{ "batch": "84-setup-devices-and-backups", "articles": [ { "id": "learn_r84_setup_devices_and_backups_ios_camera_location_services_on_by_permission", "category": "Safety", "title": "[Unverified - being checked] Does the iPhone camera embed GPS by default", "summary": "[Unverified - being checked] When Location Services is enabled for the Camera app, iPhone embeds the coordinates of where each photo or video was taken directly into the file, and anyone you share the file with may be able to read them.", "body": "When Location Services is enabled for the Camera app, iPhone embeds the coordinates of where each photo or video was taken directly into the file, and anyone you share the file with may be able to read them.\n\nWhat Apple Support (Personal Safety User Guide) actually says:\n\n“When Location Services is turned on for the Camera app, it uses information known as metadata gathered from cellular, Wi-Fi, GPS networks, and Bluetooth to determine the location coordinates where the photo or video is taken. These coordinates are embedded into each photo and video so that you can later search for them in the Photos app based on the location they were taken.”\n\nNote: Apple does not publish the default value of the Camera app's Location Services permission in this guide; the guide states collection is possible 'only if your Camera app has access to Location Services'.", "source_type": "official", "source_link": "https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (Personal Safety User Guide)", "evidence_quote": "When Location Services is turned on for the Camera app, it uses information known as metadata gathered from cellular, Wi-Fi, GPS networks, and Bluetooth to determine the location coordinates where the photo or video is taken. These coordinates are embedded into each photo and video so that you can later search for them in the Photos app based on the location they were taken.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iOS Camera / Photos (iPhone, iPad)", "topic": "Does the iPhone camera embed GPS by default", "applies_to_country": "*", "applies_to_scope": "iOS/iPadOS; permission-dependent, not a global 'off' default", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_ios_camera_embeds_where_and_when", "category": "Safety", "title": "[Unverified - being checked] What the camera writes into the file besides pixels", "summary": "[Unverified - being checked] Apple states that photos and videos taken with the camera may also carry where and when they were taken, depth of field and overcapture data.", "body": "Apple states that photos and videos taken with the camera may also carry where and when they were taken, depth of field and overcapture data.\n\nWhat Apple Legal (Camera and ARKit & Privacy) actually says:\n\n“Photos and videos taken with the camera may contain other information, such as where and when they were taken, the depth of field, and overcapture. If you do not want photos and videos taken with the Camera app to include location, you can control this at any time by going to Settings > Privacy & Security > Location Services > Camera. If you do not want photos and video to include location when shared, you can turn off location in the Options menu in the share sheet.”\n\nNote: This is the single Apple legal page covering both the per-app setting and the share-sheet Options toggle.", "source_type": "official", "source_link": "https://www.apple.com/legal/privacy/data/en/camera/", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Legal (Camera and ARKit & Privacy)", "evidence_quote": "Photos and videos taken with the camera may contain other information, such as where and when they were taken, the depth of field, and overcapture. If you do not want photos and videos taken with the Camera app to include location, you can control this at any time by going to Settings > Privacy & Security > Location Services > Camera. If you do not want photos and video to include location when shared, you can turn off location in the Options menu in the share sheet.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iOS Camera", "topic": "What the camera writes into the file besides pixels", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_ios_camera_exact_path_to_disable_geotag", "category": "Safety", "title": "[Unverified - being checked] IOS Camera: Exact settings path to turn location tagging off", "summary": "[Unverified - being checked] The exact path Apple gives to stop geotagging at the source is Settings > Privacy & Security > Location Services > Camera, then Never.", "body": "The exact path Apple gives to stop geotagging at the source is Settings > Privacy & Security > Location Services > Camera, then Never.\n\nWhat Apple Support (Personal Safety User Guide) actually says:\n\n“Location metadata in photos and videos can be collected only if your Camera app has access to Location Services.\n\n- Go to Settings > Privacy & Security > Location Services > Camera, then tap Never.”\n\nNote: Applies to new captures only. Apple separately documents removing/adjusting location on existing photos (Photos > open photo > More > Adjust Location > No Location).", "source_type": "official", "source_link": "https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (Personal Safety User Guide)", "evidence_quote": "Location metadata in photos and videos can be collected only if your Camera app has access to Location Services.\n\n- Go to Settings > Privacy & Security > Location Services > Camera, then tap Never.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iOS Camera", "topic": "Exact settings path to turn location tagging off", "applies_to_country": "*", "applies_to_scope": "iPhone, iPad", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_ios_sharesheet_location_toggle", "category": "Safety", "title": "[Unverified - being checked] IOS Photos share sheet: Does the OS strip location when sharing", "summary": "[Unverified - being checked] iOS can strip location at share time, but only via a manual Options > Location toggle in the share sheet; Apple documents no default-on stripping.", "body": "iOS can strip location at share time, but only via a manual Options > Location toggle in the share sheet; Apple documents no default-on stripping.\n\nWhat Apple Support (Personal Safety User Guide) actually says:\n\n“2. Tap the Share Sheet button, then tap Options.\n3. Turn off Location, then tap the Done button.\n4. Share the photos using one of the methods shown in the Share Sheet.”\n\nNote: Apple's wording says the toggle is scoped to 'photos in Photos on iPhone or iPad'. The guide does not state which share destinations honour the toggle, does not state its default position, and does not claim it removes non-location metadata (device model, timestamps, exposure). See also ios.sharesheet.sharing-carries-metadata.", "source_type": "official", "source_link": "https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (Personal Safety User Guide)", "evidence_quote": "2. Tap the Share Sheet button, then tap Options.\n3. Turn off Location, then tap the Done button.\n4. Share the photos using one of the methods shown in the Share Sheet.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iOS Photos share sheet", "topic": "Does the OS strip location when sharing", "applies_to_country": "*", "applies_to_scope": "iPhone, iPad", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_ios_sharesheet_sharing_carries_metadata", "category": "Safety", "title": "[Unverified - being checked] IOS Photos (sharing): What travels with a shared photo", "summary": "[Unverified - being checked] Apple states plainly that sharing a photo or video means sharing its associated metadata (date, time, location, device, captions), and offers an 'All Photos Data' toggle that sends the original file plus edit history for AirDrop and iCloud links.", "body": "Apple states plainly that sharing a photo or video means sharing its associated metadata (date, time, location, device, captions), and offers an 'All Photos Data' toggle that sends the original file plus edit history for AirDrop and iCloud links.\n\nWhat Apple Support (iPhone User Guide) actually says:\n\n“Note: Sharing a photo or video includes sharing its associated metadata, such as date and time, location, device, and captions.”\n\nNote: Same page, in 'Adjust the information you share about a photo or video': 'Send all photo data: Turn on All Photos Data to share the original file with edit history and metadata; the recipient can view and modify the current version (available with AirDrop and iCloud links only).' and 'Send as iCloud link: Turn on iCloud Link to share a URL to view or download the photos or videos. iCloud links are available for 30 days.' Apple therefore documents that metadata travels with a shared photo by default, and that the only share-time controls it names are 'Turn off location data: Turn off Location' plus the file-format option - not a general metadata scrub. Opened and verified in this session.", "source_type": "official", "source_link": "https://support.apple.com/en-mk/guide/iphone/iphf28f17237/ios", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (iPhone User Guide)", "evidence_quote": "Note: Sharing a photo or video includes sharing its associated metadata, such as date and time, location, device, and captions.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iOS Photos (sharing)", "topic": "What travels with a shared photo", "applies_to_country": "*", "applies_to_scope": "iPhone (iOS User Guide)", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_ios_airdrop_e2ee_not_metadata", "category": "Safety", "title": "[Unverified - being checked] AirDrop: Encryption vs metadata on direct device-to-device sharing", "summary": "[Unverified - being checked] AirDrop transfers are end-to-end encrypted and Apple says it cannot decrypt them and does not retain copies, but that is transport secrecy only - it says nothing about removing metadata from the file itself.", "body": "AirDrop transfers are end-to-end encrypted and Apple says it cannot decrypt them and does not retain copies, but that is transport secrecy only - it says nothing about removing metadata from the file itself.\n\nWhat Apple Legal (AirDrop & Privacy) actually says:\n\n“AirDrop uses end-to-end encryption, so there’s no way for Apple to decrypt the content of the materials you transfer. Although Apple does not retain copies of your AirDrop transfers, Apple may retain limited information about your use of AirDrop in a way that doesn’t identify you, in order to improve our products, services, and technologies.”\n\nNote: Same page also states: 'Once a transfer is started, if the sending and receiving devices leave close proximity and are not connected to the same Wi-Fi network, the transfer may be completed using the internet. Files transferring over the internet may travel over Apple servers to the receiving device.'", "source_type": "official", "source_link": "https://www.apple.com/legal/privacy/data/en/air-drop/", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Legal (AirDrop & Privacy)", "evidence_quote": "AirDrop uses end-to-end encryption, so there’s no way for Apple to decrypt the content of the materials you transfer. Although Apple does not retain copies of your AirDrop transfers, Apple may retain limited information about your use of AirDrop in a way that doesn’t identify you, in order to improve our products, services, and technologies.