Privacy
Handle a photo
with less baggage.
This first release uses a narrow boundary: the uploaded image is used for a check and is not written to this site's database or a public object store.
What this build processes
The browser selects one supported image. The server validates its bytes, dimensions, and file type, then passes it to the detector transport. We do not separately extract or store EXIF/GPS data or the original file name. Embedded metadata is not stripped from the image bytes and may be transmitted to Hive with the image.
Results and replay protection
The complete result is shown in the current browser session. To prevent a repeated request from calling Hive again, the server keeps an encrypted idempotency response only while it is within its 24-hour replay window; after 24 hours it cannot be returned. Expired entries are physically deleted by cleanup that runs while the site is in use. It is not a user history, report, download, or share link, and cleanup does not restore a used check.
Necessary cookie and quota ledger
A signed photo_guest cookie is HttpOnly, SameSite=Lax, and valid for 180 days. It supports the three-check guest allowance; it is not an account login. The server-side quota ledger stores pseudonymous identity keys, a SHA-256 image fingerprint, timestamps, quota scope, and estimated cost, not the original image. Guest allowance rows are retained for 181 days; monthly and rolling-budget rows for 62 days; daily rows for 2 days; and transient rate/lease rows for 2 hours. Cleanup that runs during site activity removes expired rows. The encrypted idempotency replay entry has a separate 24-hour validity window.
Anti-abuse verification
Guest checks use Cloudflare Turnstile as a third-party anti-abuse verification before a cost-bearing request can reach the detector. It verifies the challenge token on the server; it is separate from Hive detection and does not make an image result more accurate.
Provider and transfers
When live detection is enabled, images are sent to Hive for analysis. Hive states a default retention period of 14 days. Our service does not persist uploaded images; this does not mean Hive deletes them immediately. We do not claim that Hive excludes all data from model training. Processing locations, applicable data-use terms, and transfer arrangements must be verified before public uploads are enabled.
Optional analytics
No analytics script runs without a valid measurement ID and user consent. If optional analytics is enabled later, the visible Analytics preferences control lets you change or withdraw consent; clearing the browser's stored site choice also withdraws it. Accepted analytics sends only cleaned public page paths for page views and excludes uploads, results, scores, filenames, fingerprints, email addresses, and account IDs.
Your choices
Operated by the CheckThatPhoto team. Privacy contact: Pending email. Until the route is configured, do not upload sensitive or unlawful content or treat a detector result as proof.