Privacy needs an inspectable system.

This is the complete data path for every hide workflow, including the parts that leave your device.

Standard image check

The original stays in browser memory. Metadata, visible text, faces and privacy-relevant devices are inspected on-device. Face detection locates people but never identifies them. The export is created locally.

Browser only

Mobile share target

An installed hide app keeps the shared image in a one-time device cache. It is deleted on first open or after ten minutes.

Device cache

Advanced recognition

This is off by default. After explicit opt-in, each web check sends one reduced copy to the configured recognition provider and discards it after the response.

External only with consent

Internet search

The identifiers you submit are sent to the named public services and connected search provider. Results and your review decisions are saved to your account.

Public-source queries

Account report

Findings, verdicts and check summaries are stored. Evaluation contribution is separate and off by default; when enabled it keeps only category, source type, score and Correct or Wrong.

Exportable and deletable

Creator campaign links

A campaign link stores the first content campaign connected to an account, its arrival time and completed-check counts. It never stores findings, submitted identifiers or image content.

First-touch counts only

Team summaries

Joining a team never shares images, identifiers, findings or source links. A creator can separately allow managers to see only check dates, aggregate activity counts and the number of items awaiting that creator’s review.

Creator-controlled

Provider health

After an authorised external check, hide records only the service, outcome, operation counts, latency and time. It never records the image, query, identifier or response body. Records older than 90 days are purged when the next provider-health event is written.

Operational metadata only

What hide does not do

No face identification.
No searches without authenticated self-search consent.
No advertising based on exposure findings.
No sale of personal data.
No training of shared models on private content.
No evaluation contribution without a separate opt-in.
No public demonstration from customer material unless the submitter attests their rights and explicitly permits publication.

Your controls

Confirm, reject or mark every finding uncertain.
Disconnect suggested graph relationships.
Enable or revoke sanitized verdict contribution; revocation deletes contributed records.
Choose whether saved reports remain until deletion or expire after 30, 90 or 365 days.
Download the complete account record.
Delete exposure data without resetting security controls, or delete the entire hide account.
Cancel an active plan before account deletion; the payment processor may retain transaction records required by law.
Keep advanced external recognition switched off.

Stored reports are encrypted.

Saved exposure records use Cloudflare D1. D1 automatically encrypts live databases, inactive databases and metadata at rest using AES-256 with GCM, while traffic between the application and database is protected with TLS.

Read the platform security specification

Accuracy is measured, not implied.

Hide’s private evaluation runner measures identity-match precision, known-exposure recall, localization overlap, confidence calibration and time to result. It separates faces, text, documents, landmarks and direct or multi-source matching.

Responsible disclosure

Report a reproducible security issue affecting hide. Test only with accounts and content you own or are authorised to use. Do not access other people’s data, degrade availability, or include passwords, API keys or unrelated personal information.

Each accepted submission receives a reference and is recorded for operator review. This intake is not an emergency channel and does not replace professional security review before public launch.