Zero-Server Biometric Architecture • GDPR, CCPA & BIPA Compliant

Biometric & On-Device Privacy Policy

Effective Date: October 2026 • Platform: PassPhotoKit (passphotokit.com)

Our Ironclad Zero-Upload Guarantee

PassPhotoKit does not store, transmit, upload, or collect your photographs or biometric identifiers on any server. 100% of facial landmark detection (478-point face mesh), AI background segmentation, head-height cropping, and 300-DPI JPEG rendering happens locally inside your device's browser memory (WebAssembly and WebGPU). When you close or refresh your browser tab, your photograph and all temporary memory buffers are permanently discarded.

1. Illinois Biometric Information Privacy Act (BIPA) & GDPR Notice

To align your portrait to official government head-height and eye-line standards (such as U.S. Department of State 2×2", UK HMPO 35×45mm, and Canada IRCC 50×70mm), our client-side web application executes Google MediaPipe Vision models locally within your web browser's sandboxed Web Worker.

  • No Server Transmission: Neither your raw photo, your cropped photo, nor any facial landmark coordinates ever leave your device over the network.
  • Zero Retention: Landmark coordinates exist solely in transient JavaScript `ArrayBuffer` memory while you adjust your photo and are immediately garbage-collected when you upload a new photo or close the page.
  • No Third-Party Sharing or AI Training: Your photos are never shared with third parties and are never used to train AI models.

2. Camera & Local File Access

When you select a photo from your device or grant webcam permission via "Take Selfie", the image stream is read directly into an HTML5 `<canvas>` inside your browser. You can verify this at any time by opening your browser's Network Inspector or turning on Airplane Mode after the page loads—the studio continues to process and export 300-DPI photos completely offline.

3. Minimal Technical Logs & Cookies

We do not use invasive cross-site tracking cookies or require user accounts. Standard anonymous web server access logs (such as page URL requested and browser user-agent) are used solely to maintain site reliability and prevent abuse.

Verified 100% Client-Side Processing
Open Private Photo Studio →