Skip to content
FindMyPhotoHome
Log in

FindMyPhoto — Privacy Policy

FindMyPhoto is designed with your privacy in mind. This policy explains what data we process, why, where it goes, and the choices you have. FindMyPhoto is operated by S-Industry, based in the Netherlands ("we").

1. What does the app do?

FindMyPhoto helps you find photos in which you appear. You upload one selfie and share a link to an event photo album (for example a WeTransfer, PhotoCircle, Pixieset or similar shared album). We compare your selfie against the photos in that album and show you the ones you appear in.

2. What data do we process?

  • Account data. Your email address and username when you create an account. If you sign in with Google or Apple, we receive your name and email address from them — nothing more.
  • Guest use. You can use the app without an account. We then generate a random guest ID on your device so we can show you your own results. It is not linked to your name or email.
  • Your selfie. Stored so you don't have to upload a new one for every search. Used only to find you in the albums you submit.
  • Event albums. The album link you submit and the photos we fetch from it, which we compare against your selfie.
  • Matched photos. Photos in which you were found are stored securely for up to 30 days so you can view and download them. After 30 days they are deleted automatically.
  • Notification data. If you enable notifications: your device's push token, platform (Android/iOS) and app language, so we can tell you when your results are ready in your language.
  • Technical data. Standard technical logs (such as timestamps and error information) needed to run and secure the service.

3. Facial recognition

We use facial recognition exclusively to recognise you in the albums you submit. Face comparison is performed by Amazon Web Services (AWS) Rekognition in the European Union. What is sent to it: the reference photo you chose, and the photos in the album link you submit. AWS acts solely as our processor under a data processing agreement: it processes those photos only to return the comparison result, does not use them to train or improve any model (we have opted the whole organisation out of AWS AI-service improvement), and is contractually bound to protections equivalent to those described in this policy.

Facial data is special-category personal data under Article 9 of the GDPR. We process it only on the basis of your explicit consent, which the app asks for explicitly - in a consent screen that names what is sent and to whom - before your first search. You can withdraw it at any time in Settings > Face recognition consent, which pauses new searches; deleting your account erases everything. Comparisons are transient: no face template or "faceprint" is created or stored — only your selfie, as a photo. Other individuals appearing in the album are not identified, analysed, profiled or stored as recognisable persons, and we never build a face database.

4. Notifications

Notifications are optional and off until you allow them. We send only messages about your own activity: your photo results are ready, no matches were found, a problem with an album link, a reminder about unviewed photos, and a warning shortly before your photos expire. You can turn notifications off at any time in your device settings. Your push token is removed when you log out or delete your account, and expires automatically after about 9 months of inactivity.

5. Where your data is processed

Your data is stored and processed on AWS servers in the European Union (Stockholm; face comparison in Ireland). Push notifications are delivered through Google Firebase Cloud Messaging, which receives your device's push token and the content of the notification. If you sign in with Google or Apple, they process that sign-in under their own privacy policies. We do not sell your data and we do not show advertising.

5a. Websites and cookies

Our websites are findmyphoto.app, creator.findmyphoto.app (for creators) and event.findmyphoto.app (for guests of hosted events). Vercel hosts them as our processor, with server functions in Stockholm. When you log in on a website you use the same account as in the app, and the website passes your email address and password straight to our login service on AWS; it does not store your password. The websites use only cookies that are strictly necessary: to keep you signed in and to make sure only you can log yourself out, to carry your email address between the steps of signing up or resetting your password, to keep a guest's gallery open, to remember your language, and to load the photos of an event: in a guest's gallery, in your events on findmyphoto.app when you are logged in, in the creator portal, or in a gallery the organiser has opened to anyone with the link. There are no analytics, advertising or tracking cookies and no third-party scripts, so there is no cookie banner. A domain-wide cookie is set for findmyphoto.app, all its subdomains and every path: your browser sends it to all three websites and also to cdn.findmyphoto.app, our photo server (Amazon CloudFront), which ignores it. Every other cookie below goes only to the website that set it, unless its bullet says otherwise.

