Photohawk app: Face Data Policy

Version: 1.2
Effective date: 9 November 2026
Applies to: the Photohawk app for iPhone and Android (in the app stores as "Photohawk"; "the app") and its cloud face-matching service, made by CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk ("Photohawk", "we", "us").
Published at: photohawk.com/face-data-policy/family

This is the Photohawk app part of Photohawk's face data policy (photohawk.com/face-data-policy). Photohawk Studio, for event and business galleries, has its own section there. The two are separate: face data is never shared, mixed or matched between the Photohawk app and Photohawk Studio.

This policy explains what face data the app creates, why, where it is kept, and when it is destroyed. It is written to meet the Illinois Biometric Information Privacy Act (BIPA) standard for a publicly available written policy with a retention schedule and destruction guidelines, and similar laws elsewhere, even though the app is not offered in Illinois.

1. What "face data" means here

Grouping the people in your photos is what the app does. To do it, the app finds the faces in the photos and videos on your phone and creates:

• Face cut-outs: small pictures of each face it found (the face and a margin around it, 160 pixels across), sent in batches to our cloud face-matching service, which keeps them, encrypted (section 4). Never whole photos or videos.
• Face templates: for each face, a list of numbers (a mathematical representation of the face) that tells whether two faces are likely the same person. The cloud service makes them from the cut-outs and keeps them in a collection that holds only your faces. If the cloud service is paused or refuses (for example where it isn't offered), the phone makes face templates itself. A face template cannot be turned back into a photo of the face.
• Matching results in the cloud: which faces the cloud service groups together, how alike each face is to the others (similarity scores, and lists of each face's closest matches), possible matches the app asks you about ("Is this Maya too?"), and groups that may be one person. They are worked out from face templates, so we treat them as face data too.
• Face positions: where in each photo, and when in each video, the faces are.
• Groups: which faces belong to the same person, the corrections you make ("not this person", merging two groups), and the names you give the groups.
• Age estimates: for each face the cloud service matches, an estimated age range, which comes back to your phone and is kept there (the cloud service does not keep it). It is used only to recognise people who look like children, so that they are never offered as someone to send photos to, and to show ages on photos of a child you set up. You can always change who is a child on a person's page, and your choice wins.
• Birthdays, relationships and contacts: a birthday you add for a person, how the people you've grouped are related to you and to each other ("Maya is Tom's daughter"), and, if you choose to match people with your contacts, the phone contact you confirm for a person (its identifier, and the number or email you chose; never for a child). These stay on your phone; a number or email goes only as an invite's address when you invite that person.

Together these are "face data". Face data is a kind of biometric identifier or biometric information under some laws, and special category (biometric) data under the EU and UK GDPR.

Recognising pets and the kind of scene in your photos doesn't use face data.

2. Consent first

The app creates no face data unless you agree, and asks twice, separately, before it scans:

1. Face grouping: the consent screen explains, in your language, what is made on your phone, that face cut-outs go to your own collection in our cloud, what it is used for, that it covers everyone in your photos, children included, how long it is kept and how to delete it. You tick a box (it starts unticked) and tap "Agree and continue".
2. Cloud face matching: a second screen explains that small face cut-outs (never your photos or videos) go to your own private face collection in our cloud service (Amazon Web Services, EU (Ireland)); that we keep the cut-outs there, encrypted, with the face templates made from them, so new photos can be matched, your faces can be matched again, and we can look into a problem when you ask us for help; that only our systems and, to help with your account, Photohawk's support team can open them, and every time they do is logged; and how long they are kept. You tap "Agree and continue".

Grouping the people in your photos is what the app does, so both are needed to use it. If you don't agree, the app makes no face data and sends nothing; you can go back, or delete your account. People who only receive photos and chat (they joined from an invite and haven't chosen to scan their own photos) are not asked, and no face data is made for them.

