1. Explicit and Separate Consent

The face is a "special category of data" (GDPR Art. 9). Accepting general terms is not enough: you need its own checkbox, unchecked by default, specific to biometrics — as is done in the face verification step.

2. Data Minimization

Only the mathematical vector of your face is stored (irreversible, your photo cannot be reconstructed from it), never the original image after processing. Same for location: the city/coordinate of the moment is stored, not a permanent movement history.

3. Right to Erasure and Portability

You can ask for your face vector and personal data to be deleted at any time (GDPR Art. 17). You can also request a copy of everything Poxtal has about you in a readable format (GDPR Art. 20). This must be resolved within 30 days at most.

4. Limited Retention

If you close your account or request deletion, the biometric vector is deleted permanently and irreversibly, not just "hidden". BIPA requires deleting biometric data at most 3 years after the last interaction, or sooner if the user requests it — Poxtal must obey the shorter limit of the two.

5. Never Sold or Shared with Third Parties

Biometric data is never sold, leased or used for advertising — this is explicitly forbidden by BIPA and is bad practice under GDPR. It is only used for the exact purpose for which you gave consent: verifying that you are you.

6. Mandatory Encryption

All personal and biometric data must travel encrypted (HTTPS/TLS) and be stored encrypted at rest on the server — never in plain text. Passwords are already stored this way (PBKDF2 with salt, 100,000 iterations), and all communication with the server goes over HTTPS.

7. Minors

Processing the biometrics of minors requires verifiable parental consent (GDPR Art. 8, and laws such as COPPA in the US) — Poxtal needs real age verification before allowing registration.

Monthly challenges

Your collection

Today in history

Your Poxtal so far

1. Face Recognition — How Your Face Is Compared

Your profile photo becomes a vector of 128-512 numbers (a face "embedding", with a model such as FaceNet or ArcFace) that describes your features, not the image itself. Every time you re-verify, another vector is generated and compared by cosine similarity: if the result exceeds ~0.6-0.7, it is the same person. The original photo is never stored identically twice — only the vector, and encrypted. This runs on a GPU server, not in the browser.

2. "Proof of Life" Detection (Liveness)

So that no one uses a printed photo or a screen instead of a real face, a random challenge is requested at that moment: blink, turn your head, or smile, while the camera records for a few seconds. The model verifies that there is real 3D movement (not a flat image). Without this, any stolen photo would be enough to pretend to be someone.

3. Fingerprint — or Its Replacement with a Photo

If the phone already has a fingerprint reader, the system's Face ID / native fingerprint is used (Android BiometricPrompt, iOS LocalAuthentication) — the app never sees the fingerprint, it only receives a "yes/no" from the operating system. If the device has no fingerprint sensor, the real replacement is not "photographing the finger" (a fingerprint cannot be reliably verified that way) — the right replacement is using the same face recognition from step 1 as the only biometric factor, strengthened by the liveness challenge from step 2. It is safer than trying to simulate a fingerprint with a camera.

4. One Person, Many Accounts — How It Is Detected

3 signals are crossed; none is enough alone, but together they reveal the pattern:

• Device Fingerprint: hash generated from Canvas/WebGL fingerprint + hardware IDs (native: identifierForVendor on iOS, Android ID) — if the same device creates 2+ accounts, it is flagged.

• Grouping by Location: many new accounts activated from almost identical GPS coordinates in a short time is the classic signal of an "account farm".

• The Face Embedding from Step 1: if two different profiles have face vectors with similarity above ~0.9, it is almost certainly the same face with two identities — automatic block until human review.

5. Anti-Bots at Registration

Instead of an annoying CAPTCHA, the behavior is measured: typing speed, mouse/finger movement, time between registration steps. A perfectly uniform pattern (typical of a script) adds suspicion points. Since this registration ALREADY requires a real camera + liveness challenge + 3 approving contacts, a bot cannot pass on its own — it would need a real person behind it, which defeats the purpose of a mass bot.

6. Screenshot Blocking — A Real Limit We Must Accept

No web browser has a way to prevent a screenshot — it is a design decision by Apple/Google/Microsoft, not something a page's code can avoid. Only a native app can request it: on Android, the flag FLAG_SECURE makes the screen appear black in any capture or recording; on iOS you cannot block the capture itself, but you can detect when it happened (UIScreen.capturedDidChangeNotification) and react (warn the other user, momentarily darken). In this web prototype, the only honest action possible is disabling "save image" on right-click/long-press — a small friction, not a real barrier.

7. Stolen or Replicated Photos of Another Person

Every uploaded photo becomes a perceptual hash (pHash or similar) — it is not like a normal hash, but one that gives similar values to similar images. When a photo is uploaded, the server compares its hash against all photos already existing at the same place:

• Different Angles of the Same Place (without being the same photo)  accepted normally, everyone has their own memory of the place.

• Very Similar (slight edit, crop, filter)  rejected as new valid photos — it does not count as "your" original photo.

• Identical  the exact date of upload and the quality (resolution, if it has its own EXIF) of each copy are stored. The oldest and best-quality one wins — that one stays as the original, the others are deleted from the account that uploaded them later.

8. Consequences and Appeal — Truth First, but with a Way Back

If an account has 3 photos disabled for this reason, it is banned automatically for impersonation — as severe as the rest of the app's anti-fraud rules.

But the real situation of someone whose OWN photo was stolen and who has no way to prove it (they lost it, they don't have the original) is considered. For that there is an appeal to the community: they can ask their own verified contacts to attest that the photo is theirs — such a situation is studied separately, it is not solved by the hash alone. The goal is to prioritize the truth, not just the date.