  • Signing in: fmp_at and fmp_rt keep you signed in on this browser, and fmp_ui and fmp_user let the pages show it. fmp_at holds a login key that is valid for one hour. The cookie is deleted 5 minutes before the key runs out, so it lasts at most 55 minutes. After that, the next page that needs it gets a new one with fmp_rt. fmp_rt holds the key that renews it, for up to 60 days from the day you log in. It is not extended. fmp_ui holds only a "1" that page scripts can read, so the header can show "Account" instead of "Log in", and it lasts as long as fmp_rt. The creator portal also reads it to notice a log-out elsewhere. fmp_at, fmp_rt and fmp_ui are domain-wide, so one login works on all three websites. fmp_user holds your username, your email address and the ID of your account. The account pages use it to show your username and email address. Only findmyphoto.app sets and receives it. It lasts as long as fmp_at, so at most 55 minutes, and findmyphoto.app writes it again when it renews fmp_at. The creator and event websites delete a stray copy they find, and findmyphoto.app deletes it once fmp_rt is gone. fmp_user_fill holds a "1" for 60 seconds, on findmyphoto.app only. It keeps the website from repeating, within that minute, the quick step that writes a missing fmp_user.
  • Logging out: Log out, Sign out everywhere and deleting your account each end by sending your browser to a log-out address on that website. That address deletes fmp_at, fmp_rt, fmp_ui, fmp_user and fmp_user_fill, each in both forms (the copy for that one website and the domain-wide copy), and, for every event whose fmp_cdn_exp cookie your browser sends, that cookie and the event's photo cookies. It does this only when the address carries the one-time code held in fmp_logout, so a link on another site cannot log you out. fmp_logout holds a random code. It lasts at most 2 minutes, is set by the website where you log out, is sent only to that log-out address, and is deleted again there. A log-out in the creator portal cannot delete the copy of fmp_user that findmyphoto.app holds for itself. That copy goes the next time findmyphoto.app sees you without fmp_rt, or when it expires, at most 55 minutes after it was written. Log out clears this browser only. Sign out everywhere also asks our login service to end all your logins, the app's included. The websites also delete the login cookies when your login is refused and cannot be renewed. None of this removes fmp_gs, fmp_lang or the items kept in your browser, except that the creator portal's Log out deletes its own upload lists and zip notes (see the last bullet).
  • Signing up and resetting your password: fmp_pending holds your email address between the steps, so it never appears in a web address. It also holds whether you are signing up or resetting, and when the last code was sent, so that a new code can be sent at most once every 30 seconds. For a sign-up it can also hold up to two marks, each a "1": that this address already had a sign-up waiting for its code, and that you came from "Forgot password?" for an address that never finished signing up. The code step and the page after it use these marks to tell you what to do next. It lasts 15 minutes after the last step, or until you finish. Only findmyphoto.app sets and receives it.
  • Language: fmp_lang holds "en" or "nl" and remembers your language for 1 year after it was last set. It is domain-wide. On findmyphoto.app it is set when you choose a language, and also when you open a page in a language other than the one saved or, if none is saved, the one your browser asks for. On event.findmyphoto.app and creator.findmyphoto.app, which have no language switch, it is set only by a link with ?lang=en or ?lang=nl.
  • Guest galleries: on event.findmyphoto.app, fmp_gs keeps your gallery open. It is set when you open your gallery link or finish joining an event, and only event.findmyphoto.app receives it. It lasts until your gallery session ends, at most 12 hours. It holds the session key, your participant ID, and a copy of what the gallery shows about the event and you: the event's name, code, logo, state, download rules, General tab setting and end date; the organiser's name and handle; the consent text version you accepted and when; whether you chose a one-time or a keep-me-posted search; whether your selfie is still kept; and how many photos match you and how many the event has. It also holds when that copy was last refreshed. It does not hold your email address. It is removed when it expires, when the gallery finds that your session has ended, and when you choose "Delete my selfie and matches", which also removes that event's photo cookies. Logging out of an account does not remove it.
  • Event photos: the CloudFront-Policy, CloudFront-Signature and CloudFront-Key-Pair-Id cookies let your browser load the photos of one event from cdn.findmyphoto.app. They hold a signed permission for that event only (its ID and when it ends) and no personal data. They are set in a guest's gallery, in your events on findmyphoto.app when you are logged in, and in the creator portal for a creator's own events. They are set for findmyphoto.app and all its subdomains, but only for the path /events/ followed by the event's ID. So your browser sends them only with requests under that path: the event's photos on cdn.findmyphoto.app and, in the creator portal, the event's own pages on creator.findmyphoto.app, which do not use them. Each set lasts at most 12 hours, and never past the event's end date (the end of its retention period). When a set has run out or is about to, the page asks for a new one, as long as your gallery session or login lasts and the event has not ended. For each event there is also a cookie named fmp_cdn_exp_ followed by the event's ID. It holds a letter and a time: what the photo cookies reach (a: the whole event, originals included; v: only the versions the gallery shows) and until when they work, so the website knows when to ask for new ones. It lasts as long as the photo cookies, but it is domain-wide, so it goes with every request to all three websites and to cdn.findmyphoto.app. A log-out removes all of these.
  • Open galleries: opening a gallery the organiser has opened to anyone with the link sets only these photo cookies and their fmp_cdn_exp cookie, for that one event. Each set lasts at most 1 hour and never past the event's end date, and a page that stays open asks for a new set shortly before the old one runs out. There is no session cookie, you do not sign in, and you do not give us a selfie, an email address or a name.
  • Kept in your browser, not in cookies: your browser does not send these items to us by itself, and each website has its own storage. On findmyphoto.app: your choice of light, dark or system theme (key theme), saved when you pick one in the header. On creator.findmyphoto.app: your choice of light or dark (the same key, theme), saved only when you press the portal's light/dark switch, which every portal page shows (the log-in page included); until then your device's setting applies. On event.findmyphoto.app: that you dismissed the "Get the FindMyPhoto app" card with "Not now" (key fmp_app_card_dismissed). These have no expiry date; they stay until you clear this browser's data for that website. On findmyphoto.app and event.findmyphoto.app, when you ask for a "Download all" zip in a gallery, the browser tab keeps in its session storage (cleared when you close the tab) the zip's ID, when you asked for it and when its hourly limit ends (key fmp_zip_ followed by the event and the tab), so that after a reload the page follows the same zip instead of asking for a second one. One older than 48 hours is ignored. When the page follows the zip, it sends us the zip's ID.
  • Kept in your browser by the creator portal: on creator.findmyphoto.app, the portal keeps these in your browser's local storage. Each event's upload list (key fmp_upload_queue_ followed by the event's ID) holds, for each file you added, its name, size, type and last-modified time, how far its upload got (for a file of 8 MiB or more, the upload's ID and a receipt for each part already sent), our ID for the photo, and the result, for example rejected or duplicate. It lets an upload carry on after a reload once you select the same file again; the files themselves are not kept. The list itself has no expiry date, but finished uploads are dropped when you next open the event after the list has not changed for a day, and are deleted from your browser the next time the list changes. Uploads that did not finish stay until they finish or you cancel them. When an upload carries on, the portal sends us our ID for the photo and the receipts of its parts. fmp_upload_zip_ followed by the event's ID holds the ID and start time of a "Download all photos" zip you asked for in the Photos tab, so the page follows it after a reload. It is deleted when the zip is ready or has failed, and one older than 48 hours is ignored. The portal's Log out asks first if files are still sending in this tab or in another portal tab. To find out, the tab where you press Log out checks its own uploads and, if it is not sending, sends a short message, with a random tab number, to your other portal tabs in this browser, and waits up to about 0.4 seconds for one of them to answer that it is sending files. Nothing about this is stored, and the message does not leave your browser. If the log-out does not go through, the uploads carry on and nothing is deleted. When it goes through, the portal stops the uploads in all its open tabs (it tells them with a message) and deletes the upload lists and zip notes. A log-out on findmyphoto.app cannot reach these items; an open portal page that notices it deletes its list the next time the list would change.