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "AirDrop", "topic": "Encryption vs metadata on direct device-to-device sharing", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_photos_syncs_everything_including_metadata", "category": "Safety", "title": "[Unverified - being checked] ICloud Photos: What syncs by default once enabled", "summary": "[Unverified - being checked] Enabling iCloud Photos uploads the whole library - photos, videos, metadata and edits - and pushes it to every signed-in device; Apple's own framing is sync, not backup.", "body": "Enabling iCloud Photos uploads the whole library - photos, videos, metadata and edits - and pushes it to every signed-in device; Apple's own framing is sync, not backup.\n\nWhat Apple (iCloud Terms and Conditions) actually says:\n\n“1. iCloud Photos. When you enable iCloud Photos, your photos, videos, metadata and any edits that you make in the Photos App on your iOS device, macOS computer, or Windows PC will be automatically uploaded and stored in iCloud, and then pushed to all of your other iCloud Photos-enabled devices and computers.”\n\nNote: 'metadata' is explicitly named in Apple's contractual text. The Apple support page adds: 'iCloud Photos keeps every photo and video you take in iCloud, so you can access your library from any device' (https://support.apple.com/en-us/108782).", "source_type": "official", "source_link": "https://www.apple.com/legal/internet-services/icloud/en/terms.html", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple (iCloud Terms and Conditions)", "evidence_quote": "1. iCloud Photos. When you enable iCloud Photos, your photos, videos, metadata and any edits that you make in the Photos App on your iOS device, macOS computer, or Windows PC will be automatically uploaded and stored in iCloud, and then pushed to all of your other iCloud Photos-enabled devices and computers.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Photos", "topic": "What syncs by default once enabled", "applies_to_country": "*", "applies_to_scope": "iPhone, iPad, Mac, Windows PC", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_photos_delete_propagates", "category": "Safety", "title": "[Unverified - being checked] ICloud Photos: Is a deleted photo gone", "summary": "[Unverified - being checked] Deleting a photo deletes it from every device with iCloud Photos on, and it then sits in Recently Deleted for 30 days before being permanently removed from the iPhone, iCloud and all devices.", "body": "Deleting a photo deletes it from every device with iCloud Photos on, and it then sits in Recently Deleted for 30 days before being permanently removed from the iPhone, iCloud and all devices.\n\nWhat Apple Support (iPhone User Guide) actually says:\n\n“When you use iCloud photos, any photos you delete or hide are deleted or hidden on all your devices. Note: Deleted photos and videos are kept in the Recently Deleted collection for 30 days before being permanently removed from all devices.”\n\nNote: Two Apple-relevant leaks: (1) a 'deleted' photo is recoverable for 30 days by anyone holding the unlocked device; (2) Recently Deleted and Hidden are unlocked with the same passcode as the phone unless separately locked.", "source_type": "official", "source_link": "https://support.apple.com/guide/iphone/delete-or-hide-photos-and-videos-iphb4defbde9/ios", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (iPhone User Guide)", "evidence_quote": "When you use iCloud photos, any photos you delete or hide are deleted or hidden on all your devices. Note: Deleted photos and videos are kept in the Recently Deleted collection for 30 days before being permanently removed from all devices.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Photos", "topic": "Is a deleted photo gone", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_photos_recently_deleted_immediate_if_over_quota", "category": "Safety", "title": "[Unverified - being checked] ICloud Photos: When the 30-day safety net does not apply", "summary": "[Unverified - being checked] If the account is over its iCloud storage limit, deleted photos and videos are removed by the device immediately with no Recently Deleted recovery window.", "body": "If the account is over its iCloud storage limit, deleted photos and videos are removed by the device immediately with no Recently Deleted recovery window.\n\nWhat Apple Support actually says:\n\n“If you want to remove content from Recently Deleted album faster, tap Select, then select the items you want to remove. Tap the More button, tap Delete, then tap Delete From This iPhone. If you exceed your iCloud storage limit, your device immediately removes any photos and videos you delete and they won't be available for recovery in your Recently Deleted album.”\n\nNote: Opened and verified in this session (support.apple.com/en-us/108922, 'Manage your iCloud storage on your Apple device'). Practical consequence for the leak model: the 30-day recovery window is the *default*, and an over-quota account loses even that - so 'delete' is not a reliable control in either direction.", "source_type": "official", "source_link": "https://support.apple.com/en-us/108922", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support", "evidence_quote": "If you want to remove content from Recently Deleted album faster, tap Select, then select the items you want to remove. Tap the More button, tap Delete, then tap Delete From This iPhone. If you exceed your iCloud storage limit, your device immediately removes any photos and videos you delete and they won't be available for recovery in your Recently Deleted album.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Photos", "topic": "When the 30-day safety net does not apply", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_backup_includes_photos_and_face_data", "category": "Safety", "title": "[Unverified - being checked] What ends up in an iCloud device backup", "summary": "[Unverified - being checked] If iCloud Photos is off, the daily iCloud Backup may include the Camera Roll photos and videos plus face information from People & Pets; if iCloud Photos is on, those are synced instead and left out of the backup.", "body": "If iCloud Photos is off, the daily iCloud Backup may include the Camera Roll photos and videos plus face information from People & Pets; if iCloud Photos is on, those are synced instead and left out of the backup.\n\nWhat Apple Support actually says:\n\n“If you haven’t turned on iCloud Photos, iCloud Backup may include photos and videos in your Photos or Camera Roll, as well as face information from the People & Pets album. When you use iCloud Photos, your photos, videos, and face information automatically sync to iCloud so they aren’t included in your daily backup.”\n\nNote: Opened and verified in this session (support.apple.com/en-us/108770, 'What does iCloud back up?'). Either way the library ends up in iCloud; the two features just decide which copy holds it, which is why 'I never turned on iCloud Photos' is not a leak-control. Same page: app data for third-party messaging/social apps is also in the backup. face_required='no' records that Apple describes face data as a backup input, not that a face must appear in a photo.", "source_type": "official", "source_link": "https://support.apple.com/en-us/108770", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support", "evidence_quote": "If you haven’t turned on iCloud Photos, iCloud Backup may include photos and videos in your Photos or Camera Roll, as well as face information from the People & Pets album. When you use iCloud Photos, your photos, videos, and face information automatically sync to iCloud so they aren’t included in your daily backup.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Backup", "topic": "What ends up in an iCloud device backup", "applies_to_country": "*", "applies_to_scope": "iPhone, iPad, Apple Vision Pro", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_no_folder_exclusion_documented", "category": "Safety", "title": "[Unverified - being checked] ICloud Photos: How to exclude a folder or turn sync off", "summary": "[Unverified - being checked] Apple documents turning iCloud Photos on/off per device (Settings > [name] > iCloud > Photos > Sync this device) and pausing library uploads, but documents no way to exclude a specific album or folder from the library that syncs.", "body": "Apple documents turning iCloud Photos on/off per device (Settings > [name] > iCloud > Photos > Sync this device) and pausing library uploads, but documents no way to exclude a specific album or folder from the library that syncs.\n\nWhat Apple Support actually says:\n\n“Turn on iCloud Photos\n\nMake sure that you set up iCloud and sign in to iCloud with the same Apple Account on all of your devices.\n\n### Turn on iCloud Photos on your iPhone, iPad, or Apple Vision Pro\n\n1. Go to Settings. Tap your name, then select iCloud.\n2. Tap Photos.\n3. Turn on Sync this device.”\n\nNote: The same page's 'Pause library uploads to iCloud' section is the only partial control. Apple's own warning on this page: 'They're not duplicated in your iCloud backup, so keep backup copies of your library' - i.e. iCloud Photos is not a backup.", "source_type": "official", "source_link": "https://support.apple.com/en-us/108782", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support", "evidence_quote": "Turn on iCloud Photos\n\nMake sure that you set up iCloud and sign in to iCloud with the same Apple Account on all of your devices.\n\n### Turn on iCloud Photos on your iPhone, iPad, or Apple Vision Pro\n\n1. Go to Settings. Tap your name, then select iCloud.\n2. Tap Photos.\n3. Turn on Sync this device.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Photos", "topic": "How to exclude a folder or turn sync off", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_encryption_tiers", "category": "Safety", "title": "[Unverified - being checked] ICloud Photos (storage security): Who can read the library on Apple's servers", "summary": "[Unverified - being checked] Under the default Standard data protection, Photos is encrypted in transit and on server with Apple holding the keys; end-to-end encryption of Photos requires opting into Advanced Data Protection, and Shared Albums / link sharing are never end-to-end encrypted.", "body": "Under the default Standard data protection, Photos is encrypted in transit and on server with Apple holding the keys; end-to-end encryption of Photos requires opting into Advanced Data Protection, and Shared Albums / link sharing are never end-to-end encrypted.\n\nWhat Apple Support (iCloud data security overview) actually says:\n\n“Standard data protection is the default setting for your account. Your iCloud data is encrypted in transit and stored in an encrypted format at rest. The encryption keys from your trusted devices are secured in Apple data centers, so Apple can decrypt your data on your behalf whenever you need it, such as when you sign in on a new device, restore from a backup, or recover your data after you’ve forgotten your password.”\n\nNote: Same page: table row 'Photos | In transit & on server | Apple | End-to-end | Trusted devices'; and 'iWork collaboration, the Shared Albums feature in Photos and sharing content with “anyone with the link,” do not support Advanced Data Protection.' Also: 'checksums of file and photo data are used to help Apple de-duplicate and optimize your iCloud and device storage' remain under standard protection even with ADP on.", "source_type": "official", "source_link": "https://support.apple.com/en-us/102651", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (iCloud data security overview)", "evidence_quote": "Standard data protection is the default setting for your account. Your iCloud data is encrypted in transit and stored in an encrypted format at rest. The encryption keys from your trusted devices are secured in Apple data centers, so Apple can decrypt your data on your behalf whenever you need it, such as when you sign in on a new device, restore from a backup, or recover your data after you’ve forgotten your password.