DRAFT — needs review
Face data
Last updated: November 2026
Face grouping is the feature that finds a runner's photos even when their bib is hidden. It works by measuring faces, and a face measurement is biometric data. This page says exactly what Bibbit computes, when, where it goes and when it is destroyed. It is written from the code that does the work, and it is a draft until it has been reviewed by a lawyer.
What is collected
When face grouping runs over a gallery, or over a folder added from your computer, Bibbit records for each face it finds:
- A face embedding: a list of 512 numbers describing the face, produced by a face recognition model. This is the biometric identifier.
- Where the face is in the photo (a bounding box) and which photo it is in (the photo's address on your gallery host, or for a folder its file name).
- Which group of faces it was placed in, and, once you resolve a group, the bib number and runner name you gave it.
When it runs
Only for events where face grouping is switched on. The switch is per event, on the event page, and for a new event it is off until you change it. A gallery added to an event with face grouping off is scanned for bib numbers only, and a face scan cannot be started for it.
Where the processing happens
Photos are read from your gallery host, downscaled in memory and sent to Bibbit's inference server, which runs the detection and face recognition models and returns the results. Photos in a folder added from your computer are sent by your browser as a downscaled copy and processed the same way. The photo bytes are discarded as soon as that is done; Bibbit never stores your photos. The embeddings, boxes, photo addresses (for a folder, file names) and groups are stored in Bibbit's database, attached to the scan or folder.
How long it is kept
For the life of the scan or folder it belongs to, and no longer. Face data is destroyed when any of these happens:
- You delete the scan, or delete the folder from its event.
- You remove the gallery from its event (this deletes the gallery's scans).
- You re-run a face scan on the gallery (the previous face data is cleared first).
- You delete your account: scans and folders are purged by a scheduled job once the {days}-day account recovery window has passed.
How to delete it
From the app, at any time: delete the scan, remove the gallery or folder from the event, or delete your account. Deleting a scan or folder removes its face data immediately and permanently; there is no backup copy to request. If you cannot reach the app, write to hello@bibbit.io.
Photo search by race participants
If you turn on the hosted "find your photos" page, a participant can upload a photo of themselves. Bibbit measures the face in that photo, compares it with the faces already recorded for the event, shows the matches, and discards the uploaded photo and its measurement. Nothing from the participant's upload is stored, and the page says so before they upload.
セルフィーでチェックインするランナー
フォトグラファーがランナーのチェックインを有効にすると、ランナーはレース前にセルフィー、名前、必要に応じてゼッケン番号を送信できます。何かを計算する前に、ランナー本人が自分の名前で同意します。Bibbit はセルフィーの顔を測定し、その測定値を名前とゼッケンとともに保存し、セルフィーは破棄します。測定値はそのイベントの写真に写る顔とだけ照合され、ランナーの名前がギャラリーに書き込まれる前にフォトグラファーが照合結果を承認します。測定値は 180 日後、イベントが削除されたとき、またはランナーが受け取った専用リンクで取り消したときに削除されます。
Who can see it
You, in your own account, and Bibbit's administrators for support. Face data is never sold, never shared with other photographers, never used to train models and never used for anything but grouping photos within your galleries. The inference server is operated by Bibbit; the photo bytes it receives exist only for the request that carries them.
GDPR basics (draft)
Face embeddings used to identify a person are special category data under GDPR Article 9. Our working position is that the photographer is the controller for their galleries and Bibbit is a processor acting on their instructions; the per-event switch is the instruction. The lawful basis for processing participants' faces, and any consent or notice the photographer must give at the event, are the photographer's responsibility and are being reviewed with counsel. Participants may exercise their rights (access, erasure, objection) through the photographer or by writing to hello@bibbit.io; erasure is carried out by deleting the scan.
United States
Illinois (BIPA), Texas and Washington regulate biometric identifiers, and Illinois law requires written consent from the person whose face is measured, which a race photographer cannot collect from a crowd. Face grouping is therefore not offered for events held in those states: when a photographer turns it on for an event, they confirm the photos were not taken there, and Bibbit records when that confirmation was given.
Questions
Write to hello@bibbit.io. The general Privacy Policy covers everything else Bibbit stores.