Biometric policy
Face data: what is kept, and for how long
Last updated August 12, 2026
Making an account means a short live capture from the front camera. A face template is computed from it. The template is destroyed when the check finishes, and in no case later than 24 hours.
Nothing on this page requires you to install anything to read it.
This is the written policy the Illinois Biometric Information Privacy Act asks for at 740 ILCS 14/15(a): a retention schedule, and guidelines for destroying what was collected. Schedule version RET-2026-08-B.
Who collects it, and what for
The operator is PlainSpan LLC, the company that makes Porchkeep. The stated purpose is the whole of the purpose:
To confirm that a living person is making this account, and that they are the person in the photographs on this profile.
A face template is a mathematical description of the geometry of a face. Illinois calls that a biometric identifier, and the word for it here is the same word the statute uses.
The schedule
Five of these eleven lines describe something Porchkeep never holds at all. The third column is the destruction guideline for that line.
| What | How long | What happens to it |
|---|---|---|
| The live capture video | Never written to disk | It exists in your phone's memory for the length of the check and nowhere else. |
| The face template | Until the check finishes. 24 hours at the outside | Destroyed whether the check passed or failed. The 24 hours is a ceiling. |
| The on-device age estimate | Not kept | Used once, to decide whether to ask you for anything more, then discarded with the template. |
| The age band from your device | Not kept | Read from the platform and discarded before the record was written. Never sent anywhere. |
| Which method proved you were an adult | Not kept | Which route proved it is a fact about your paperwork, and it stays yours. |
| An identity document image | Never held | None is ever received here. The processor answers yes or no and destroys the image, and no key exists that could retrieve it. |
| That you are a verified adult | For the life of the account | Deleted when the account is deleted, or immediately if you delete your biometric record. |
| When that was established | For the life of the account | Deleted with the account. |
| Which legal regime applies to you | For the life of the account | Deleted with the account. What it names is a legal regime, at the granularity of a statute. |
| The non-reversible dedupe value | For the life of the account, or until you delete it | One tap in Settings destroys it immediately. That also removes the account's verified state, which the button says. |
| Your consent receipt | For as long as we rely on it | It contains no biometric data. It is the text you agreed to and the moment you agreed. Deletable separately, so deleting your face data never quietly destroys your own evidence. |
What you are shown before the camera opens
Notice version BIO-2026-08-C. It is a full screen of its own, not a clause inside something else, and it appears before the first frame is captured. Published here so the same text is readable by somebody deciding whether to install anything at all.
Who is doing this
PlainSpan LLC, the company that makes this app. No advertising network or data broker receives the capture, and nothing learns from it. There is no third party in this flow at all unless you reach the identity-document step, which almost nobody does, and you will be told before that happens.
What is captured
A few seconds of video from the front camera while you hold three poses. Nobody at Porchkeep watches it, and it never goes on your profile. It is never written to disk; it lives in your phone's memory for the length of the check and nowhere else.
What is computed, and yes, this is biometric
Two things, both on this device. First, a face template: a mathematical description of the geometry of your face. Under the Illinois Biometric Information Privacy Act that template is a biometric identifier, which is why this is a screen rather than a clause. Second, from the same frames, an estimate of your age. It is used once, to decide whether anything more needs asking.
The one purpose it is used for
To confirm that a living person is making this account, and that they are the person in the photographs on this profile. Nothing else: not matching, not ranking. No model is trained on it and no advertising touches it. That is an access boundary inside the systems rather than a line in a policy document, and any other use would mean coming back to ask you again.
Exactly how long it is kept: 24 hours, and usually seconds
The face template is destroyed the moment the check finishes. Pass or fail, no difference. Twenty-four hours is a published ceiling, there to cover a check that has to be finished on a server. The video goes with it. No identity document image is ever stored, because none is ever received.
What is left afterwards
Four things: that you are an adult, when that was established, which legal regime applies to you, and one non-reversible value that stops one person holding two accounts. No age and no birth date. Nothing from which a face could be reconstructed, and no record of which method proved it. All four are in Settings, and the last one deletes in a tap.
Everyone, on identical terms
Every account goes through this same capture before a single word it writes is visible to anybody. Free and paying alike, with no tier that skips it. No subscription in this product changes this check or the threshold behind it.
If you say no
Nothing is captured and no account is created. You keep reading your city's wall exactly as you are now, and saying no does not take that away. No timer brings this back. Come back whenever you want. The two buttons below are the same size on purpose.
One sentence of the section on identical terms is not reproduced above: in the app it names another company as an example. That sentence is left off the public web for reasons that have nothing to do with its accuracy. The rest of the section is word for word.
The sentence you agree to
Section 15(b) asks for a written release. This is it, and agreeing to it is a separate deliberate act rather than a consequence of continuing.
I have read this, and I agree that PlainSpan LLC may create a face template from a live capture for the single purpose stated above, and destroy it within 24 hours.
A receipt is stored with the text as it was read, the version string, and the moment of agreement. It holds no biometric data. It is deletable on its own, so deleting face data never quietly destroys the evidence of what was agreed.
Refusing, and changing your mind
Declining means nothing is captured and no account is created. Reading a city's wall does not require any of this.
After the fact, the non-reversible value derived from the check is deletable from Settings in one tap. That also removes the account's adult status, which the button says before you press it. To ask anything else about face data, write to hello@plainspan.com.
Where this stands today
Porchkeep is not open, no account exists, and no face has been captured. This page is published first on purpose: 740 ILCS 14/15(a) wants the policy public before possession, not after.
Written by PlainSpan LLC and published under 740 ILCS 14/15(a). Schedule RET-2026-08-B, notice BIO-2026-08-C. The same schedule and the same notice render inside the app, and the two move together or neither moves. Review of the biometric package by a licensed Illinois attorney is pending, and this page changes if that review changes it.