— Privacy & data handling
Your images. Analyzed, then removed. Seen by no one.
People check the photos they trust least: disputed evidence, suspected scams, private conversations. So the pipeline is built so that trusting us requires believing our architecture, not our goodwill. We cannot leak, sell, or train on what we never store.
— The short version
Three commitments, no asterisks
Analyzed by software, seen by no one
Your image exists on our server for the seconds scoring takes, in memory only, and no human ever sees it. It is never written to disk, never cached, never logged, never added to a training set. The service runs on a read-only filesystem; there is nowhere for it to land.
Chain of custody you can verify
Your browser computes the SHA-256 of the exact bytes before upload. The report states the hash the server scored, and the client refuses any report whose hash differs. What was analyzed is provably what you sent.
Nothing to delete
The report is returned to your browser and kept nowhere else. Deleting it is a local action: there is no server-side copy to purge, no backup for it to linger in, no retention schedule to trust.
— The pipeline
What actually happens to your image
Most privacy pages describe policies. This one describes the request path, because the strongest privacy property we have is architectural: there is no storage step.
- 01
local hash
Before anything is uploaded, your browser computes the SHA-256 of the exact bytes. This is the fingerprint the whole analysis is anchored to.
- 02
transit
The image travels over TLS to the analysis service. No third-party analytics or storage service ever sees it.
- 03
analysis
The service decodes the image in memory, scores it with the pinned detector stack, and builds the report. Plaintext pixels exist only for those seconds, only in memory, and no human ever sees them.
- 04
report
The report (hashes, scores, verdict, limits) is returned in the response. The server keeps no copy; the image buffer is discarded.
- 05
after
What remains on our side is a size-capped operational log line: timestamp, client IP, your opaque account id, the image's SHA-256, and the verdict. Never the image, never the filename, never the report. The account database never learns which image you analyzed.
— Data at rest
What we keep, and for how long
Data minimization isn't a slogan here. The analysis needs your pixels for seconds, so that's how long they exist.
| Data | Retention | Notes |
|---|---|---|
| Image (pixels) | Never stored | In server memory for the seconds scoring takes |
| Forensic report | Not kept server-side | Returned in the response; exists only where you save it |
| Account | Until you delete it | Email, your sign-in credentials (a scrypt password hash, or the link to the Google or GitHub account you chose), and session records. Self-serve deletion on the account page removes all of it, usage records included |
| API keys | Until you revoke them or delete your account | Stored as a hash, never in readable form, alongside a name you chose and the date last used. A key you create is shown once and cannot be recovered from us afterwards |
| Usage records | Until you delete your account | One timestamp per analysis, for the weekly (trial) or monthly (Pro) quota: never which image, never a hash, never a verdict |
| Subscription & billing | Held by Polar; our copy until you delete your account | Vestige Pro is sold by Polar (polar.sh) as merchant of record. Polar receives your email and payment details and holds them under its own privacy policy; card numbers never reach us. Our database stores only your plan tier, subscription status, and period end, so we know what quota to grant |
| Abuse-control log | Size-capped rolling log | Timestamp, client IP, opaque account id, image SHA-256, verdict; no image data, no filenames, no emails |
| Site analytics | Aggregated counts, on our own server | Self-hosted, cookie-free analytics (Umami) on our own infrastructure: page views and product events like “analysis completed”. No third party receives it, no advertising identifiers, and it is never joined to your account, your images, or their hashes. Visitors are distinguished by a salted hash that resets daily; raw IPs are not stored |
We never train on your images. Not for detectors, not for calibration, not “anonymized”. Improving our models uses licensed and public benchmark data only; your uploads are evidence, not fuel. And since uploads are never stored, this is a property of the architecture, not a promise about our restraint.
— Deletion
Delete means: it was never kept
Most services make deletion a request you file and a schedule you trust. Here the image is gone the moment scoring finishes, and the report lives only where you keep it.
Discarded from memory when the analysis response is sent. There is no stored copy to delete and no backup for it to survive in.
Returned to your browser and kept nowhere else. Clearing it from your browser removes the last copy in existence. The DELETE endpoint acknowledges for API symmetry, but there is nothing on our side for it to remove.
Deleting your account on the account page permanently removes your email, sign-in credentials, sessions, and usage records, cascaded in one operation with no request to file.
Ask us for the report you generated yesterday. We cannot produce it. That's the point, and it's testable.
— Posture
Security practices
Transport encryption
TLS in transit, end to end. Hashes (SHA-256) identify images without exposing content: they appear in reports and abuse logs; pixels never do.
A minimal account database
Accounts hold exactly what the service needs: your email, your sign-in credentials (a scrypt password hash we cannot read, or, if you sign in with Google or GitHub, the link to that account, the name it reports, and short-lived sign-in tokens stored encrypted), session records, per-analysis timestamps for the quota, hashes of any API keys you create, and, for subscribers, a plan tier, status, and period end. No card details (those live with Polar, our merchant of record), no images, no reports, and no record of which image any account analyzed; the two systems are deliberately unjoinable.
Minimal, hardened service
The analysis service accepts images, returns reports, and does nothing else: read-only filesystem, no storage backend, size caps and per-IP rate limits, pinned detector checkpoints with hashes on record.
What we send you, and to whom
Account email only: address verification, password resets, and, for subscribers, billing mail from Polar. No marketing email, no newsletter, no product blasts. We never sell your address and never share it for anyone else's marketing. The only companies that handle it are the ones that run the service: our email sender, our database host, and, if you subscribe, Polar as merchant of record, which holds your details under its own privacy policy. If you sign in with Google or GitHub, that provider necessarily knows you use Vestige and gives us your name and email; we never send it anything about your analyses.
Questions & disclosures
Methodology, calibration references, and security questions: privacy@vestigeforensics.com. Report vulnerabilities to security@vestigeforensics.com.
Try it on an image you'd never email anyone
That's the standard the pipeline is built for. Free trial: no human ever sees your image, it is removed once the report is written, and the analysis is verified against the hash your own browser computed.