Privacy

ARGUS searches for a face. That makes almost everything on this page biometric data, so it is written to be specific rather than reassuring: what is held, where, and for exactly how long.

The search itself

• The photo you choose. Faces are found in your own browser, before anything is uploaded — your photo is not sent anywhere for that step. When you start a search we upload only the face you picked, cropped out of the photo. The rest of the picture never leaves your device and we never receive the original file.
• That crop, stored with your case. We keep the cropped face for 30 days. It is what lets your report show the photo you searched with, and what lets you return to a report you paid for. It is destroyed on day 30 — see how long things live.
• A copy in your browser.The crop and the landmark points measured from it are held in your tab's session storage so the scanning screen can draw them. That copy is on your device only, and your browser discards it when you close the tab.
• Results. Thumbnails, source links and match scores returned by the index. The thumbnails are faces too, so they are treated the same way and destroyed on the same schedule.

Your account

You can register at any time, and you never have to. Searching is anonymous up to the paywall; an account is only required to open a report you have paid for, and one is created for you at that point if you have not made one already.

• Your account is held by Clerk, in the United States. Sign-in is run by Clerk, Inc. — they hold your email address, your password if you set one, any account you connect such as Google, and your sign-in sessions and devices. We never see your password. See where your account lives, because for this service that is not a detail.
• A copy of your email address, here. Mirrored from Clerk so your account screen and our support can show it. We do not ask for your name.
• Which browsers belong to you. Your account owns the anonymous browser identifiers below. That link is how a search you paid for on your laptop is still yours on your phone.
• Sign-in sessions belong to Clerk. The cookie in your browser is theirs, it is refreshed about once a minute, and signing out ends it. We keep no session record of our own.
• Password resetsare Clerk's too — the email comes from them and we never see the link.

Your browser

• An anonymous visitor id. A random identifier in a signed, http-only cookie. It carries no name and nothing derived from your device — it is how a purchase stays attached to you before there is an account to attach it to.
• A hashed IP address and your browser's user-agent string. Used for rate limiting and to investigate abuse. The IP is stored as a salted hash; we do not retain raw IP addresses.

How long things live

Thirty days after a search, everything biometric about it is destroyed: the face you searched with, every matched thumbnail, and every source link and domain. That deletion is permanent and it is not something you have to ask for.

What survives is a stub — the date, which plan paid for it, how many matches came back, the best score and how long it took. No face, no links, nothing that identifies anyone. It exists so that your own history does not silently empty itself while you are still a subscriber, and so a report you can no longer open says why instead of showing nothing.

Records of payment are kept for as long as tax and accounting law requires, which is longer than 30 days and is not ours to shorten.

What we do not collect

No name, no address, no phone number, no date of birth. We do not run advertising or analytics trackers, we set no cookie that follows you to another site, and we do not sell or share data with data brokers. Card details go directly to our payment processor and never reach our servers.

Cookies

All strictly necessary, none used for tracking: the anonymous visitor id described above, which is ours, and — once you have an account — the sign-in cookies set by Clerk. Clerk also sets a cookie on its own domain to keep you signed in across our pages. We set nothing that follows you to another site.

Who we share with

• Our face index provider receives the cropped face in order to run the search, and nothing else about you.
• Our payment processor receives what is needed to take payment.
• Clerk, Inc. runs sign-in and holds your account. Details below.
• Google, but only if you choose to connect it to your account. Worth being plain about, because on this site it is not a neutral convenience: doing so tells Google you have an account with a face-search service. It is optional and always will be — an email address and a password reach every part of ARGUS that Google does. We do not send Google your searches, your photo, or anything you found.

We disclose data to anyone else only where the law compels us to.

Where your account lives

Sign-in is run by Clerk, Inc., and this is the part of our setup we would most want to know about if we were you.

Your account data is stored in the United States,on Google Cloud and Cloudflare infrastructure. Clerk offers no option to keep it in the EU on any plan. Transfers rely on the EU–US Data Privacy Framework, with standard contractual clauses as a fallback, and Clerk's representative in the EU and UK is VeraSafe Ireland Ltd.

We cannot list Clerk's own suppliers. They do not publish the list publicly — it sits behind a login we do not have — so the only ones we can name from their contract are Google Cloud and Cloudflare. We would rather say that than imply we know the full chain.

What does not go to Clerk: your photo, the face you searched with, your results, and what you paid. All of that stays with us and is covered by everything above. What Clerk holds is the identity half — who you are — and the link between the two is a key we hold and do not share.

Your face, in someone else's search

ARGUS searches an index we do not ourselves compile. If your face appears in it and you want it removed, our removal page explains how to have it de-indexed. Removing it there removes it for everyone, which is more than we can do from here.

Your rights

Depending on where you live you may have the right to access, correct, export or delete the data we hold about you. Email and we will act on it.

One limit is worth stating plainly rather than burying. When you ask us to erase your account we destroy the biometric data and the email address, and we replace the account with an anonymous record. We do not delete the payment history underneath it, because those records are what stop a single payment being counted twice and what we are required to retain for tax purposes. What remains cannot be traced back to you.

Deleting your account is done in your sign-in settings, which removes it at Clerk; we are told and anonymise our copy. You can also stop at any time without asking anyone: clearing the ARGUS cookie ends the link between this browser and your searches, and every face in them is destroyed within 30 days regardless.