If you join the waitlist for creators, we keep your name, email address and role and what you tell us about your events, only to invite you to the beta and to answer you. We delete it when you ask, and in any case 12 months after you signed up.

6. How long do we keep it?

  • Matched photos: up to 30 days, then deleted automatically. Photos you save to your own device fall outside our processing.
  • Your selfie: as long as your account is active; permanently deleted when you delete your account.
  • Account data: until you delete your account.
  • Push tokens: until you log out, delete your account, or after around 9 months of inactivity.
  • Album data: temporary copies used for matching are kept for at most 30 days.

7. Your responsibility

You may only upload a selfie of yourself, and only submit albums you have legitimate access to. The albums you submit may contain photos of other people, but the app must not be used to identify, analyse, track or profile anyone other than yourself.

8. Your rights and control

You remain in full control of your data. Under the GDPR you have the right to access, correct, delete, restrict and export your data, and to object to processing. To exercise any of these rights, email support@findmyphoto.app.

You can delete your account at any time in the app (Settings → Delete Account); this permanently removes your selfie, your photos and your account data. If you no longer have the app installed, email us instead — see Delete your account for both routes. You can also withdraw your consent for facial recognition at any time under Settings → Face recognition consent; new searches then stop until you agree again. If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encryption in transit, signed time-limited photo links, and strict access controls.

10. Changes

We may update this policy as the app evolves. Significant changes will be announced in the app. The date at the top shows the latest revision.

11. Who is responsible, and questions

The controller for the data described above is:

  • S-Industry, trade name of Sem van Embden
  • Goudse Rijweg 497, 3031 CG Rotterdam, Netherlands
  • Chamber of Commerce (KvK) number: 94484124
  • Email: support@findmyphoto.app

If you have questions about privacy or security, or want to exercise any of the rights in section 8, email support@findmyphoto.app. You also have the right to lodge a complaint with your local supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.