What we hold, and what we cannot.
Most privacy policies describe intentions. This one describes an architecture: for most of what you give FaceGUID, we could not hand it over if we were compelled to, because it is encrypted with a key derived from your face and that key never reaches us.
Last updated 31 August 2026.
- No image or video of your face is ever transmitted or stored. The camera runs in your browser; what leaves is a 128-number mathematical descriptor, and only to match you against existing identities.
- We cannot read your vault or your documents. They are encrypted in your browser under a key we never receive. This is a property of the design, not a promise about our conduct.
- We do not sell, lease, trade or share your data with anyone, for any purpose, ever. There is no advertising on this service and no third-party analytics.
- You can delete everything, yourself, in about a minute — and it is a real deletion, described below.
This is the complete list. If it is not here, we do not have it.
| What | Why | Can we read it? | Kept |
|---|---|---|---|
| Face template 128 floating-point numbers |
To recognise you as the same person on a later visit, and to guarantee one face resolves to one GUID. | Encrypted at rest under a server key; decrypted in memory only during a match. It is not an image and cannot be turned back into your face. | Until you delete your identity. |
| Helper data the fuzzy-commitment mask |
Lets a fresh scan of your face reproduce the same exact key. | Yes, and it is useless without your face. | Until you delete your identity. |
| Wrapped keys | Your vault key and signing key, encrypted under your face-derived key. | No. Opaque ciphertext. | Until you delete your identity. |
| Vault records | The secrets you chose to store. | No. Ciphertext, plus truncated HMAC search tokens that cannot be inverted into your search terms. | Until you delete them. |
| Sealed documents | The files you chose to seal, and the signature that proves it. | No. Chunk-wise ciphertext in Cloudflare R2. We hold the byte count and the plaintext hash, not the contents or the filename. | Until you delete them. |
| Linked identifiers email, mobile, websites, social profiles |
Only what you explicitly add and verify. Released to an application only when you grant that scope. | Yes — these are claims about public identifiers, so they are stored in the clear. | Until you remove them. |
| Activity log | Event names and times: enrolled, signed in, revealed a record. Never contents. | Yes, including the IP address the request came from. | Until you delete your identity. |
| Proof receipts | Which application asked you to prove you are human, when, and whether the proof was spent — so a proof cannot be replayed, and so you can see who asked. | Yes. It records the per-application identifier, never what you did on their site. | Until you delete your identity. |
| Rate-limit counters | To stop automated abuse of face matching. | A count against a hashed key including your IP address. | Ten minutes. |
A face template is biometric data, and is treated as a special category of personal data under the UK and EU GDPR, and as a biometric identifier under laws such as the Illinois Biometric Information Privacy Act. So, plainly:
- Lawful basis: your explicit consent, given when you choose to enrol. There is no other basis and no legitimate-interest argument being made here.
- Purpose limitation. The template is used for one thing: matching a face to its GUID. It is not used for demographic inference, emotion detection, surveillance, advertising, training any model, or anything else.
- We never sell, lease, trade or profit from biometric identifiers, and we do not disclose them to anyone — including applications that use FaceGUID to log you in. They receive an identifier, never biometric data.
- Withdrawing consent is deletion, and you can do it yourself at any time.
- No image or video is retained at any point, including transiently on our servers. Frames are processed in your browser and discarded there.
On the Accounts page, signed in with your face: Delete my FaceGUID. It asks for one more live face check, because deletion is irreversible and a stolen session should not be able to do it.
What that removes: the face template, the helper data, every wrapped key, every vault record, every sealed document (including the encrypted bytes in object storage), every linked identifier, every application grant and access token, every proof receipt, the activity log, and any developer credentials or organisations you created.
What it means: the same face will afterwards enrol as a new GUID, with no connection to the old one. Nothing is retained, so nothing can be restored — including by us, and including for you.
One cookie: fg_session. It is an HMAC-signed token proving a
face check happened recently, it lasts thirty minutes, and it is HttpOnly, Secure and
SameSite=Lax. It is strictly necessary for the service to function.
There are no analytics cookies, no advertising cookies, no pixels, no fingerprinting, no session recording, and no third-party scripts of any kind. The site's own Content-Security-Policy forbids loading scripts from anywhere but this origin, which you can verify in your browser's network tab rather than taking our word for it.
One processor: Cloudflare, Inc., which provides the compute, the database and the object storage this service runs on. Nothing is sent to any other company. There are no third-party CDNs — even the face-recognition models are served from this origin.
If you use email or SMS verification for a linked identifier, that one message is delivered by a transactional provider and contains only a one-time code.
Under the UK GDPR, the EU GDPR and comparable laws you have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority.
In practice: access and portability are already yours — the Accounts page shows everything we hold about you, and your vault and documents are yours to export at any time. Erasure is the delete control above. For anything else, or to complain, write to privacy@faceguid.com.
We will not ask you to prove your identity with a face scan in order to exercise a right. Email is enough.
FaceGUID is not intended for anyone under 16, and we do not knowingly enrol them. If you believe a child has enrolled, write to privacy@faceguid.com and we will delete the identity.
If this policy changes in a way that affects what we collect or who can read it, the change will be dated here and announced on the service before it takes effect.
Privacy questions: privacy@faceguid.com. Security reports: security@faceguid.com (see security.txt). Who operates this service, and where: About.