In one line: the photo you check is never uploaded. It is measured inside your browser and nowhere else, so your face cannot reach us even by accident. The sections below list the few things the website itself does record.

What happens to the photo you check

Dropping a photo into the checker hands it to JavaScript running in this tab. Your browser reads the file from your disk, paints it onto a canvas, samples the pixels and takes every measurement right there. The site’s code has no upload address, no image queue and no processing server for a photo to go to. You can test this yourself: open the checker, switch off your internet connection and check a photo — it still works.

Because nothing is sent, we have no way to view, keep or leak your photo. For a document photo of your face, that matters more than for almost any other kind of file.

What the website records

Cloudflare’s request logs. Cloudflare hosts and delivers the site. Each time your browser asks for a page, Cloudflare handles the standard details of that request — your IP address, your browser’s user agent, the time and the address requested — to deliver the page, to block abuse and to count overall traffic. There are no accounts and no forms that store anything, so there is nothing else those details could be matched with.

Our own usage counts. Each page view sends a small ping, plus a second one when you leave or switch away from the tab, saying how long the page was open, so we can see which pages and tools get used. Two more pings count tool use: one named upload when you open a photo in the checker, one named checked:partial once the four automatic checks have finished but the head is still unmarked, and one named checked once all of its checks have finished. If the checker can’t get that far, a ping carries a short fixed error code instead: error:type for a file that isn’t an image, error:decode for one your browser can’t read, error:pixels if the browser won’t hand the photo’s pixels to the page. After the first full verdict of a browser session the page asks once whether the check helped; the answer is a button, never typed text, and it sends one more ping named fb:yes, fb:no:rejected, fb:no:wrong, fb:no:usage or fb:no:other. They carry only that name — not the result. A ping carries:

• the page address;
• the domain of the site that linked you here;
• the page’s language;
• any campaign tag in the link.

Our collector stores it with the time and adds a few fields of its own:

• the country and network provider that Cloudflare reports;
• a device type (phone, tablet, desktop or bot) worked out from your browser’s user agent;
• a traffic-source category such as search, social media, another website or direct;
• a quality label with a short reason code, which separates automated traffic from people;
• a visitor code made by hashing your IP address and browser details with the date and a secret key.

The visitor code changes every day, so visits can’t be linked from one day to the next. The collector answers at passports.pics/__ev, on this site’s root domain, and writes into one analytics database shared with our other websites: a Cloudflare D1 database in western North America, with no automatic expiry set yet. The code is worked out the same way on all of our sites, so visits to two of our sites on the same day carry the same code. The database never stores your IP address, but the Cloudflare Worker that receives the pings keeps a log of each raw request (your IP address, request headers and approximate location) for 7 days before it is deleted. The pings use no cookies and never contain your photo, its file name, the check results or anything you enter — the checker itself sends nothing over the network. The counts are not used to build profiles of individual visitors.

Cloudflare Web Analytics. Cloudflare also adds its own analytics script to the pages it serves for us, which counts visits and measures how quickly pages load. Cloudflare says this measurement uses no cookies or local storage and does not fingerprint visitors (Cloudflare Web Analytics).

Ads and cookies

Adsterra supplies display banners beside the content on wide desktop screens and one 320×50 banner below the tool or article on smaller screens. Loading an ad shares your IP address and browser details with Adsterra and its advertising partners; their own cookies or identifiers may be used where your browser permits them. See Adsterra’s privacy policy. Each banner runs in an isolated, sandboxed frame that cannot read this page’s inputs, uploaded images or browser storage. We do not pass tool inputs to the ad network. Advertising does not load on About, Privacy, Contact and Disclaimer pages. Blocking ads does not disable the tool. A separate 300×250 display ad sits between the upper and lower sections of longer content.

What you can control

• Every page except the checker works with JavaScript turned off, and turning it off also stops our usage pings, Cloudflare’s analytics script and the banner scripts.
• Cookies and ad personalisation are controlled in your browser’s settings.
• Questions about this policy go to hello@passports.pics.

Changes to this policy

When this policy changes, the new version will appear on this page with a fresh “last updated” date.