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud Photos (storage security)", "topic": "Who can read the library on Apple's servers", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_tos_content_and_backup_disclaimer", "category": "Safety", "title": "[Unverified - being checked] ICloud (terms): Platform rights over stored photos; whose fault a lost file is", "summary": "[Unverified - being checked] Apple's iCloud terms reserve the right to screen, refuse, modify or remove content at any time without notice, and put the burden of keeping a backup on the user.", "body": "Apple's iCloud terms reserve the right to screen, refuse, modify or remove content at any time without notice, and put the burden of keeping a backup on the user.\n\nWhat Apple Legal actually says:\n\n“However, Apple reserves the right at all times to determine whether Content is legal, appropriate and in compliance with this Agreement, and may screen, move, refuse, modify and/or remove Content at any time, without prior notice and in its sole discretion, if such Content is found to be in violation of applicable law, this Agreement or is otherwise objectionable.”\n\nNote: Same document, section D: 'You are responsible for backing up, to your own computer or other device, any important documents, images or other Content that you store or access via the Service.' I searched the full iCloud ToS text for 'obscene' and 'pornograph': the only hit for 'obscene' is a custom-email-domain clause; there is no clause naming adult content as such in the body I read (see apple.icloud.adult-content, below).", "source_type": "official", "source_link": "https://www.apple.com/legal/internet-services/icloud/en/terms.html", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Legal", "evidence_quote": "However, Apple reserves the right at all times to determine whether Content is legal, appropriate and in compliance with this Agreement, and may screen, move, refuse, modify and/or remove Content at any time, without prior notice and in its sole discretion, if such Content is found to be in violation of applicable law, this Agreement or is otherwise objectionable.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud (terms)", "topic": "Platform rights over stored photos; whose fault a lost file is", "applies_to_country": "US (document reviewed is the en-US iCloud Terms and Conditions)", "applies_to_scope": "Other jurisdictions have separate iCloud terms", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_apple_icloud_adult_content", "category": "Safety", "title": "[Unverified - being checked] ICloud: Can an account be closed for adult content", "summary": "[Unverified - being checked] Apple's iCloud Terms and Conditions contain no clause that names adult or sexually explicit content; they instead give Apple an unrestricted right to screen or remove anything it finds 'otherwise objectionable' and to take steps to enforce compliance.", "body": "Apple's iCloud Terms and Conditions contain no clause that names adult or sexually explicit content; they instead give Apple an unrestricted right to screen or remove anything it finds 'otherwise objectionable' and to take steps to enforce compliance.\n\nWhat Apple Legal actually says:\n\n“D. Back up Your Content You are responsible for backing up, to your own computer or other device, any important documents, images or other Content that you store or access via the Service. Apple shall use reasonable skill and due care in providing the Service, but Apple does not guarantee or warrant that any Content you may store or access through the Service will not be subject to inadvertent damage, corruption or loss. E. Access to Account and Content Apple reserves the right to take steps Apple believes are reasonably necessary or appropriate to enforce and/or verify compliance with any part of this Agreement.”\n\nNote: Absence-of-clause finding, recorded deliberately rather than inferred. I did not find (and did not open) an Apple document that states iCloud accounts may be terminated specifically for adult content; see could_not_verify.", "source_type": "official", "source_link": "https://www.apple.com/legal/internet-services/icloud/en/terms.html", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Legal", "evidence_quote": "D. Back up Your Content You are responsible for backing up, to your own computer or other device, any important documents, images or other Content that you store or access via the Service. Apple shall use reasonable skill and due care in providing the Service, but Apple does not guarantee or warrant that any Content you may store or access through the Service will not be subject to inadvertent damage, corruption or loss. E. Access to Account and Content Apple reserves the right to take steps Apple believes are reasonably necessary or appropriate to enforce and/or verify compliance with any part of this Agreement.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "iCloud", "topic": "Can an account be closed for adult content", "applies_to_country": "US", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_backup_device_folders", "category": "Safety", "title": "[Unverified - being checked] Google Photos (Android): What syncs by default / how to exclude a folder", "summary": "[Unverified - being checked] Turning Google Photos Backup on also backs up every chosen device folder - not just the camera - and Google documents per-folder toggles plus a 'back up all device folders' switch.", "body": "Turning Google Photos Backup on also backs up every chosen device folder - not just the camera - and Google documents per-folder toggles plus a 'back up all device folders' switch.\n\nWhat Google Photos Help actually says:\n\n“Back up device folders\n\nImportant: When you turn “Backup” on, your chosen device folders are automatically backed up too, not only your camera. You can choose to automatically backup all folders, or turn “Backup” on or off for individual device folders”\n\nNote: This is the concrete answer to 'how do I exclude a folder': Settings path given on the same page is Profile picture > Photos settings > Backup > Back up device folders. The page does NOT state whether Backup is on or off by default - see could_not_verify.", "source_type": "official", "source_link": "https://support.google.com/photos/answer/6193313?hl=en&co=GENIE.Platform%3DAndroid", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "Back up device folders\n\nImportant: When you turn “Backup” on, your chosen device folders are automatically backed up too, not only your camera. You can choose to automatically backup all folders, or turn “Backup” on or off for individual device folders", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos (Android)", "topic": "What syncs by default / how to exclude a folder", "applies_to_country": "*", "applies_to_scope": "Android", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_android_camera_location_tag_per_vendor", "category": "Safety", "title": "[Unverified - being checked] Does the camera embed GPS and where to switch it off", "summary": "[Unverified - being checked] Google's own documentation lists the location-tag switch for each Android camera app under camera settings rather than a single system path, and gives no default value.", "body": "Google's own documentation lists the location-tag switch for each Android camera app under camera settings rather than a single system path, and gives no default value.\n\nWhat Google Photos Help actually says:\n\n“Samsung devices\n1. Open your camera's settings.\n2. Turn on or off Location tags.”\n\nNote: Vendor-set labels differ by OEM and change with OS updates, hence 'high' volatility. Whether geotagging is on by default on a given handset is NOT stated on this page.", "source_type": "official", "source_link": "https://support.google.com/photos/answer/9921876?hl=en", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "Samsung devices\n1. Open your camera's settings.\n2. Turn on or off Location tags.", "volatility": "high", "from_batch": "84-setup-devices-and-backups", "subject": "Android Camera (per manufacturer)", "topic": "Does the camera embed GPS and where to switch it off", "applies_to_country": "*", "applies_to_scope": "Pixel ('Save location'), Samsung ('Location tags'), Motorola/Sony ('Save location'), OnePlus ('Store location data'), Xi", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_location_untouchable_in_app", "category": "Safety", "title": "[Unverified - being checked] Google Photos: Can you remove the GPS that your camera wrote", "summary": "[Unverified - being checked] In Google Photos you can only edit or remove locations the service estimated; a location stamped by the camera itself cannot be edited or removed in-app.", "body": "In Google Photos you can only edit or remove locations the service estimated; a location stamped by the camera itself cannot be edited or removed in-app.\n\nWhat Google Photos Help actually says:\n\n“Important: You can only update or remove estimated locations. If the location of a photo or video was automatically added by your camera, you can't edit or remove the location.”\n\nNote: Practical consequence: the in-app 'Remove location' control is not a way to scrub a geotagged original. Removing camera GPS means not capturing it (camera settings) or scrubbing the file before upload.", "source_type": "official", "source_link": "https://support.google.com/photos/answer/6153599?hl=en&co=GENIE.Platform%3DAndroid", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "Important: You can only update or remove estimated locations. If the location of a photo or video was automatically added by your camera, you can't edit or remove the location.", "volatility": "high", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos", "topic": "Can you remove the GPS that your camera wrote", "applies_to_country": "*", "applies_to_scope": "Android app", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_location_private_by_default", "category": "Safety", "title": "[Unverified - being checked] Google Photos: Whether synced location is exposed to others", "summary": "[Unverified - being checked] Google states that photo locations are private by default and are never shared with advertisers, but that shared albums/conversations can be configured to include them, and Photos also estimates missing locations from image content.", "body": "Google states that photo locations are private by default and are never shared with advertisers, but that shared albums/conversations can be configured to include them, and Photos also estimates missing locations from image content.