We rely on your explicit consent (GDPR Art. 9(2)(a), and the equivalent in other laws). You can withdraw it at any time by tapping "Delete all face data" in Settings → Privacy and data: everything is deleted, on the phone and in the cloud, and the app asks again before it makes any more. The app records, on your phone, that you agreed, when, which version of the wording you agreed to and in which language; our service also records the version and time of the cloud face matching consent, and the country (and US state) you told the app you live in. If the wording changes, the app asks again, and makes or sends no new face data until you agree.

The cloud face matching wording of 6 November 2026 is the first to say that the cut-outs are kept. The app asks everyone who agreed to an earlier wording to read and agree to it; nothing is deleted by asking. Until you agree to it, our service doesn't keep your cut-outs: each batch is deleted as soon as it is matched (section 4), as before.

3. Purpose

Face data is used only to:

1. group your photos and videos by the people in them;
2. let you search your photos and videos by person;
3. help you choose which photos to share with the people in them, if you decide to share; and
4. keep people who look like children from being offered as people to send photos to (age estimates, section 1);
5. match your faces again from the kept cut-outs, without your phone sending them again: for example when grouping improves, after a fault, or to fix two people mixed up or one person split in two; and
6. look into problems with your face grouping when we support you or keep the service working (section 6).

Face data is never used for advertising, marketing, profiling, identity verification, to find out who anyone is (for Photohawk or anyone else), to match faces across different users, or to train or improve models. It is never compared with, or added to, the face data of Photohawk Studio galleries.

4. Where face data is kept

On your phone. Face data is stored in the app's private storage, protected by the phone's app sandbox and storage encryption, and excluded from iCloud and iTunes/Finder backups on iPhone and from Android cloud backup and device-to-device transfer. Names, corrections, birthdays, relationships, contacts and age estimates stay only on your phone.

In the cloud.

• The phone sends face cut-outs in batches over an encrypted connection (TLS) to Photohawk's service, which uses Amazon Rekognition (Amazon Web Services, EU (Ireland) region) as our processor to make the face templates. With each cut-out go only the app's own reference for the face, a code for its photo that means nothing outside your phone (so two faces of one photo are never matched to each other) and the face's size.
• The cut-outs are kept, in a private store in the same EU (Ireland) region. Each one is encrypted with a key that belongs to your account alone (AES-256-GCM; the key itself is protected by AWS Key Management Service), and the store is encrypted again with a key we manage there. Files are named by a random code for your account, never your name, email or account ID. Public access is blocked, and there are no download links: no app, website or person can download a cut-out, the Photohawk app included. Our matching service opens them only to match your faces; people open them only as section 6 describes. A cut-out in which no face is found is deleted.
• The face templates and the matching results are kept in a collection, and records, that hold only your faces; they are never compared with anyone else's faces or with Photohawk Studio's.
• If you haven't agreed to the cloud face matching wording of 6 November 2026 (section 2), the cut-outs aren't kept: each batch is deleted as soon as its faces are matched (within minutes; an automatic rule deletes anything left after a day).
• We never receive your photos or videos for this (apart from photos you share, which are encrypted so we can't see them, and prints you order), which photo a face comes from, or the names, birthdays, ages, relationships or corrections you add.

Not in shares. When you share photos, only the photos you choose are sent (encrypted end to end). Face templates, face positions, groups and group names are never part of a share.

5. Retention schedule and destruction

Face data is kept only as long as needed for the purposes above, and is permanently destroyed at the earliest of:

Deletion on the phone removes the face templates, face positions, groups, names, corrections, age estimates, birthdays, relationships and contacts, and then securely compacts the app's database so the deleted records are overwritten. Deletion in the cloud removes your whole face collection at Amazon Rekognition (every template), the matching results, and our records of it, including the consent record. The kept cut-outs go in two steps: first the key that opens them, at once, so they can't be opened from that moment; then the files themselves, in the same step, with a daily check that deletes anything left over. Everything is gone within 24 hours. The cut-out store keeps no earlier versions or copies. Deleting face data never deletes photos or videos.

