Face search in client galleries: how “find photos of me” works

What it actually is

Face search indexes the faces in one gallery's photographs, so that a guest's selfie can be matched against them. It is a matching tool, not recognition in the sense of naming anybody: nothing is told who a face belongs to, and no name, age, gender or mood is attached to it.

What the index holds is a face template for each face found — a numeric representation of a face, not a picture of one — plus the record of which photograph it came from, so a match can be turned back into photographs the guest can see. No crops of faces, no facial landmarks and no inferred attributes are stored, and nothing in the index is used to train any model.

It is off unless somebody turns it on, and it is turned on for one gallery at a time. There is no setting that quietly indexes everything you have ever delivered. It is also included from the Basic plan, not the free one.

Two limits are worth knowing before you promise a client anything. Each plan indexes up to a certain number of photographs per gallery, and the gallery tells you plainly how many were past that limit and left out — so on a very large wedding a guest's search covers the indexed part of it, not necessarily every frame. And within a photograph, only the first several faces are indexed, which matters in a group shot of forty people and not at all in a portrait. Every plan lists the exact figures beside each other.

What the guest does

1. They open the gallery as usual — the link, and the password if you set one.
2. They tap Find photos of me.
3. They are told what is about to happen: that their selfie will be compared with the faces in this gallery's photographs, that this is biometric processing of their face, who does the comparing and in which region, and that the selfie is not kept.
4. They tick a consent box. Until they do, nothing happens — the search cannot run without it.
5. They choose or take a selfie, and see the photographs they appear in.

From there they can switch back to the whole gallery whenever they like, or download their own photographs if you allow downloads at all. The photographs their search found are remembered on their own device for two weeks, so coming back does not mean searching again.

If the photo they picked has no clear face in it, if nobody in the gallery matches, or if that gallery has used up its searches for the day, they are told so plainly and the gallery carries on exactly as it did before. A guest who would rather not search never has to: the feature adds a button and takes nothing away.

The selfie itself is used for that one comparison, in memory, and is never written down anywhere. That is worth saying out loud to a nervous client, because it is the part people assume is false.

What you have to do first

Switching it on is deliberately not one tap. Before anything is indexed you are shown what you are agreeing to:

• it covers everyone in the photographs, not only the guests who choose to search;
• the faces are indexed by a named provider, in a named region, on your behalf;
• every visitor to that gallery is told their faces are indexed, by whom and where — with your email address given as the way to object;
• the index is destroyed when you turn the feature off, and when the gallery is deactivated, expires or is deleted.

Only then does it ask you the question it exists to ask: do you have the consent of the people in these photographs? Saying yes is a statement on the record — your name against it, timestamped, with the wording you agreed to, in that gallery's audit log. Saying no simply closes the dialog; nothing is written and nothing is indexed.

This is the part to take seriously rather than click through. The people whose faces are indexed are your client, their family and their guests, and none of them is in the room when you flip the switch. If you have not asked them, you do not have their consent, and the confirmation says you do.

Practically: ask at the point you agree the job. A line in the contract or the booking form — that photographs may be made searchable by face in the delivery gallery, and that anybody can ask for theirs to be removed — is enough to be asking rather than assuming, and it is far easier to get before the day than after.

What happens to the face data afterwards

The short answer is that nothing about the index outlives the gallery. Some of what ends it is in your hands:

• switch the feature off for that gallery, and the index goes with it;
• give the gallery an expiry date, and the index cannot outlast it;
• delete the gallery, and there is nothing left to index.

The rest follows your account rather than the gallery: turning the feature off account-wide, or a plan that stops including it, or deleting your AI data or your account, each take the indexes with them. And none of this waits for a purge date — a sweep keeps re-checking, so "off" means gone rather than gone at the end of the month. The published schedule lists every trigger and the order things are deleted in; it is linked at the end of this guide.

Setting an expiry date on the gallery is therefore the simplest way to put an outside limit on how long any of this exists. The guide to sending a client gallery covers expiry, passwords and download rules together.

If someone asks you to take their face out

They may well ask you rather than us, because it is your name and your email on the notice in the gallery. The answer is short: turning face search off for that gallery destroys the whole index, including their templates, and the gallery goes on working as an ordinary gallery.

If one person objects and the rest of the party is using the feature happily, you have a judgement to make, and it is yours rather than ours. Switching off is immediate and reversible; what it costs is the convenience, which is not nothing at a large event.

Where to read the detail

The written schedule — exactly what is created, how long it is kept, every trigger that destroys it and how to object — is published at the face search retention and destruction schedule. It is a public page rather than an internal document, which is the point: a schedule your client cannot read is not one they can hold you to.

If you are deciding whether to use face search on a particular job, read that page first and the notice your guests will see second. Both are short, and between them they are the whole of what you are asking people to agree to. What the feature itself does, plan by plan, is on the face search feature page.