\n\nWhat Google Photos Help actually says:\n\n“There are 2 ways for a photo to have location data. When you take a photo or video, the camera app may capture and save location data. Or, Google Photos will try to estimate a location based on machine learning, like landmarks detected in your photos and similarities with your other photos that have locations”\n\nNote: Opened and verified in this session ('How Google Photos protects your location data'). Same page, verbatim: 'Locations are private by default. Google Photos only shares locations if you choose to include them when you create a new conversation or shared album, or when you set up partner sharing.'; 'Location data is never shared with advertisers.'; 'Other than for partner sharing, new albums, links, conversations, and other items you share do not include location details by default.'; and the caveat that matters here: 'Even if you don’t include a location when you share with other people, they may be able to guess based on landmarks in your photo or video.' The second mechanism (Google deriving a location that the camera never wrote) is the part people do not opt into.", "source_type": "official", "source_link": "https://support.google.com/photos/answer/11190100?hl=en", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "There are 2 ways for a photo to have location data. When you take a photo or video, the camera app may capture and save location data. Or, Google Photos will try to estimate a location based on machine learning, like landmarks detected in your photos and similarities with your other photos that have locations", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos", "topic": "Whether synced location is exposed to others", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_delete_propagates_and_trash", "category": "Safety", "title": "[Unverified - being checked] Google Photos: Is a deleted photo gone", "summary": "[Unverified - being checked] Deleting in the Google Photos app deletes from the phone as well and from all devices with backup on; deleted items sit in Trash for 30 days and cannot be restored after that, and copies pushed to Blogger, Drive, Gmail or YouTube are not removed.", "body": "Deleting in the Google Photos app deletes from the phone as well and from all devices with backup on; deleted items sit in Trash for 30 days and cannot be restored after that, and copies pushed to Blogger, Drive, Gmail or YouTube are not removed.\n\nWhat Google Photos Help actually says:\n\n“Important: Deleting photos and videos from the Google Photos app deletes the same items from your device. This means that both the Google Photos copy and the one on your device will be deleted. If these items are backed up, the same content will be deleted on all devices with backup turned on.”\n\nNote: Contested retention number: the live Android page I opened says 'If you delete a photo or video that’s backed up in Google Photos, it will stay in your trash for 30 days', while Google's desktop version of the same article (answer/6128858, co=GENIE.Platform=Desktop, read only via search extract) says 60 days for backed-up items and 30 for un-backed-up. Treat the exact number as page- and platform-specific. The same page lists what deletion does NOT clean: 'Items you delete aren't automatically removed from: Blogger, Drive, Gmail, YouTube' - and that 'Deleted photos and videos might stay on a removable memory card.'", "source_type": "official", "source_link": "https://support.google.com/photos/answer/6128858?hl=en&co=GENIE.Platform%3DAndroid", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "Important: Deleting photos and videos from the Google Photos app deletes the same items from your device. This means that both the Google Photos copy and the one on your device will be deleted. If these items are backed up, the same content will be deleted on all devices with backup turned on.", "volatility": "high", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos", "topic": "Is a deleted photo gone", "applies_to_country": "*", "applies_to_scope": "Android", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_face_groups", "category": "Safety", "title": "[Unverified - being checked] Face grouping and what turning it off does", "summary": "[Unverified - being checked] Google Photos groups faces and builds face models; Google's documented off-switch is Settings > Privacy > Face Groups, and switching it off deletes the groups, the face models and your labels.", "body": "Google Photos groups faces and builds face models; Google's documented off-switch is Settings > Privacy > Face Groups, and switching it off deletes the groups, the face models and your labels.\n\nWhat Google Photos Help actually says:\n\n“If you turn off \"Face Groups,\" you delete:\n\n- Face groups in your account\n- Face models used to create those face groups\n- Face labels you created”\n\nNote: Google does not state on this page whether Face Groups is on by default (see could_not_verify). Same page: 'Face Groups occurs in 3 steps' and 'We will store and use your face models, face groups, and face labels until you either delete them or your Google Photos account is inactive for more than two years.' Also: 'Only you can find the private face labels you choose, even if you share those photos.'", "source_type": "official", "source_link": "https://support.google.com/photos/answer/6128838?hl=en&co=GENIE.Platform%3DAndroid", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "If you turn off \"Face Groups,\" you delete:\n\n- Face groups in your account\n- Face models used to create those face groups\n- Face labels you created", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos (Face Groups)", "topic": "Face grouping and what turning it off does", "applies_to_country": "*", "applies_to_scope": "Not available in all regions/account types per Google", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gphotos_locked_folder", "category": "Safety", "title": "[Unverified - being checked] The one folder that is not synced", "summary": "[Unverified - being checked] Locked Folder items stay off the grid, memories, search and albums and are not backed up unless backup for Locked Folder is turned on explicitly; if you uninstall the app, un-backed-up Locked Folder items are lost.", "body": "Locked Folder items stay off the grid, memories, search and albums and are not backed up unless backup for Locked Folder is turned on explicitly; if you uninstall the app, un-backed-up Locked Folder items are lost.\n\nWhat Google Photos Help actually says:\n\n“You can save sensitive photos and videos to a folder protected by your device screen lock in the Google Photos app. Items in Locked Folder won’t appear in the Photos grid, memories, search or albums and won’t be available to other apps on your device that have access to your photos and videos. The Locked Folder is designed to be private and not shared.”\n\nNote: Opened and verified in this session. Same page: 'Locked Folder is protected by Google Photos’ standard encryption practices', backup of Locked Folder is a separate switch, un-backed-up items are lost if you uninstall the app, and you cannot share, move to Trash or send Locked Folder items to third-party apps. Not a metadata control - it does not strip GPS - and the 'safe delete' flow it implies still leaves copies that pre-existed outside the folder.", "source_type": "official", "source_link": "https://support.google.com/photos/answer/10694388?hl=en&co=GENIE.Platform%3DAndroid", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Photos Help", "evidence_quote": "You can save sensitive photos and videos to a folder protected by your device screen lock in the Google Photos app. Items in Locked Folder won’t appear in the Photos grid, memories, search or albums and won’t be available to other apps on your device that have access to your photos and videos. The Locked Folder is designed to be private and not shared.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Photos (Locked Folder)", "topic": "The one folder that is not synced", "applies_to_country": "*", "applies_to_scope": "Android", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_onedrive_camera_roll_is_one_way_upload", "category": "Safety", "title": "[Unverified - being checked] OneDrive (Android/iOS camera upload): What syncs and whether deletion is symmetric", "summary": "[Unverified - being checked] Microsoft states OneDrive camera backup is a one-way upload: deleting from the phone does not delete from OneDrive, and uploads stop if the app is force-closed.", "body": "Microsoft states OneDrive camera backup is a one-way upload: deleting from the phone does not delete from OneDrive, and uploads stop if the app is force-closed.\n\nWhat Microsoft Support actually says:\n\n“The camera roll on your device only backups to Microsoft OneDrive - it does not sync photos both ways. That means you can delete backed up photos and videos from your device, and the copies in OneDrive won't be affected”\n\nNote: This is the leak vector people mis-model: 'I deleted it off my phone' does not delete it from OneDrive. The iOS version of the article says the same ('The camera roll on your device only uploads to OneDrive - it does not sync photos both ways'), and its path is Settings > Camera Upload > toggle, with 'Include Videos' separate.", "source_type": "official", "source_link": "https://support.microsoft.com/en-us/onedrive/automatically-save-photos-and-videos-with-onedrive-for-android", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Microsoft Support", "evidence_quote": "The camera roll on your device only backups to Microsoft OneDrive - it does not sync photos both ways. That means you can delete backed up photos and videos from your device, and the copies in OneDrive won't be affected", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "OneDrive (Android/iOS camera upload)", "topic": "What syncs and whether deletion is symmetric", "applies_to_country": "*", "applies_to_scope": "Android", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_onedrive_camera_roll_off_until_toggled", "category": "Safety", "title": "[Unverified - being checked] OneDrive (Android): Turning photo backup off / excluding folders", "summary": "[Unverified - being checked] Camera backup is a user-turned-on feature in the OneDrive app (the app shows 'Camera backup is off' with a Turn on button), and additional folders are opt-in per folder.", "body": "Camera backup is a user-turned-on feature in the OneDrive app (the app shows 'Camera backup is off' with a Turn on button), and additional folders are opt-in per folder.\n\nWhat Microsoft Support actually says:\n\n“1. In the OneDrive app, tap the account image at the top left of the app.\n\n2. Tap Turn on below the \"Camera backup is off\" text.”\n\nNote: Folder exclusion is documented on the same page: Settings > Camera backup > 'Back up device folders' > 'Flip the categorize toggle ... on if you want to keep the original folders, and flip it off if you want all images to go into your Camera Roll folder' and 'Scroll through the list and choose which folders you want to be backed up'.", "source_type": "official", "source_link": "https://support.microsoft.com/en-us/onedrive/automatically-save-photos-and-videos-with-onedrive-for-android", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Microsoft Support", "evidence_quote": "1. In the OneDrive app, tap the account image at the top left of the app.\n\n2. Tap Turn on below the \"Camera backup is off\" text.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "OneDrive (Android)", "topic": "Turning photo backup off / excluding folders", "applies_to_country": "*", "applies_to_scope": "Android, iOS", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_onedrive_people_grouping", "category": "Safety", "title": "[Unverified - being checked] Face grouping and how to get the data out", "summary": "[Unverified - being checked] Microsoft says OneDrive collects and stores facial scans/biometric information from your photos for grouping, that groupings are visible only to you and are not shared with people you share photos with, and that turning the feature off purges the data within 30 days.", "body": "Microsoft says OneDrive collects and stores facial scans/biometric information from your photos for grouping, that groupings are visible only to you and are not shared with people you share photos with, and that turning the feature off purges the data within 30 days.