What Happens to Your Selfie After You Upload It
A selfie stops being yours the moment the upload finishes: it becomes a file on someone else’s computer, and the useful questions start there. What travelled with it, how long it stays, what was learned from it, and what you can ask to have removed. Most face-analysis sites answer some of that in a privacy policy written to be survived rather than read.
A phone photo can carry the camera model, the exact second it was taken, and, if location was on, the coordinates of where you stood. Some sites strip that on arrival. Others keep the original file and the metadata with it. Two services with the same headline promise, that they delete your photo, can behave very differently in the first ten seconds.
What leaves the phone with the photo
The image is only part of the upload. Photographs taken on phones usually include EXIF data: camera make and model, lens, exposure, orientation, a timestamp, and often a GPS position. Some files also carry a small embedded thumbnail that survives edits made to the main image. Screenshots usually shed most of this, which is one reason a screenshot can be the more private version of a picture.
The request carries more than the file. The server sees your IP address, browser and device details, the page you came from, and any cookie or account identifier attached to the session. Then there is what the service derives: the coordinates of your face in the frame, the positions of landmarks, a numerical template, a predicted age, and a confidence figure. A policy that talks about photographs may not mention templates, and a template is the part that can be stored cheaply and compared later.
A one-photo estimate, such as the one on the site’s how old do I look page, is the smallest version of this transaction: an image goes in and a range comes out. Whether the image is kept afterwards is answered by the policy and the retention schedule, not by the interface.
Where it goes, and how long it stays
Processing can happen in memory and end when the response is sent. It can also write a temporary file, keep the upload in an account library, or copy it into cloud storage behind a content network. Logs may record the request and its metadata even when the image itself is discarded. Backups run on their own schedule, so a file deleted from the live system can persist in a weekly archive for as long as that archive is kept.
This is why “we delete your photo” is not a complete sentence. The useful version names a timeframe and a scope: within twenty-four hours, from production storage, with backups overwritten on a thirty-day cycle. Account deletion and single-image deletion are often different processes. A service that erases uploads on request and one that keeps them for ninety days of quality review can both describe themselves as privacy-friendly.
Training clauses: what “improve our models” can mean
Terms of service often grant a licence to use uploads to develop or improve the service. That phrase can cover several different practices: checking a bug against a real image, measuring accuracy on a sample, or adding photos to a training set that will shape future versions of the model. Only the third changes the model itself, and it is the one that deserves attention.
There is an asymmetry worth understanding. Deleting a file removes the file. It does not remove what a model learned from it, because that influence is spread across millions of numerical weights. Some providers offer an opt-out from training, and others do not train on uploads at all. The European Commission’s pages on the AI Act describe transparency duties for general-purpose models, including a public summary of training content, which is one place to check what a provider says about its data.
Your rights, described in general terms
Under the UK GDPR and the EU GDPR, you can ask for a copy of your data, ask for corrections, object to certain processing, and ask for erasure. The UK regulator, the ICO, explains that an erasure request should be answered within one calendar month, with a possible extension of up to two more months for complex cases. That is a concrete benchmark for judging a vague promise.
Whether a selfie counts as biometric data depends on what is done with it. The ICO’s guidance is careful here. A digital photograph is not automatically biometric data, even when it is used for identification. It becomes biometric data when specific technical processing, usually the creation of a template for automated matching, is applied, and it becomes special category data when that processing is for uniquely identifying a person. An age estimator that only measures a face may stay on the ordinary side of that line, while a system that stores a template for later comparison may not. Ask which one you are dealing with.
Other countries set their own rules, and they do not line up. Canada’s federal privacy law, Australia’s Privacy Act, various US state statutes, and Turkey’s KVKK each take a different approach to consent, retention and deletion. None of this is legal advice for your situation. The point is that you have rights somewhere, and the local regulator is the place to find out what they are. If the question is simply how old you are, the age calculator works from a birth date rather than a photograph, which is a smaller thing to hand over.
Questions to ask before you upload
Five questions do most of the work, and a site that answers them in plain language has earned a little trust.
- Does it need an account, or will it accept a file from a visitor with no sign-in?
- What is the stated retention period, and does it cover backups as well as live storage?
- Are uploads used to train or improve models, and is there a way to refuse?
- Is the analysis run on the device or on a server?
- Where do I send a deletion request, and what response time is promised?
If three of those go unanswered, assume the least favourable answer. Two habits reduce your exposure whatever the policy says: strip location data or upload a screenshot instead of the original, and avoid sending a face that belongs to someone else without asking first. A face is not a file you can take back.
FAQ
Does deleting my account delete my photos?
Usually, eventually, and not always from backups. Check the retention section for separate timelines covering account data, uploads and archives, and ask for written confirmation if the image matters to you.
Is a selfie biometric data?
Not by itself. Under UK and EU law a photograph becomes biometric data only when specific technical processing, usually a matching template, is applied, and the stricter rules for special category data apply when that processing is used to identify you uniquely.
Can a site keep my photo forever because I agreed to its terms?
Consent is not unlimited. Data protection law generally requires a lawful basis, a stated purpose, and no longer retention than the purpose needs, and consent can often be withdrawn.
What if the company is in another country?
Different rules apply, and enforcement is harder across borders. Start with the privacy policy, then the regulator in the company’s own jurisdiction, then your own.
Last updated: October 26, 2026. This article is for general information only and is not medical, veterinary or legal advice. For decisions about your own health, your pet, or a legal matter, consult a qualified professional.
Sources
- Information Commissioner’s Office, Your right to get your data deleted: ico.org.uk
- Information Commissioner’s Office, What is special category data?: ico.org.uk
- European Commission, AI Act: ec.europa.eu
