Privacy Policy

Last updated August 2026

Sherlock helps you check the provenance of a photo or object using reverse image search and AI analysis. This is not facial recognition — we do not build, store, or match biometric face templates. We match whole images and the public web pages they appear on. This policy applies to both the Sherlock website and the Sherlock mobile app.

Face data

Sherlock does not collect, create, or store face data, and is not a facial-recognition app. We do not detect, scan, map, or measure faces, and we do not create, derive, or store face templates, faceprints, face geometry, or any other biometric identifier. Matching is done on the whole image — a reverse-image search for the same picture — not on facial features. No face data is collected, so none is shared with third parties and none is retained.

Photos you upload

What we collect and how. We collect only the photo you actively choose to submit for a check — by picking it, taking it, or pasting its address. We do not scan your photo library, and we collect no names, handles, email addresses or phone numbers as search input. The image file you submit may carry metadata your camera embedded in it, such as device model or capture date; we read that on our own server to show you the photo's own details and do not send it anywhere as a separate record.

How it is used. The photo is sent over an encrypted connection to our analysis service for the duration of a single check, and is used only to produce that report: finding public pages where the image appears, estimating whether it looks AI-generated, and describing what is in it. It is processed in memory, deleted once the report is generated, and never retained afterwards. We do not sell your uploaded photos, use them to train AI models, or use them for advertising or ad targeting.

Third-party services that receive your photo

Completing a check requires sending your photo to the services below. Each is contractually bound to process it only to return a result to us, and each provides the same or equal protection for it as this policy does — in particular, no retention beyond the request and no use for model training. We share your photo with no one else, and we never attach your identity to it.

Cloudflare R2 — briefly hosts a temporary copy of the photo, because reverse-image engines must fetch an image by address rather than receive raw bytes. The copy is deleted as soon as the search finishes.
SerpApi — runs the reverse-image search on our behalf and, in doing so, submits the photo to Google (Google Lens) and Yandex (Yandex Images) to find pages where it appears.
Sightengine — a forensic classifier that scores how likely the photo is AI-generated.
OpenAI (GPT) and Google (Gemini) — AI services, reached through our own server, that judge AI-generation signs and name the object in the photo.

For the written summaries in a report, these AI services receive text only — page addresses, site names and titles returned by the search — and never your photo. The summaries describe where an image appears; they do not judge who a person is.

Your history stays on your device

Past checks and their thumbnails are stored locally on your device — in your browser on the web, and on-device in the mobile app — and never leave it. Clearing your browser data, or using the "Clear all" button in the app or on the site, removes them permanently. History is not synced across devices.

Account and billing

If you subscribe, we store your account identifier, email, and subscription status to provide premium access. On the web, payments are processed by Stripe; we never receive or store your full card details. Sign-in is handled by Firebase Authentication.

In the mobile app, purchases are made through Apple's In-App Purchase and your subscription status is managed for us by Adapty, which receives an anonymous device identifier and the App Store purchase record so it can tell the app what you are entitled to. Adapty never receives your photos or any report.

Anonymous usage limits

To offer a free check without requiring an account, we generate a device identifier — in your browser on the web, and on-device in the mobile app — to count free usage. It is not linked to your identity unless you choose to sign in.

Analytics and cookies

We use analytics to understand aggregate, anonymous traffic such as page views and which features are used. On the website this is Google Analytics. The mobile app sends no analytics to any third party: it reports only an event name and the anonymous device identifier above, to our own server. We do not use advertising trackers, and we never send your uploaded photos, search results, or other content to analytics — analytics receives none of the data described above. You can block these cookies in your browser without affecting how the service works.

Contact

Questions about privacy? Reach us through the support channel listed in the app or on this site.