\n\nWhat Microsoft Support actually says:\n\n“Microsoft collects, uses, and stores facial scans and biometric information from your photos through the OneDrive app for facial grouping technologies. This helps you quickly and easily organize photos of friends and family. Only you can see your face groupings. If you share a photo or album with another individual, face groupings will not be shared.”\n\nNote: Same page: 'You can turn this feature off at any time through Settings. When you turn off this feature in your OneDrive settings, all facial grouping data will be permanently removed within 30 days.' and 'Microsoft does not use any of your facial scans and biometric information to train or improve the AI model overall.' The page does not state whether the feature is on by default (see could_not_verify).", "source_type": "official", "source_link": "https://support.microsoft.com/en-us/onedrive/group-photos-by-people-in-onedrive-photos", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Microsoft Support", "evidence_quote": "Microsoft collects, uses, and stores facial scans and biometric information from your photos through the OneDrive app for facial grouping technologies. This helps you quickly and easily organize photos of friends and family. Only you can see your face groupings. If you share a photo or album with another individual, face groupings will not be shared.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "OneDrive Photos (facial grouping)", "topic": "Face grouping and how to get the data out", "applies_to_country": "*", "applies_to_scope": "Personal OneDrive", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_amazonphotos_auto_save", "category": "Safety", "title": "[Unverified - being checked] Amazon Photos: What syncs by default", "summary": "[Unverified - being checked] Amazon states its own product does not auto-sync: Auto-Save must be turned on in Settings, and once on, every photo taken is backed up automatically.", "body": "Amazon states its own product does not auto-sync: Auto-Save must be turned on in Settings, and once on, every photo taken is backed up automatically.\n\nWhat Amazon (Amazon Photos product page / FAQ) actually says:\n\n“Does Amazon Photos automatically sync? - Amazon Photos does not automatically sync. You can choose to manually select which photos you want to upload to your account, or enable Auto-Save in Settings to ensure that every photo you take is automatically backed up.”\n\nNote: Same page, 'How do I stop photos from syncing to Amazon Photos?': 'Stop photos from automatically syncing to your Amazon Photos account by going to Settings. Once there, make sure that the toggle for Auto-Save is turned off.' Note the page also encourages 'Once you save your pics to Amazon Photos you can safely delete them from your device to free up space' - the copies remain in Amazon's cloud.", "source_type": "official", "source_link": "https://www.amazon.com/Amazon-Photos/b?ie=UTF8&node=13234696011", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Amazon (Amazon Photos product page / FAQ)", "evidence_quote": "Does Amazon Photos automatically sync? - Amazon Photos does not automatically sync. You can choose to manually select which photos you want to upload to your account, or enable Auto-Save in Settings to ensure that every photo you take is automatically backed up.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Amazon Photos", "topic": "What syncs by default", "applies_to_country": "US (page reviewed is amazon.com)", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_amazonphotos_encryption_not_e2ee", "category": "Safety", "title": "[Unverified - being checked] Who can see the photos", "summary": "[Unverified - being checked] Amazon's own FAQ says only you (and anyone you give your password to) can view your photos because they are encrypted - it does not claim end-to-end encryption, so Amazon retains access.", "body": "Amazon's own FAQ says only you (and anyone you give your password to) can view your photos because they are encrypted - it does not claim end-to-end encryption, so Amazon retains access.\n\nWhat Amazon (Amazon Photos product page / FAQ) actually says:\n\n“Who can see my photos? - Because your photos and videos are encrypted, you (and those you share your password with) are the only ones who can view your photos on Amazon Photos.”\n\nNote: Read as written: the guarantee is scoped to other viewers, and password-holders are explicitly inside the trust circle. No statement on this page about Amazon staff, scanning or legal process.", "source_type": "official", "source_link": "https://www.amazon.com/Amazon-Photos/b?ie=UTF8&node=13234696011", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Amazon (Amazon Photos product page / FAQ)", "evidence_quote": "Who can see my photos? - Because your photos and videos are encrypted, you (and those you share your password with) are the only ones who can view your photos on Amazon Photos.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Amazon Photos", "topic": "Who can see the photos", "applies_to_country": "US", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_amazonphotos_tagging_on_by_default", "category": "Safety", "title": "[Unverified - being checked] Amazon Photos (Tagging Features): Image recognition and face grouping defaults", "summary": "[Unverified - being checked] Amazon's Photos Terms of Use say the object/scene 'Tag Photos' feature is enabled automatically on first use and can be disabled, while face tagging ('Tag Specific People') is an enable-or-disable feature whose data is retained until disabled.", "body": "Amazon's Photos Terms of Use say the object/scene 'Tag Photos' feature is enabled automatically on first use and can be disabled, while face tagging ('Tag Specific People') is an enable-or-disable feature whose data is retained until disabled.\n\nWhat Amazon Customer Service (Amazon Photos Terms of Use) actually says:\n\n“The “Tag Photos” feature tags your photos and videos with objects, actions, and scene-related keywords. This feature is enabled automatically when you use the Services for the first time (however, you can disable at any time). The “Tag Specific People” feature allows you to tag and find specific people in your photos and videos. When “Tag Specific People” is enabled, you agree that the Services may collect, store, and use records of individual faces, including to group together photos and videos containing people with similar facial characteristics, organize and tag your photos and videos, and create albums for you.”\n\nNote: Retention clause on the same page: 'We retain image recognition data relating to the photos and videos you store using the Services until you disable the applicable Tagging Feature or your account's access to the Services is terminated.' For Family Vault: 'If Tagging Features are enabled in your Family Vault, you understand that image analysis will be performed on all of the photos and videos stored by members of the Family Vault.'", "source_type": "official", "source_link": "https://www.amazon.com/gp/help/customer/display.html?nodeId=201376540", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Amazon Customer Service (Amazon Photos Terms of Use)", "evidence_quote": "The “Tag Photos” feature tags your photos and videos with objects, actions, and scene-related keywords. This feature is enabled automatically when you use the Services for the first time (however, you can disable at any time). The “Tag Specific People” feature allows you to tag and find specific people in your photos and videos. When “Tag Specific People” is enabled, you agree that the Services may collect, store, and use records of individual faces, including to group together photos and videos containing people with similar facial characteristics, organize and tag your photos and videos, and create albums for you.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Amazon Photos (Tagging Features)", "topic": "Image recognition and face grouping defaults", "applies_to_country": "*", "applies_to_scope": "Tagging Features 'may not be available for customers in certain locations'", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_amazonphotos_terms_content_rule", "category": "Safety", "title": "[Unverified - being checked] Amazon Photos: Can an account be closed for adult content", "summary": "[Unverified - being checked] Amazon's Photos Terms of Use ban 'illegal content' and commercial/third-party use of your files but contain no clause naming adult or sexually explicit content, and the document I read states no content-based termination right.", "body": "Amazon's Photos Terms of Use ban 'illegal content' and commercial/third-party use of your files but contain no clause naming adult or sexually explicit content, and the document I read states no content-based termination right.\n\nWhat Amazon Customer Service (Amazon Photos Terms of Use) actually says:\n\n“You may not use the Services to store, transfer, or distribute illegal content or content of or on behalf of third parties, to operate your own file storage application or service, to operate a photography business or other commercial service, or to resell any part of the Services.”\n\nNote: Regex over the full Terms text for obscene|indecent|sexually|adult returned no match; the page's 'How do I delete photos' siblings are JS-rendered and would not open (see could_not_verify), so Amazon's Trash retention window (30 vs 90 days on different help pages) is left unverified.", "source_type": "official", "source_link": "https://www.amazon.com/gp/help/customer/display.html?nodeId=201376540", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Amazon Customer Service (Amazon Photos Terms of Use)", "evidence_quote": "You may not use the Services to store, transfer, or distribute illegal content or content of or on behalf of third parties, to operate your own file storage application or service, to operate a photography business or other commercial service, or to resell any part of the Services.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Amazon Photos", "topic": "Can an account be closed for adult content", "applies_to_country": "US", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gdrive_adult_content_policy", "category": "Safety", "title": "[Unverified - being checked] Google Drive / Docs (Google's Abuse Program Policies): Cloud storage adult-content policy", "summary": "[Unverified - being checked] Google's abuse policies for Drive/Docs expressly prohibit distributing sexually explicit material including nudity and pornographic material, with an artistic/educational exception.", "body": "Google's abuse policies for Drive/Docs expressly prohibit distributing sexually explicit material including nudity and pornographic material, with an artistic/educational exception.\n\nWhat Google Docs Editors Help (Abuse Program Policies & Enforcement) actually says:\n\n“Sexually Explicit Material\n\nDo not distribute content that contains sexually explicit material, such as nudity, graphic sex acts, and pornographic material. This includes driving traffic to commercial pornography sites. We allow nudity for educational, documentary, scientific, or artistic purposes.\n\nLast updated: January 2021”\n\nNote: Enforcement is stated on the same page: 'This review includes access restriction of content, removal of content, and limitation or termination of a user’s access to Google products.' The page opens: 'The program policies below apply to Drive, Docs, Sheets, Slides, Forms, Vids, Sites, and Pics.'", "source_type": "official", "source_link": "https://support.google.com/docs/answer/148505", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Docs Editors Help (Abuse Program Policies & Enforcement)", "evidence_quote": "Sexually Explicit Material\n\nDo not distribute content that contains sexually explicit material, such as nudity, graphic sex acts, and pornographic material. This includes driving traffic to commercial pornography sites. We allow nudity for educational, documentary, scientific, or artistic purposes.