How Face Check-In protects you

Face Check-In is built so that convenience never costs you your privacy. Here's exactly what protects you:

It's a template, not a photo. Your device turns your face into an irreversible set of numbers. That template can't be turned back into a picture of you, and it's the only thing stored.

It's scoped, not global. Your template lives only in the private gallery of the organization you enrolled with, matched only against people enrolled for that same place and visit. There is no platform-wide face database, and no other organization can reach it.

You consent, and you can undo it. Enrollment is a one-tap choice, and deleting your face data is a one-tap request you can make anytime — no reason required (see "Delete your face data").

It can't pay for anything. A recognition only ever checks you in or registers you. It never authorizes a charge — payments always stay on the normal checkout screen where you confirm them yourself.