How face enrollment works: no photos stored, ever
One of the most common questions we get is: "If Shield uses my camera to recognize me, does it store photos of my face?" The answer is no. Not a single image of your face is ever saved anywhere. Here's what actually happens.
The short version
During enrollment, Shield looks at your face through the camera and converts it into a set of numbers. Mathematical matrices. These numbers describe the geometry of your face, not what your face looks like. The numbers are then secured with a cryptographic hash and stored in a protected subsystem of your operating system. No image is saved. The original camera frames are discarded immediately.
What happens during enrollment
When you enroll your face in Shield, the app asks you to look at the camera from a few different angles. This takes less than a minute. During this process, the following happens:
1. The camera captures live frames. These are standard video frames from your webcam, the same as any video call. They exist only in memory, for a fraction of a second.
2. A face detection algorithm locates your face. It identifies key points on your face: the distance between your eyes, the width of your nose, the shape of your jawline, the position of your cheekbones. These are geometric measurements, not visual features like skin color or eye color.
3. The measurements are converted into a mathematical matrix. Think of it as a list of numbers. For example, the ratio between the distance from your left eye to your right eye and the distance from your nose to your chin. These ratios are unique to your face but they don't describe what you look like. You cannot reconstruct a face from these numbers.
4. The matrix is secured with a cryptographic hash. The mathematical representation is processed through a one-way cryptographic function. This creates a unique fingerprint of the data that cannot be reversed. Even if someone accessed the stored data, they could not reconstruct the original measurements, let alone an image of your face.
5. The result is stored in a protected area of your operating system. Your device has a hardware-protected storage area designed specifically for sensitive data like biometric templates, encryption keys, and passwords. This is where Shield saves the mathematical template. It's the same type of secure storage that your device uses to protect fingerprint and face unlock data.
6. The original camera frames are discarded. The video frames that were captured during enrollment are deleted from memory immediately after processing. They are never written to disk, never saved as files, never stored anywhere.
What is actually stored on your device
After enrollment, the only thing that exists on your device is a small set of numbers: a mathematical template that describes the proportions and geometry of your face. It is not an image. It contains no pixels, no colors, no visual data. It's a list of numerical ratios secured with a cryptographic hash.
You cannot open this template and see a face. You cannot convert it back into an image. It has no visual meaning. It's math, not a photo.
How recognition works after enrollment
Once you're enrolled, Shield uses the stored template to recognize you in real time. Here's the process:
1. The camera provides a live frame.
2. Shield runs the same geometric analysis on the live frame, producing a new set of numbers.
3. The new numbers are compared to the stored template. If the match is above a certain threshold, Shield recognizes you as the registered user.
4. The live frame is discarded immediately. It is never saved.
This happens continuously while Shield is running. Every frame is analyzed, compared, and discarded. No frame is ever kept. The camera feed is processed and thrown away in real time, hundreds of times per minute.
Why this matters
The difference between storing a photo and storing a mathematical template is fundamental:
What Shield does NOT do
Store photos. There are zero image files of your face on your device created by Shield.
Store video. No recordings of any kind are saved from the camera feed.
Store visual data. The template contains no pixel data, no color information, no visual representation.
Send anything anywhere. The template never leaves your device. There is no server, no cloud, no upload.
What Shield does
Store numbers. A matrix of geometric ratios that describe facial proportions.
Secure those numbers. With a cryptographic hash that prevents reverse engineering.
Store them safely. In the operating system's hardware-protected secure storage.
Keep everything local. Nothing leaves your device. Ever.
Can someone reconstruct my face from the template?
No. The mathematical template is a one-way transformation. It's like a fingerprint of your facial geometry, not a photograph of it. The process of converting a face into numbers is designed to be irreversible.
Think of it this way: if someone tells you that a room is 4.5 meters wide and 6.2 meters long, you know the proportions of the room, but you cannot tell what color the walls are, what furniture is inside, or what it looks like. The measurements describe the geometry, not the appearance.
The same principle applies to facial templates. The numbers describe proportional relationships between facial landmarks. They don't describe what your face looks like. And the cryptographic hash adds another layer: even the numbers themselves are protected behind a one-way function.
Summary
Shield converts your face into math, secures the math with cryptography, and stores it in hardware-protected storage on your device. No photos. No images. No visual data. No uploads. No servers. Your face stays your face. Shield only keeps the numbers it needs to recognize you.