\n\nLast updated: January 2021", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Drive / Docs (Google's Abuse Program Policies)", "topic": "Cloud storage adult-content policy", "applies_to_country": "*", "applies_to_scope": "'Any restrictions pursuant to these policies apply globally unless noted otherwise'", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_gdrive_ncii_and_metadata", "category": "Safety", "title": "[Unverified - being checked] Intimate images and what Google can do to an account", "summary": "[Unverified - being checked] Google prohibits storing or distributing private nude or sexually explicit images without the subject's consent, and reserves review of content plus account disablement across several policies.", "body": "Google prohibits storing or distributing private nude or sexually explicit images without the subject's consent, and reserves review of content plus account disablement across several policies.\n\nWhat Google Docs Editors Help (Abuse Program Policies & Enforcement) actually says:\n\n“Non-Consensual Intimate Imagery (NCII)\n\nDo not store or distribute private nude, sexually explicit, or intimate images or videos without the subject’s consent. If someone has sent a private nude, sexually explicit, or intimate image or video of you, please report it to us here.\n\nLast updated: October 2023”\n\nNote: Same page, Circumvention policy: 'We may take appropriate action if we are notified of circumvention, which may include restricting the sharing of files, removing access to some of our products or disabling your Google Account.' Also 'We may review content for violations of these policies and take action.' This is the closest thing to a metadata/scanning statement Google publishes for Drive, and it says nothing about stripping EXIF.", "source_type": "official", "source_link": "https://support.google.com/docs/answer/148505", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google Docs Editors Help (Abuse Program Policies & Enforcement)", "evidence_quote": "Non-Consensual Intimate Imagery (NCII)\n\nDo not store or distribute private nude, sexually explicit, or intimate images or videos without the subject’s consent. If someone has sent a private nude, sexually explicit, or intimate image or video of you, please report it to us here.\n\nLast updated: October 2023", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Google Drive / Docs (Google's Abuse Program Policies)", "topic": "Intimate images and what Google can do to an account", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_dropbox_aup_adult_content", "category": "Safety", "title": "[Unverified - being checked] Dropbox: Cloud storage adult-content policy", "summary": "[Unverified - being checked] Dropbox's Acceptable Use Policy bars storing material that is 'unlawful pornography, or ... otherwise indecent' - a standard far broader than 'illegal'.", "body": "Dropbox's Acceptable Use Policy bars storing material that is 'unlawful pornography, or ... otherwise indecent' - a standard far broader than 'illegal'.\n\nWhat Dropbox (Acceptable Use Policy) actually says:\n\n“publish, share, or store materials that constitute child sexually exploitative material (including material which may not be illegal child sexual abuse material but which nonetheless sexually exploits or promotes the sexual exploitation of minors), unlawful pornography, or are otherwise indecent;”\n\nNote: Same AUP also covers non-consensual intimate imagery: 'violate the privacy or infringe the rights of others, including publishing, sharing, or storing other people’s confidential information, identifying information, or intimate imagery without authorization...'. The web search extract for this URL additionally shows the enforcement sentence 'We reserve the right to take swift and appropriate action in response to violations of this policy, which could include removing or disabling access to content, suspending a user’s access to the Services, or terminating an account' - that sentence was not in the body my HTTP request returned, so treat it as unconfirmed here (see could_not_verify).", "source_type": "official", "source_link": "https://www.dropbox.com/acceptable_use", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Dropbox (Acceptable Use Policy)", "evidence_quote": "publish, share, or store materials that constitute child sexually exploitative material (including material which may not be illegal child sexual abuse material but which nonetheless sexually exploits or promotes the sexual exploitation of minors), unlawful pornography, or are otherwise indecent;", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Dropbox", "topic": "Cloud storage adult-content policy", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_dropbox_terms_right_to_remove", "category": "Safety", "title": "[Unverified - being checked] Dropbox: Account/content termination right", "summary": "[Unverified - being checked] Dropbox's Terms of Service (posted 7 Jan 2025) state a right to delete or disable content and terminate accounts, at least in the copyright context, and to suspend paid accounts for non-payment.", "body": "Dropbox's Terms of Service (posted 7 Jan 2025) state a right to delete or disable content and terminate accounts, at least in the copyright context, and to suspend paid accounts for non-payment.\n\nWhat Dropbox (Terms of Service) actually says:\n\n“We respect the intellectual property of others and ask that you do too. We respond to notices of alleged copyright infringement if they comply with the law, and such notices should be reported using our Copyright Policy . We reserve the right to delete or disable content alleged to be infringing and terminate accounts of repeat infringers.”\n\nNote: Same page also carries: 'If you don’t pay for your Paid Account on time, we reserve the right to suspend it or remove Paid Account features.' Page footer states: 'Dropbox’s Terms of Service will be changing effective January 1, 2027.' I searched the Terms text for an explicit adult-content clause and for the phrase 'take action'; neither was present in the body I read.", "source_type": "official", "source_link": "https://www.dropbox.com/terms", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Dropbox (Terms of Service)", "evidence_quote": "We respect the intellectual property of others and ask that you do too. We respond to notices of alleged copyright infringement if they comply with the law, and such notices should be reported using our Copyright Policy . We reserve the right to delete or disable content alleged to be infringing and terminate accounts of repeat infringers.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Dropbox", "topic": "Account/content termination right", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_onedrive_msa_adult_content", "category": "Safety", "title": "[Unverified - being checked] OneDrive / Microsoft account (Microsoft Services Agreement): Cloud storage adult-content policy", "summary": "[Unverified - being checked] Microsoft's Services Agreement tells users not to publicly display or use the Services to generate or share content involving nudity or pornography, and reserves the right to block content and close the Microsoft account for violations.", "body": "Microsoft's Services Agreement tells users not to publicly display or use the Services to generate or share content involving nudity or pornography, and reserves the right to block content and close the Microsoft account for violations.\n\nWhat Microsoft (Microsoft Services Agreement) actually says:\n\n“iv. Don’t publicly display or use the Services to generate or share inappropriate content or material (involving, for example, nudity, bestiality, pornography, offensive language, graphic violence, self-harm, or criminal activity).”\n\nNote: Enforcement, same document (Moderation and Enforcement, 'iv. Enforcement'): 'We may block, remove or decline to display content if it appears to violate our Code of Conduct or another Service policy or where required by law. If you violate these terms or Policies, we may take action against your account. This could include limiting access to certain features or Services, stopping providing Services, closing your Microsoft account immediately...' and 'When reviewing alleged violations of these Terms, Microsoft reserves the right to review content to resolve the issue. However, we cannot monitor the entire Services and make no attempt to do so.' Note the qualifier 'publicly display or use' - private storage is addressed by the Code of Conduct, not this sentence.", "source_type": "official", "source_link": "https://www.microsoft.com/en-us/servicesagreement/", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Microsoft (Microsoft Services Agreement)", "evidence_quote": "iv. Don’t publicly display or use the Services to generate or share inappropriate content or material (involving, for example, nudity, bestiality, pornography, offensive language, graphic violence, self-harm, or criminal activity).", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "OneDrive / Microsoft account (Microsoft Services Agreement)", "topic": "Cloud storage adult-content policy", "applies_to_country": "US (en-US agreement reviewed)", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_messaging_whatsapp_retention", "category": "Safety", "title": "[Unverified - being checked] WhatsApp: What the platform keeps of a sent photo", "summary": "[Unverified - being checked] WhatsApp's Privacy Policy says delivered messages are deleted from its servers, undelivered ones are held encrypted up to 30 days, and forwarded media is stored temporarily in encrypted form - and that recipients (and anyone they show it to) can screenshot chats.", "body": "WhatsApp's Privacy Policy says delivered messages are deleted from its servers, undelivered ones are held encrypted up to 30 days, and forwarded media is stored temporarily in encrypted form - and that recipients (and anyone they show it to) can screenshot chats.\n\nWhat WhatsApp (Privacy Policy) actually says:\n\n“We do not retain your messages in the ordinary course of providing our Services to you. Instead, your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers. The following scenarios describe circumstances where we may store your messages in the course of delivering them:\n - Undelivered Messages. If a message cannot be delivered immediately (for example, if the recipient is offline), we keep it in encrypted form on our servers for up to 30 days as we try to deliver it. If a message is still undelivered after 30 days, we delete it.\n - Media Forwarding. When a user forwards media within a message, we store that media temporarily in encrypted form on our servers to aid in more efficient delivery of additional forwards.”