Ever quietly trained facial recognition AI using its photo storage app

Ever hasn’t kept its facial recognition component a secret, at least from potential buyers or government agencies. Ever’s facial recognition tool was even applauded by NIST, the U.S. agency which sets standards for technology, back in November. Ever placed number one in the US in a ranking of facial recognition vendors by NIST, scoring over 99 percent in both of the benchmarks used.

Doug Aley, Ever’s CEO, told NBC that the company does not share photos or any identifying information with the parties who purchase its facial recognition tool. The user photos are used by Ever to train an algorithm to recognize faces. Aley argued that it the company is clear about its facial recognition practices, but only in its privacy policy — which is very rarely, if ever, read in full by the vast majority of users.

The ACLU called out Ever’s handling of its users photos in a tweet. “Companies shouldn’t use people’s private information to build surveillance tools without their consent,” the ACLU tweeted.

While Ever’s privacy policy does mention it uses facial recognition technology, the reference is fairly vague. “To organize your Files and to enable you to share them with the right people, Ever uses facial recognition technologies as part of the Service. Your Files may be used to help improve and train our products and these technologies. Some of these technologies may be used in our separate products and services for enterprise customers, including our enterprise face recognition offerings, but your Files and your personal information will not be,” writes Ever.

Even more worrisome is that deleting or deactivating your Ever account won’t wipe your photos from Ever’s servers immediately. Ever states that it may need to retain user information for a period of time in order to “comply with legal requirements, resolve disputes, and enforce our agreements.” Ever does not state how long it will need to hold on to the data of deactivated users. Furthermore, Ever won’t delete files you have in common with other users from its servers.

So if you want to erase your photos from Ever’s servers, you’ll have to make sure your friends deactivate the service as well. “Please note, however, that there might be latency in deleting information from our servers and backed-up versions might exist after deletion. In addition, while we will delete requested Files from your account, we do not delete from our servers Files that you have in common with other users,” states Ever in its privacy policy.

Facial recognition isn’t mentioned once (see update below) in the marketing language for the Ever app on Apple’s App Store description, which trumpets “Never run out of photo storage again!”* Ever consistently ranked #1 in Productivity apps for both iOS and Android back in 2016, according to App Annie. But it has since fallen in the rankings, overtaken by other free cloud photo storage apps like Google Photos and Dropbox.

Ever has taken care to separate the marketing for Ever, the photo app and Ever AI, the facial recognition service it’s hawking to interested parties. A look at Ever AI’s website indicates its looking to sell its data to a wide range of clients, including retail, financial services, government and security services. The company touts its “private global database” of 13 billion photos and videos, but doesn’t specify that they were acquired from the Ever photo storage app. A section on “Smart Cities” suggests that Ever can be used to help cities create “fully integrated identity networks.” NBC reported that Ever AI has so far only secured contracts with private companies, and has yet to take on any government clients.

“Ever AI’s face recognition technology enables smart cities to prepare for the future with start-of-the-art identification and attribution technologies. Cities can improve urban planning initiatives by building fully integrated identity networks across sectors such as transportation, education, healthcare, and more,” wrote Ever AI on its website.

Update: Ever responded, noting that its AI business does not sell data, collected from its users or otherwise, to enterprise clients, but ways to use the technology it has developed. Also, the company said it notifies users of the facial recognition technology in use twice: when they first sign up, and prior to using facial recognition in the app.