs remain in local cache and history until cleared, which matters more on a shared machine than a server ever will.
-
Memorisation, and how likely it is for a scoring model
Generative models have reproduced training images; a scoring model outputs numbers, which makes extraction far harder but not a non-question.
-
Backup retention outlives every other setting
Backups exist to survive deletion, so an upload can persist in a backup rotation long after it is gone everywhere else.
-
A partial face is enough for a face-recognition system
Face-matching models work from far less than a full face, so an edge of one in frame is a linkage risk that cropping fixes and blurring may not.
-
Model improvement often means human eyes
Training data needs labels, and labels usually come from people, so 'used to improve the model' can mean a contractor viewed the image.
-
A promise with several possible mechanisms behind it
The sentence can mean in-memory processing, short TTL storage, or storage of derivatives, and each is a different privacy outcome.
-
Inversion attacks, and what they recover
An embedding is lossy, but research has shown partial reconstruction from some models, so 'we only keep the vector' is a weaker promise than it sounds.
-
Crop, filter, export - and the EXIF is often still there
Most editors preserve metadata by default because photographers want it, so an edited export is not a cleaned one.
-
What a VPN covers in an upload
A VPN changes the address the service sees; it does not touch metadata, account linkage, payment or fingerprinting, which is most of the risk.
-
Synthetic data avoids uploads, with its own catch
Some teams train on generated images so no user photo enters training, which is a real privacy gain and a real accuracy trade.
-
A device identifier hiding in MakerNotes
Some cameras and phones write a body or sensor serial into metadata, which links every photo from that device to each other.
-
The privacy question is not only yours
An upload of another person's image raises consent and lawfulness questions that no policy of the tool resolves for you.
-
C2PA metadata, and what it discloses
Some cameras and apps now sign photos with provenance data that can include device and edit history, which is a new field to strip.
-
The mechanics behind 'we have deleted your data
A deletion request triggers a process, and how thorough it is depends on whether the service can find every copy it made.
-
Clicking a link tells the next site where you came from
Browsers send the referring URL by default, so following a link from a results page can disclose that page to the destination.
-
Edge caches hold images after the origin forgets them
An image served through a CDN can sit at edge nodes past its deletion at the origin, until the cache expires or is purged.
-
The payment processor knows who you are
An anonymous account becomes a named one at checkout, and the linkage lives with the processor and in the service's records.
-
The result can appear where anyone can read it
Push and email notifications preview their contents on the lock screen and in inboxes, so the score can be seen without unlocking anything.
-
IP, time, path, size, and sometimes more
Every request leaves a log line, and the line often includes enough to link an upload to a device even when the image itself is gone.
-
The photo stays; the result and telemetry may not
Running the model on your phone means the image never uploads, but results, crash reports and analytics can still leave, so read what does.
-
Metadata is not only an EXIF thing
PNG images can hold text fields, editing history and even prompts from generation tools, and most stripping advice forgets them.
-
No account is not the same as no identifier
An upload without an account still arrives from an IP address at a time, and that pair narrows a person down more than most people assume.
-
Inventory the data first, then judge the risk
A breach exposes whatever was retained: files, derivatives, results, emails, logs; the harm depends on which of those the service kept.
-
Your camera roll may already be on a server
If photos sync automatically, the image reached a cloud provider before you chose to upload it anywhere, under that provider's terms.
-
How image search matches, and what it needs
Reverse search finds near-duplicates well and different-photo matches poorly, so the risk depends on whether the same file was ever posted elsewhere.
-
Data region, jurisdiction and what it means for a photo
The country a file is stored in decides which rules govern it, and most services do not say, which is itself an answer.
-
A time-limited link is a capability, not a login
Many services hand out signed links to stored files; anyone holding the link can open it until it expires, and the expiry varies wildly.
-
Debugging pipelines capture inputs
When inference fails, some systems save the failing input for engineers, and that path is rarely covered by the retention promise.
-
The tag on the page reports the visit somewhere else
Third-party analytics and ad scripts see the page URL and often the visitor identity, so the visit is known to more than the site.
-
A rule on a bucket, not a person pressing delete
Most services store uploads in object storage with automatic expiry rules, and the rule's setting is the real retention period.
-
Location is the headline; the rest is the fingerprint
A photo file carries camera model, serial number, lens, software version and timestamps, and together they identify a device even without coordinates.
-
Cropping the photo does not always crop the preview inside it
Many files carry a small preview image in their metadata, and some editors leave it untouched, so the original framing rides along with the crop.
-
Internal access controls are the part you cannot verify
Encryption and deletion aside, the question is which staff can view stored images and whether access is logged, and few policies say.
-
A still that carries a short clip and its own metadata
Live and motion photos bundle a video segment with the still, and uploading the bundle uploads the seconds around the shot.
-
Shareable links carry the thing they share
A result URL that encodes the score or an image ID can be read from history, logs and referrers, so the link itself is data.
-
Strip EXIF before you upload anything
Your camera writes your location into the file. Removing it is quick, permanent, and worth doing before any upload rather than after.
-
Browser and device traits as an identifier
A site can recognise a returning browser from its configuration alone, so clearing cookies does not make two uploads unlinkable.
-
TLS protects the wire; it does not protect the server
A padlock in the browser means the upload was encrypted on the way; what happens once it arrives is a separate question with a separate answer.
-
Hashing identifies; it does not hide
Storing a hash instead of an image is described as privacy-preserving, and it is - unless the point of the hash is to recognise the same photo again.
-
What actually happens to a photo you upload
The file leaves your device, and where it goes next varies enormously between tools. What to check, and what the answers should be.
-
Who could see it, how, and what each path costs to close
Listing the realistic paths from upload to unwanted exposure turns a vague worry into a short set of checks, most of which are cheap.
-
Soft delete, backups, caches and logs
Deleting a file from an app removes a pointer; the bytes can persist in backups, caches and logs for as long as each is retained.
-
Sometimes, and the policy clause that says so is easy to miss
Some services use uploads to improve their models, some do not, and the sentence that tells you which is usually not where you expect it.