\n\nNote: Does this document say media metadata (EXIF/GPS) is stripped on send? No - see could_not_verify. What it does say about metadata is the opposite of 'nothing': 'Your phone number, profile name and photo, \"about\" information, last seen information, and message receipts are available to anyone who uses our Services'; and on capture: 'You should keep in mind that in general any user can capture screenshots of your chats or messages or make recordings of your calls with them and send them to WhatsApp or anyone else, or post them on another platform.'", "source_type": "official", "source_link": "https://www.whatsapp.com/legal/privacy-policy", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "WhatsApp (Privacy Policy)", "evidence_quote": "We do not retain your messages in the ordinary course of providing our Services to you. Instead, your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers. The following scenarios describe circumstances where we may store your messages in the course of delivering them:\n - Undelivered Messages. If a message cannot be delivered immediately (for example, if the recipient is offline), we keep it in encrypted form on our servers for up to 30 days as we try to deliver it. If a message is still undelivered after 30 days, we delete it.\n - Media Forwarding. When a user forwards media within a message, we store that media temporarily in encrypted form on our servers to aid in more efficient delivery of additional forwards.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "WhatsApp", "topic": "What the platform keeps of a sent photo", "applies_to_country": "outside European Region and UK (this is the WhatsApp LLC policy; EEA/UK have separate documents)", "tags": { "lane": "any", "stage": "any", "region": [ "eu" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_messaging_telegram_cloud_vs_secret", "category": "Safety", "title": "[Unverified - being checked] Telegram: Where a sent photo lives", "summary": "[Unverified - being checked] Telegram's own FAQ says default Cloud Chats use server-client encryption and are stored encrypted in the Telegram cloud, while only Secret Chats are end-to-end encrypted and 'leave no trace' on its servers.", "body": "Telegram's own FAQ says default Cloud Chats use server-client encryption and are stored encrypted in the Telegram cloud, while only Secret Chats are end-to-end encrypted and 'leave no trace' on its servers.\n\nWhat Telegram (FAQ) actually says:\n\n“Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions.”\n\nNote: The same FAQ frames the design trade-off: 'Messages in Secret Chats use client-client encryption, while Cloud Chats use client-server/server-client encryption and are stored encrypted in the Telegram Cloud ... This enables your cloud messages to be both secure and immediately accessible from any of your devices'. Telegram's own FAQ warns it 'may contain outdated information'.", "source_type": "official", "source_link": "https://telegram.org/faq", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Telegram (FAQ)", "evidence_quote": "Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Telegram", "topic": "Where a sent photo lives", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_messaging_telegram_metadata_retention", "category": "Safety", "title": "[Unverified - being checked] Telegram: Metadata retention window", "summary": "[Unverified - being checked] Telegram's Privacy Policy states it may collect IP address, devices, app versions and username history for security and abuse prevention and keep that metadata for up to 12 months.", "body": "Telegram's Privacy Policy states it may collect IP address, devices, app versions and username history for security and abuse prevention and keep that metadata for up to 12 months.\n\nWhat Telegram (Privacy Policy) actually says:\n\n“To improve the security of your account, as well as to prevent spam, abuse, and other violations of our Terms of Service, we may collect metadata such as your IP address, devices and Telegram apps you've used, history of username changes, etc. If collected, this metadata can be kept for 12 months maximum.”\n\nNote: Nothing in this document or the FAQ states that Telegram removes GPS/EXIF from photos on send (see could_not_verify). Same policy: 'We only store the data that Telegram needs to function as a secure and feature-rich messaging service' and 'We don't use the contents of any of your chats or contact lists to show you ads.'", "source_type": "official", "source_link": "https://telegram.org/privacy", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Telegram (Privacy Policy)", "evidence_quote": "To improve the security of your account, as well as to prevent spam, abuse, and other violations of our Terms of Service, we may collect metadata such as your IP address, devices and Telegram apps you've used, history of username changes, etc. If collected, this metadata can be kept for 12 months maximum.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Telegram", "topic": "Metadata retention window", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_messaging_signal_minimised_data", "category": "Safety", "title": "[Unverified - being checked] Signal: What the service can disclose about you", "summary": "[Unverified - being checked] Signal says it end-to-end encrypts content and metadata by default and holds essentially nothing else, and its published legal-request log shows that for a 2016 subpoena the only data it could produce was registration date and last connectivity date.", "body": "Signal says it end-to-end encrypts content and metadata by default and holds essentially nothing else, and its published legal-request log shows that for a 2016 subpoena the only data it could produce was registration date and last connectivity date.\n\nWhat Signal Foundation (Government Requests) actually says:\n\n“Signal end-to-end encrypts both content and metadata by default far beyond most of our peers. Our aim is to have access to as close to no data as possible, meaning that we have a fraction of the personal information compared to the average communications service. We simply don’t have access to things like messages, calls, profile information, group information, contacts, stories, call logs, and many other kinds of content and metadata, and we cannot share data in response to valid legal requests that we never had in the first place.”\n\nNote: Same page, 04 Oct 2016 entry: 'the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service.' Signal's own page on whether it strips photo EXIF on send is a separate claim and is NOT covered by this document (see could_not_verify).", "source_type": "official", "source_link": "https://signal.org/bigbrother/", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Signal Foundation (Government Requests)", "evidence_quote": "Signal end-to-end encrypts both content and metadata by default far beyond most of our peers. Our aim is to have access to as close to no data as possible, meaning that we have a fraction of the personal information compared to the average communications service. We simply don’t have access to things like messages, calls, profile information, group information, contacts, stories, call logs, and many other kinds of content and metadata, and we cannot share data in response to valid legal requests that we never had in the first place.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Signal", "topic": "What the service can disclose about you", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_messaging_imessage_attachments_upload_and_retention", "category": "Safety", "title": "[Unverified - being checked] IMessage / Messages (Apple): What happens to a photo you send", "summary": "[Unverified - being checked] Apple states iMessage is end-to-end encrypted and attachments are encrypted, but that attachments may be uploaded to Apple while you compose, and that if the message is never sent the attachments stay on Apple's server for 30 days.", "body": "Apple states iMessage is end-to-end encrypted and attachments are encrypted, but that attachments may be uploaded to Apple while you compose, and that if the message is never sent the attachments stay on Apple's server for 30 days.\n\nWhat Apple Legal (Messages & Privacy) actually says:\n\n“We designed iMessage to use end-to-end encryption, so there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices. Attachments you send over iMessage (such as photos or videos) are encrypted so that no one but the sender and receiver(s) can access them. These encrypted attachments may be uploaded to Apple. To improve performance, your device may automatically upload attachments to Apple while you are composing an iMessage. If your message isn’t sent, the attachments are deleted from the server after 30 days.”\n\nNote: Same page, on the other leak surfaces: 'Messages are backed up in iCloud and encrypted if you enable iCloud Backup or Messages in iCloud'; 'The name and photo you select for messages will be sent to Apple, and stored on Apple’s servers encrypted in a way that Apple cannot see'; and the conduct rule 'iMessage is intended for communicating with family and friends, and is not for conducting commercial activities or disseminating unwanted messages. iMessage misuse may result in service limitations.' The page says nothing one way or the other about stripping GPS/EXIF from a sent photo.", "source_type": "official", "source_link": "https://www.apple.com/legal/privacy/data/en/messages/", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Apple Legal (Messages & Privacy)", "evidence_quote": "We designed iMessage to use end-to-end encryption, so there’s no way for Apple to decrypt the content of your conversations when they are in transit between devices. Attachments you send over iMessage (such as photos or videos) are encrypted so that no one but the sender and receiver(s) can access them. These encrypted attachments may be uploaded to Apple. To improve performance, your device may automatically upload attachments to Apple while you are composing an iMessage. If your message isn’t sent, the attachments are deleted from the server after 30 days.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "iMessage / Messages (Apple)", "topic": "What happens to a photo you send", "applies_to_country": "*", "applies_to_scope": "iOS, iPadOS, macOS, visionOS, watchOS", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_instagram_removal_power", "category": "Safety", "title": "[Unverified - being checked] Instagram (incl. DMs as a sharing surface): Adult content and account risk", "summary": "[Unverified - being checked] Instagram's Help Center states that content that goes against its Community Standards is removed from Instagram, and that it removes content containing adult nudity or sexual activity.", "body": "Instagram's Help Center states that content that goes against its Community Standards is removed from Instagram, and that it removes content containing adult nudity or sexual activity.\n\nWhat Instagram Help Center actually says:\n\n“Our Community Standards define what is and isn’t allowed on Instagram. These guidelines help us keep Instagram an authentic and safe place. If we're made aware of a post that goes against our Community Standards, we'll remove it from Instagram.”\n\nNote: Same page: 'Content that may be sexually explicit or suggestive, such as pictures of people in see-through clothing. (We remove content that contains adult nudity or sexual activity.)' This page addresses feed content and recommendation eligibility; it is not a statement about DMs and it is not a metadata statement. Instagram's DM/attachment metadata behaviour could not be verified from a tier A source (see could_not_verify).", "source_type": "official", "source_link": "https://help.instagram.com/251027992727268", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Instagram Help Center", "evidence_quote": "Our Community Standards define what is and isn’t allowed on Instagram. These guidelines help us keep Instagram an authentic and safe place. If we're made aware of a post that goes against our Community Standards, we'll remove it from Instagram.