How face recognition at Ohhi works, and stays private

Anyone who keeps thousands of family photos wants to search them by the people in them: every photo of your daughter, of grandad, of the two of you together. That is what face recognition is for. At the same time it is the most sensitive feature a photo service can build, because facial features are biometric data and fall under the strictest category of the GDPR. So below we explain exactly what happens at Ohhi, from the moment you turn the feature on to the moment you turn it off again.

What happens when you turn it on

Face recognition is off by default at Ohhi, for everyone. As long as you do nothing, we do not look for faces and we store nothing about them. If you turn the feature on in your profile (available from 100 GB of storage, so on Pro and Max), our own servers in Europe process your library in the background, including the photos that were already there. We use an existing open-source model for this and run it unchanged. No external service is involved and your photos train nothing.

For every face we find, we keep three things: the position in the photo, a small crop for the overview on the People page, and a short series of numbers that summarises the face mathematically, a so-called embedding. We use that series to compare faces and group them into people. That comparison happens exclusively within your own account; your faces are never placed next to those of other users.

Embeddings live only in our database. They appear in no API response, go to no third party and are used for nothing other than grouping photos within your own account.

Where you hold the controls

The groups that emerge stay yours. In concrete terms:

• You give the names. We only put together what looks like the same person; a group has no name until you type one, and you can remove that name again.
• Merging is up to you. If the system accidentally sees the same person as two groups, you merge them in one step.
• Deleting carries through. If you throw away a photo, the face data of that photo disappears with it.
• Turning it off means erasing. If you switch face recognition off, we immediately delete all embeddings and groups from your account. No copy stays behind. Turn the feature back on later and the analysis simply starts from scratch.

For accounts of children aged 13 to 15 there is another lock in front of all this: uploading only works after a parent has confirmed the registration via an email link. Without that confirmation there are no photos, and without photos there is nothing to recognise.

Face recognition at Ohhi is therefore a feature you turn on deliberately and erase just as easily. Why we never train models on your images in the first place, you can read in why we'll never use your photos to train AI. Where those servers are and what that means legally is covered in servers in Europe: what it really means. You can find the plans with 100 GB or more on the pricing page.