Texas and Washington. Face data is destroyed as soon as its purpose ends (you delete your face data or your account, or ask us to), and in any case within the periods above. If you stop using the app without deleting anything, the purpose is treated as ended after 3 years without use, when the data is destroyed automatically (Texas Bus. & Com. Code § 503.001; Washington RCW 19.375).

6. No sale, no disclosure

Photohawk does not and will not sell, lease, trade or otherwise profit from face data. Face data in the cloud is processed by Amazon Web Services only on our instructions, under its data processing terms, to provide cloud face matching to you. We don't disclose face data to anyone else unless the law requires it.

Who at Photohawk can see it. Our systems use your cut-outs only to match your faces. Only Photohawk's owner and support staff the owner names, each with their own sign-in, can look at your cut-outs or the matching results, or have your faces matched again, and only to support your account (for example when you ask us about two people mixed up) or to keep the service working for you (for example after a fault). They don't try to find out who the people in them are. Every support action on your face data is recorded in an audit log (who, when, which account, by a code, and why), kept for 3 years; the log itself holds no face data.

7. Not available in Illinois

The Photohawk app is not offered to people who tell it they live in Illinois. Illinois law asks for written consent from everyone whose face is in your photos, not only from you, and the app cannot yet obtain that properly. The app asks where you live when you first open it. It does not use GPS or your IP address for this. If you say you live in Illinois, nothing is scanned and no face data is made (our service also refuses cloud matching for Illinois), and if you later change to Illinois, existing face data is deleted, on the phone and in the cloud.

8. Other people in your photos, and children

Your photos and videos include other people, often children and people who don't use Photohawk. The app creates face data for every face it finds, for your own use as described above: on your phone, and in your own collection in the cloud, where their cut-outs are kept like yours. Our cloud service doesn't know which faces are children's, so their cut-outs are kept and protected in the same way. Support staff may see them only as section 6 describes, to fix your grouping. Face data is never used to find out who anyone is, for Photohawk or for other users, and is deleted on the schedule above. People the app thinks are children are never offered as people to send photos to, can't be matched with your contacts, and can't be chosen as "This is me". Please use face grouping and sharing respectfully, and only share photos you have the right to share.

9. Your choices

• Delete all face data (on the phone and in the cloud, kept cut-outs included) at any time: Settings → Privacy and data → Delete all face data. The app then asks for your agreement again before making any more.
• Delete your account at any time: Settings → Plan and account → Delete account, or photohawk.com/personal/delete-account.
• Remove a face from a group ("not this person"), merge groups, hide or rename people, and change whether a person is a child.
• Read this policy in the app (Settings → Help and legal → Face data policy) and at the address above.

For face data in the cloud you can also ask us to access or delete it (support@photohawk.com); deletion requests are carried out by deleting your whole cloud face collection.

10. Changes

If we change this policy in a way that affects face data, the app will ask for your consent again before creating or sending any more face data.

Version history:

• 1.2, 9 November 2026: the cloud keeps the face cut-outs, encrypted with a key for your account alone, to match your faces again and to support you (asked for with the updated cloud face matching wording of 6 November 2026; until you agree, cut-outs are deleted as soon as matched); matching results (similarity scores and closest matches) named as face data; who at Photohawk can see face data, and the audit log; cloud deletion within 24 hours; the in-app paths.
• 1.1, 28 October 2026: face grouping and cloud face matching are required to use the app (two separate consents, withdrawn with "Delete all face data"); cloud face data is no longer deleted 30 days after a plan ends (it is kept while you use the app and deleted on the events in section 5); deleting your account also deletes the face data on your phone; the app isn't offered in Illinois; age estimates, birthdays, relationships and contacts added to section 1; the consent is shown in the app's language. Everyone who agreed to an earlier version is asked again.
• 1.0, 20 October 2026: first published version.

11. Contact

CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom. Email: support@photohawk.com.