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "Instagram (incl. DMs as a sharing surface)", "topic": "Adult content and account risk", "applies_to_country": "*", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_screenshots_no_vendor_statement", "category": "Safety", "title": "[Unverified - being checked] Screenshots and screen recording: What metadata they carry", "summary": "[Unverified - being checked] No vendor documentation I opened states what metadata a screenshot carries or that screenshots are metadata-clean; the closest Apple statement is a general one that sharing a photo or video shares its associated metadata.", "body": "No vendor documentation I opened states what metadata a screenshot carries or that screenshots are metadata-clean; the closest Apple statement is a general one that sharing a photo or video shares its associated metadata.\n\nWhat Apple Support (Personal Safety User Guide) actually says:\n\n“When photos and videos that include location metadata are shared, the people you share them with may be able to access the location metadata and learn where it was taken.”\n\nNote: Deliberately thin record: it documents what the vendor page covers (any photo in the library, including a screenshot saved into the library, is subject to whatever location metadata it has) and nothing more. See could_not_verify for the specific screenshot-metadata questions I could not source at tier A.", "source_type": "official", "source_link": "https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (Personal Safety User Guide)", "evidence_quote": "When photos and videos that include location metadata are shared, the people you share them with may be able to access the location metadata and learn where it was taken.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "Screenshots and screen recording", "topic": "What metadata they carry", "applies_to_country": "*", "applies_to_scope": "iOS/Android/Windows/macOS", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_backup_cisa_3_2_1", "category": "Safety", "title": "[Unverified - being checked] US government (CISA) statement of the rule", "summary": "[Unverified - being checked] CISA's 'Data Backup Options' paper states the 3-2-1 rule as three copies (one primary, two backups), on two different media types, with one copy offsite.", "body": "CISA's 'Data Backup Options' paper states the 3-2-1 rule as three copies (one primary, two backups), on two different media types, with one copy offsite.\n\nWhat CISA (US Cybersecurity and Infrastructure Security Agency), 'United States Computer Data Backup Options', Paul Ruggiero and Matthew A. Heckathorn actually says:\n\n“All computer users, from home users to professional information security officers, should back up the critical data they have on their desktops, laptops, servers, and even mobile devices to protect it from loss or corruption. Saving just one backup file may not be enough to safeguard your information. To increase your chances of recovering lost or corrupted data, follow the 3-2-1 rule:\n1 Krogh, Peter. The DAM Book: Digital Asset Management for Photographers, 2nd Edition, p. 207. O’Reilly Media, 2009.\n3 – Keep 3 copies of any important file: 1 primary and 2 backups.\n2 – Keep the files on 2 different media types to protect against different types of hazards.\n1 – Store 1 copy offsite (e.g., outside your home or business facility).”\n\nNote: Quote extracted from text parsed out of the downloaded PDF (6 pages); no publication date is printed in the extracted text. The paper attributes the rule to Peter Krogh's DAM Book (2009). This is the copy of the publication still served at that URL; the newer /2022-12/ path returned 'Page Not Found'.", "source_type": "official", "source_link": "https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "CISA (US Cybersecurity and Infrastructure Security Agency), 'United States Computer Data Backup Options', Paul Ruggiero and Matthew A. Heckathorn", "evidence_quote": "All computer users, from home users to professional information security officers, should back up the critical data they have on their desktops, laptops, servers, and even mobile devices to protect it from loss or corruption. Saving just one backup file may not be enough to safeguard your information. To increase your chances of recovering lost or corrupted data, follow the 3-2-1 rule:\n1 Krogh, Peter. The DAM Book: Digital Asset Management for Photographers, 2nd Edition, p. 207. O’Reilly Media, 2009.\n3 – Keep 3 copies of any important file: 1 primary and 2 backups.\n2 – Keep the files on 2 different media types to protect against different types of hazards.\n1 – Store 1 copy offsite (e.g., outside your home or business facility).", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "3-2-1 backup rule", "topic": "US government (CISA) statement of the rule", "applies_to_country": "US", "applies_to_scope": "Written for 'all computer users, from home users to professional information security officers'", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_backup_ncsc_3_2_1", "category": "Safety", "title": "[Unverified - being checked] UK government (NCSC) statement of the rule", "summary": "[Unverified - being checked] The NCSC's '10 Steps to Cyber Security - Data security' states the rule as at least 3 copies, on 2 devices, with 1 offsite backup, plus an offline copy kept separate from the network.", "body": "The NCSC's '10 Steps to Cyber Security - Data security' states the rule as at least 3 copies, on 2 devices, with 1 offsite backup, plus an offline copy kept separate from the network.\n\nWhat NCSC (National Cyber Security Centre, UK) actually says:\n\n“Have multiple backups of important files stored in different locations. The ‘3-2-1’ rule is a popular strategy that can be used in most scenarios; at least 3 copies, on 2 devices, and 1 offsite backup. This helps ensure that if one copy is compromised, there is at least one other copy intact. This is a key mitigation against ransomware as up-to-date backups will enable you to recover your data.”\n\nNote: Note the NCSC's wording is '2 devices', not '2 media types' as CISA has it. The same page adds the two rules that matter for a photo library: 'Ensure that an offline backup is kept separate from your network, or in a cloud service designed for this purpose' and 'You should also ensure that previous versions of files are protected from accidental or malicious deletion, for example when using cloud synchronisation services for backups' - i.e. a sync service is not a backup.", "source_type": "official", "source_link": "https://www.ncsc.gov.uk/collection/10-steps/data-security", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "NCSC (National Cyber Security Centre, UK)", "evidence_quote": "Have multiple backups of important files stored in different locations. The ‘3-2-1’ rule is a popular strategy that can be used in most scenarios; at least 3 copies, on 2 devices, and 1 offsite backup. This helps ensure that if one copy is compromised, there is at least one other copy intact. This is a key mitigation against ransomware as up-to-date backups will enable you to recover your data.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "3-2-1 backup rule", "topic": "UK government (NCSC) statement of the rule", "applies_to_country": "UK", "applies_to_scope": "Organisational guidance", "tags": { "lane": "any", "stage": "any", "region": [ "uk" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_encryption_bitlocker_windows", "category": "Safety", "title": "[Unverified - being checked] BitLocker / Windows: Full-disk encryption: availability and how to turn it on", "summary": "[Unverified - being checked] Microsoft states BitLocker Drive Encryption is only on Windows Pro, Enterprise or Education - not Home - and is turned on per drive from the BitLocker applet.", "body": "Microsoft states BitLocker Drive Encryption is only on Windows Pro, Enterprise or Education - not Home - and is turned on per drive from the BitLocker applet.\n\nWhat Microsoft Support actually says:\n\n“BitLocker Drive Encryption is only available on devices running Windows Pro, Enterprise, or Education editions. It isn't available on Windows Home edition. If Manage BitLocker isn't listed, it means that you don't have the correct Windows edition.”\n\nNote: Steps on the same page: 'Sign in to Windows with an administrator account'; 'type BitLocker and select Manage BitLocker'; 'To enable encryption, select the option Turn on BitLocker'; 'Select an unlock option and back up the recovery key'. The page also notes 'For devices managed by an organization, BitLocker Drive Encryption is usually managed by the IT department'. A separate page in the same Microsoft index covers 'Device Encryption' (the Home-edition variant) - https://support.microsoft.com/en-us/windows/security/encryption/device-encryption-in-windows - which I did not open, so any claim about it being on by default is unverified here.", "source_type": "official", "source_link": "https://support.microsoft.com/en-us/windows/security/encryption/bitlocker-drive-encryption", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Microsoft Support", "evidence_quote": "BitLocker Drive Encryption is only available on devices running Windows Pro, Enterprise, or Education editions. It isn't available on Windows Home edition. If Manage BitLocker isn't listed, it means that you don't have the correct Windows edition.", "volatility": "medium", "from_batch": "84-setup-devices-and-backups", "subject": "BitLocker / Windows", "topic": "Full-disk encryption: availability and how to turn it on", "applies_to_country": "*", "applies_to_scope": "Windows 11, Windows 10", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r84_setup_devices_and_backups_encryption_filevault_macos", "category": "Safety", "title": "[Unverified - being checked] FileVault / macOS: Full-disk encryption: what it does and how to turn it on", "summary": "[Unverified - being checked] Apple states that on Apple silicon or T2 Macs data is encrypted automatically and FileVault adds the requirement for your login password, while on older Macs FileVault must be turned on to encrypt at all.", "body": "Apple states that on Apple silicon or T2 Macs data is encrypted automatically and FileVault adds the requirement for your login password, while on older Macs FileVault must be turned on to encrypt at all.\n\nWhat Apple Support (Mac User Guide) actually says:\n\n“If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password. If you use a Mac that doesn’t have Apple silicon or the T2 chip, you need to turn on FileVault to encrypt your data.”\n\nNote: Path: Apple menu > System Settings > Privacy & Security > FileVault > Turn on FileVault, then choose iCloud account or a recovery key to unlock the disk. Apple's warning on the same page: 'If you turn on FileVault and then forget your login password and can’t reset it, and you also forget your recovery key, you won’t be able to log in, and your files and settings will be lost forever.' To set up FileVault, you must be an administrator.", "source_type": "official", "source_link": "https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Apple Support (Mac User Guide)", "evidence_quote": "If you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password. If you use a Mac that doesn’t have Apple silicon or the T2 chip, you need to turn on FileVault to encrypt your data.", "volatility": "low", "from_batch": "84-setup-devices-and-backups", "subject": "FileVault / macOS", "topic": "Full-disk encryption: what it does and how to turn it on", "applies_to_country": "*", "applies_to_scope": "macOS Tahoe 26 guide version", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } } ] }