Facial Recognition & Biometric Notice

Draft — last updated September 29, 2026. Not yet reviewed by an attorney.

Attorney review required before large-scale launch. This draft was prepared to describe how the service actually works. It does not guarantee compliance with any law.

The Times of My Life, run by CompanyWRX, LLC, offers an optional facial recognition feature that can suggest who appears in your family photos. Because face data is sensitive, this notice explains exactly how it works. Please read it before turning the feature on.

Notice version: biometric-v1

The short version

Facial recognition is OFF by default.
It is turned on only when a family space owner or event host chooses to, after reading this notice.
Face data is used only to suggest matches within the same family space (or event).
It is never shared across families, never sold, and never used to identify anyone outside your family's archive.
Anyone can ask that a person be marked "do not recognize," which deletes that person's face data.

What "face detection" and "facial recognition" mean here

Face detection finds where a face is in a photo. It runs on our own servers using open-source models and does not work out who the person is.

Facial recognition goes one step further. When it is turned on, our servers convert each detected face into a face descriptor: a list of 128 numbers that describes the shape of that face. Descriptors from different photos can be compared to suggest "this might be the same person." This is the part that may count as biometric information under the law.

Who can turn it on

Only the owner of a family space, or the host of an event, can turn facial recognition on for that space or event. Before they can, they must read this notice and confirm their consent. We record that consent along with the notice version (biometric-v1) and the date.

By turning it on, the owner or host also confirms that they will let the members and guests of their space or event know that facial recognition is in use.

How face descriptors are used

Face descriptors are used only to suggest matches between faces within the same family space (or event). You confirm or reject each suggestion.

Face descriptors are:

Stored only in our database (DigitalOcean, United States).
Never shared across families — one family's face data is never compared with another's.
Never sold, leased, traded, or otherwise profited from.
Never sent to outside AI providers.
Never used for identification outside the family's archive, including for advertising, law enforcement databases, or any other purpose.

We will disclose face descriptors only if required by a valid law, warrant, or subpoena.

How to stop it and delete face data

"Do not recognize": anyone can ask that a person be marked "do not recognize." This deletes that person's face descriptors and stops new ones from being made for them. You can do this in the app, or ask the space owner, or email us at bill@companywrx.com.
Turning it off: the owner of a space can turn facial recognition off at any time. This deletes all face descriptors in that space.
Deleting a photo, person, or account deletes the related face descriptors.

How long we keep face data

We keep face descriptors only while they serve their purpose. They are deleted:

When the photo, person, or account they belong to is deleted; and
In all cases, within 30 days of the purpose ending — for example, when a space turns facial recognition off or an account is deleted.

Security

Face descriptors are protected with at least the same care we give all sensitive data in the service, including limited, logged staff access.

State laws and where the feature is available

Several states have laws specifically about biometric information, including:

Illinois — Biometric Information Privacy Act (BIPA)
Texas — Capture or Use of Biometric Identifier Act (CUBI)
Washington — its biometric identifiers law (RCW 19.375), and its My Health My Data Act where applicable

Other states treat biometric data as sensitive data under their privacy laws. Facial recognition may be disabled for users in certain jurisdictions until we are confident we meet the requirements there.

Questions

If you have questions about face data, or want face data about you deleted, email bill@companywrx.com.

CompanyWRX, LLC [Mailing address — to be confirmed]