AI and Photo Privacy: What You Should Know

Every AI photo tool asks you for the same thing: an image, uploaded to a server you do not control. What happens after that is the whole question. Some services keep the file indefinitely, index it against your account and feed it into training runs. Others read it once and forget it. The difference is invisible from the outside, which is exactly why it is worth knowing what to look for before you hand a picture over.

There are two halves to this. The first is what a photograph gives away on its own, before any model looks at it. The second is what a service should do with the file once it arrives. Neither half is complicated. Both are routinely skipped, usually in favour of a sentence on a marketing page saying that privacy is taken seriously, which measures nothing.

People tend to worry about the wrong one. The fear is usually that a model will somehow recognise a face or reconstruct a life story from a snapshot. The more mundane risk is that the file itself already contains a precise set of coordinates, and that a copy of it now lives on a server whose retention policy nobody read. One of those is speculative. The other is a matter of fact you can verify in about a minute.

The useful way to think about it is as a chain of custody. A photo leaves your device, crosses a network, is processed somewhere, and then either persists or does not. Each link in that chain is a place where a policy decision was made by somebody. Good tools make those decisions legible; poor ones make them unfindable.

The format is called Exif, and it has been riding along inside ordinary JPEGs since 1995. It was designed to be helpful, and mostly it is: it is how your photo library sorts a decade of pictures onto a map without you doing anything. The awkward part is that helpfulness travels with the file. A photo of a cat asleep on a sofa can carry the sofa's coordinates to within a few metres.

Large social platforms generally strip this block on upload, which is a genuine privacy service almost nobody notices. Direct sharing is where it survives: messaging apps that send originals, email attachments, personal blogs, cloud folders, small web tools built by someone in a weekend. If you want to see what is actually in a file rather than assume, ExifTool will print every tag in it, and remove them on request. There is a longer walk through the ordinary version of this problem in our piece on what your vacation photos might reveal.

Worth saying plainly: the pixels leak too. A house number, a bus route, a pharmacy sign, the shape of a mountain on the horizon. Stripping metadata closes one door and leaves the other open, which is the entire premise of visual geolocation in the first place.

These are not gotcha questions. Plenty of services have honest reasons to store an image briefly — a processing queue, a retry after a failed job, an abuse review. Training on user content with genuine consent is a normal arrangement too. The point is not that storage is sinister; it is that you are entitled to know which of these applies before you decide.

1. 1.Do you store my images? The one that matters most. If a copy is written to a disk, a bucket or a database, it exists on infrastructure you do not control, and everything that can happen to stored data can now happen to your photo.
2. 2.For how long, and where? A few seconds in a queue and an indefinite archive are both technically storage. So is a backup taken nightly and kept for a year. Jurisdiction matters too, because it decides which law governs the copy.
3. 3.Who can access it? Employees handling support tickets? Human moderators reviewing flagged uploads? A training pipeline for the next model version? Services that treat this carefully tend to say so in specific terms rather than general ones.

One more test, useful because it is quick: search the privacy policy for the word 'retention'. If nothing comes back, the omission is the answer. Regulation nudges in the same direction — the GDPR has treated precise location as personal data and storage limitation as an obligation since 2018 — but a policy written to satisfy a regulator is not the same as a system built so the question cannot arise.

The sequence is short enough to describe completely. Your browser sends the file over an encrypted connection. The server checks the size, and sniffs the leading bytes to confirm the file is genuinely the image type it claims to be. The bytes are encoded in memory and handed to Google's Gemini model, which reads the scene and returns a probable location with its reasoning. That response goes back to you, the request ends, and the memory holding the image is released.

Upload the same photo twice and the second request starts from nothing. There is no cached result, no previous copy to compare against, no per-user gallery quietly accumulating. That is the concrete meaning of privacy by design: the safest data is the data that was never retained, because it cannot be breached, sold or handed over. A step-by-step account of the same journey, including what does get logged, is in what data Raven actually sees when you upload.

Some things genuinely do persist, and pretending otherwise would undercut the rest. Your account details from sign-in, a flag recording that the one free web guess has been used, and ordinary operational logs — timestamps, error codes, response times — all outlive the request. None of them contain the image or anything derived from its pixels.

This is the clause most worth finding, because it is the one with the longest tail. A stored image can be deleted. An image absorbed into a set of model weights cannot be meaningfully withdrawn afterwards. The distinction rarely appears on the marketing page and almost always appears in the terms, often under a heading about improving the service.

The honest position for a tool like Raven is that it has nothing to gain from your photographs. The model doing the work is a general-purpose one from Google; there is no in-house model being fed. Results are estimates for entertainment, not a product improved by hoarding examples.

• —Turn off location tagging in the camera app. This fixes the problem at the source rather than at every share point afterwards, and it takes one visit to the settings screen.
• —Assume the big platforms strip metadata and that nothing else does. Messaging apps, email, personal sites and small tools frequently pass the original file through untouched.
• —Look at the background before posting, not just the subject. House numbers, delivery labels, school uniforms, station signs and window reflections are the details people miss in their own photographs.
• —Prefer tools that discard rather than tools that promise. A retention policy can change with a version number. A system that never wrote the file down has nothing to change its mind about.

The travel-specific version of this — timing, geotags, the pattern a feed builds over months — is covered in traveling without oversharing your location, which is where most of these habits actually earn their keep.

It matters that this distinction is structural rather than promissory. A tool with no stored images and no identity resolution is not a gentler version of a surveillance system; it is missing the parts that would make surveillance possible. That argument is laid out in full in the ethics of AI photo analysis.

It also helps to know what these tools cannot do. Visual geolocation reasons from evidence in the frame and returns a probability, not a record. That is a different capability from a database lookup, and the comparison in reverse image search vs AI geolocation is a useful way to see why a confident answer is not the same thing as a verified one.

None of this argues for photographing less. It argues for knowing which parts of a picture travel with it and which parts stay behind. Turn the geotag off, glance at the background, and prefer the tools that can tell you exactly what happens to your file in a sentence you can check. That is most of photo privacy, and the rest is detail.