Biometric Data Policy

1. What this policy covers

Personas is a dosya feature that groups photos by the people in them. You can give a person a name once and then find their photos by searching for that name. To do that, Personas reads faces and keeps a numeric description of each face. That description is biometric data.

Since November 1, 2026, faces are read on your own device, and the result is end-to-end encrypted with a key only you hold. dosya stores the result only in encrypted form and cannot read it. This policy explains how that works, what dosya stores, and how the data is deleted. It applies in addition to our Privacy Policy.

Personas is off until you turn it on for yourself in a workspace. It is available on every plan, Free included. Nothing described here happens for a user who has not turned it on.

2. How Personas works

• Your own index. When you turn Personas on in a workspace, your device builds a people index for you in that workspace: the faces it finds, which faces belong together, and the names you give them. Each user has their own index. Turning it on does not change what any other member sees, and other members are not told.
• Read on your device. The dosya app, or the dosya web app in your browser, reads the faces. The photos are not sent anywhere to be read.
• Encrypted before it leaves your device. Your device encrypts the index before it sends it to dosya, so your other devices can use it without reading the photos again. The key is opened only with your Vault passphrase or your recovery code, which dosya never sees.
• Your devices share it. Each of your signed-in devices downloads the encrypted index, opens it with your key and keeps an encrypted copy of it locally. A device keeps the opened key in its own protected storage, so People works without asking for your passphrase each time. Signing out removes that key from the device.

3. What dosya stores, and what it does not

dosya stores:

• Your sealed Personas key. One per user, sealed so that only your devices can open it after you unlock with your Vault passphrase or recovery code.
• Encrypted index batches. The batches your devices send, each with its size, a sequence number and the time it was added. dosya cannot open them.
• That Personas is on. dosya can tell that you have Personas on in a workspace, because your encrypted index exists there.

dosya does not store any of the following in a form it can read:

• face signatures (a list of 128 numbers your device computes for each face);
• where faces are in a photo;
• which faces are grouped together;
• the names you give people;
• which photos have faces in them.

dosya cannot read, search, hand over or recover your index. If you lose both your Vault passphrase and your recovery code, your index is lost for good. Your devices can read the photos again, but the names you gave are gone.

Personas never estimates or stores age, gender, ethnicity, mood, health or any other trait.

4. What Personas reads, and what it never reads

Your device reads still images in the workspace that you can see. It reads the reduced copy of each image that dosya already keeps for viewing, and downloads it the same way the viewer does. dosya sees those downloads as it sees any viewing, but never what the device finds in them.

Personas never reads:

• Vault files. Files in an end-to-end encrypted Vault Space.
• Hidden or locked photos. Hidden files, and password-locked files and folders.
• The trash. Photos in the trash.
• Folders you skip. Folders you choose to leave out in your Personas settings.
• Photos you cannot see. Anything outside the folders your access in the workspace covers.
• Videos. Personas reads still images only.

5. Where faces are read, and by what

Faces are read on your own device, inside the dosya app or your web browser. No face is read on dosya's servers, and no third-party face recognition service is involved.

The reading uses two open-source models from the OpenCV model zoo: YuNet, which finds faces, and SFace, which computes a face signature. Your device downloads the models and the reader from dosya and checks each file against a SHA-256 fingerprint before using it. No model provider receives any data.

No sub-processor receives face data. The encrypted index is stored with the rest of your account's data by the providers listed in section 5 of our Privacy Policy, who receive only encrypted data they cannot read.

6. Who can see it

• You. Your people, names and groups are visible only on your own devices, after they have opened your key.
• Not other members. Other members of the workspace never see your index. Nothing from it is shared with them. A member who wants Personas turns it on for themselves and gets their own index.
• Not dosya. dosya staff cannot see it, because dosya cannot decrypt it.
• Not anyone outside. Share links, file requests, transfer links and public share pages never include anything from Personas. The API, the MCP connector, the command-line client, WebDAV and SFTP cannot search by person, because the server cannot read the index.

Face data is never sold, never used for advertising and never used to train machine-learning models.

7. How long it is kept, and how it is deleted

Your index is kept until you delete it or one of the following happens:

• Delete my people in this workspace, or turning Personas off there: deletes your index for that workspace on dosya, and on each of your devices the next time it syncs. Your photos are not touched.
• Leaving a workspace, or being removed from it: deletes your index for that workspace. Deleting the workspace does the same for every member.
• Deleting your Vault identity: deletes your Personas key and your index in every workspace.
• Deleting your account: deletes your Personas key and every index you have.
• A photo you can no longer see: a photo that is deleted, moved where you cannot see it, hidden, locked or in a folder you skip drops out of your index the next time it syncs. A photo restored from the trash is read again.
• Remove person: removes that person and their name from your index. Your index keeps a note of the removed positions, inside the encryption, so reading again does not bring the person back.

Backups. Our database keeps recovery data for up to 30 days to protect against failures. Deleted encrypted batches can remain in it for up to 30 days after deletion. We never restore deleted data from it.

8. Photos of other people

You decide whether to run Personas on photos that show other people. You are responsible for doing so lawfully where you live. Some places have laws about face recognition, including on photos used for personal purposes. If the people in your photos would not want this, do not turn Personas on for those photos, or skip the folders they are in.

9. If your face is in someone else's photos

Each person's index is encrypted with their own key, so dosya cannot see whether your face is in anyone's index and cannot remove it. If you want your face taken out of someone's index, ask that person. They can use Remove person, skip a folder, or delete their index.

If you do not know how to reach them, write to privacy@dosya.dev and tell us which workspace the photos are in. We will forward your request to the owner of that workspace.

10. Children

A dosya account requires the holder to be at least 16 (18 where local law says so). Photos may still show children. Personas treats a child's face like any other face, under the same rules. dosya does not know or estimate anyone's age. A parent or guardian who wants a child's face taken out of someone's index can follow section 9. Our general rules on children are in section 21 of our Privacy Policy.

11. Security

Your index is encrypted on your device before it is sent. Anyone who obtained the Personas data dosya stores would get encrypted batches, their sizes and sequence numbers, and your sealed key, but not your index. Our general security measures are in section 4.2 of our Privacy Policy, and our breach commitments in section 20 of our Privacy Policy.

12. Questions and complaints

Write to privacy@dosya.dev first; we answer within 30 days. You can also complain to the data protection authority where you live, or in Australia to the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au. Your other rights are in section 7 of our Privacy Policy.

13. Changes to this policy

If we change how Personas handles face data, we publish a new version on this page with a new version date and tell people who use Personas in the app or by email before the change applies.

14. Contact

Questions about this policy: privacy@dosya.dev. DOSYA PTY LTD (ABN 27 700 842 235), 4/54 Cintra Road, Bowen Hills, Brisbane, Queensland, Australia 4006.