Dating-app ID checks: what happens to your selfie and identity data?
A dating app can delete your video selfie and still keep information derived from your face. It can also retain screenshots, details extracted from your identity document and a redacted ID image. “We delete the selfie” answers only part of the question you need settled before uploading.
The practical decision is whether you accept the full process: what the operator collects, what it creates from your upload, who receives it and what remains after verification or account closure. Those answers depend on the exact feature and, sometimes, where you live.
We are building FilWest for adult Filipinas and Western partners seeking serious relationships. Our public guides help you make decisions while our dating project remains prelaunch. Here, we use Tinder’s published notices to explain distinctions worth checking with any operator, not to rank services or claim that we have tested their data handling.
Identify The Check Before You Agree
Start with the name on the verification screen. A request to prove that you are a live person is not necessarily a request for a government-issued identity document. Nor does an optional verification feature tell you whether another check can become a condition of using the app.
Tinder’s privacy policy separates Face Data from ID Data. Under ID Data, it says: “You may provide us with a copy of your government-issued ID to help us check that you’re who you say you are.” Its face-data section directs members to different notices for Photo Verification, Photo Check, ID + Photo Verification and Face Check.
Those names matter. Tinder describes ID + Photo Verification as optional and available only to some people in select test markets. Photo Check is different: its notice says unusual activity detected by automated systems or human moderators may lead to a video-selfie prompt before normal app use can resume. Face Check is required in regions where that requirement applies.
Before continuing, establish whether you can decline, what declining changes and which notice governs the request. An optional badge and a check needed to regain access involve different choices. If the screen does not make that distinction clear, ask support rather than borrowing an answer from a similarly named feature.
Separate The Upload From What It Produces
Think of verification as several records, not a single selfie file. Each record can serve a different purpose and have a different deletion route.
The original video selfie is the recording you submit. Audit images are still pictures taken from that recording. Face geometry is information generated from your facial features for comparison. A retained ID image is another record, alongside details extracted from the document and the result of the check.
Tinder’s Photo Check notice provides a concrete example. It describes using facial geometry, called a FaceMap, to generate a unique number called a FaceVector. The FaceMap helps compare the person in the selfie with profile photos. The FaceVector is compared with those from other accounts to help detect whether another profile is using the same likeness.
That explains why deletion of the recording does not end the processing. Tinder says it promptly deletes the Photo Check video selfie, but keeps two audit images and retains the FaceMap and FaceVector for continued verification and likeness checks.
For ID + Photo Verification, Tinder describes comparing the ID photo with the video-selfie face and profile photos. It also checks the date of birth against the profile and whether the person is over 18. Its notice says a mismatching profile date of birth is updated using the submitted ID.
Your question should therefore be more specific than “Do you store my selfie?” Ask which images, extracted details and face-derived records remain. Otherwise, an accurate answer about the original recording can leave the most important part of your decision unresolved.
Read Retention By Record, Not By Slogan
Retention means how long information is kept. Look for both a duration and the event that starts the clock: completion of verification, account closure or an account ban, for example. “Deleted within a period” is incomplete if you do not know when that period begins.
For Tinder’s ID + Photo Verification, the notice says facial geometry and two video-selfie screenshots are kept for the life of the account. It also describes retaining the ID photo, the name on the ID and a redacted image of the document’s front. In its deletion explanation, Tinder states: “We also keep a redacted copy of your ID for the life of your account to audit this feature.”
Redacted does not mean that nothing identifiable remains. This notice says the redacted image hides information such as the address, physical characteristics, ID number and barcodes, while retaining the information specified for the check. That is a narrower record than a full document, but it still needs a retention explanation.
Photo Check has its own schedule. Tinder says the FaceMap and FaceVector remain for the account’s lifetime and are deleted within 30 days of account closure, subject to stated legal or safety-and-security exceptions. Its notice separately says verification results remain until 90 days after closure, or one year if the account is banned. Audit images are kept for 90 days after closure, or up to the duration of an applicable ban.
Do not transfer those Photo Check periods to ID + Photo Verification. The latter directs readers to the privacy policy for deletion after account closure. A useful answer names the record and the feature together.
This is where a short personal note helps. Record what stays during membership, what happens after closure and which exceptions apply. If an operator gives only a general statement about keeping data “as necessary,” ask how that applies to the particular ID image or face template you are about to submit.
Find Out Who Is Responsible And Who Receives It
The company responsible for your data and the company providing verification technology may not be the same. Look for the data controller, meaning the company identified as responsible for the processing, and for service providers or processors handling information on its behalf.
Tinder’s privacy policy identifies different responsible companies according to residence. It names MTCH Technology Services Limited for residents of the EEA, UK and Switzerland, MG Japan Services GK for Japan, and Tinder, LLC for residents outside those areas. For a Filipina and a Western partner, the relevant company may therefore differ even when both use the same brand.
Then read the sharing terms for the exact feature. Tinder’s Photo Check notice says: “Verification Data is only shared with Tinder’s service providers when necessary to manage, troubleshoot, or ensure the smooth operation of our Photo Check feature.” The same notice separately allows sharing Verification Data between Match Group affiliates for safety purposes, to the extent permitted by applicable law.
Both statements belong in your understanding of Photo Check. Quoting only the service-provider sentence would leave out the affiliate disclosure.
ID + Photo Verification uses different wording. Its notice says the specified retained information is stored on AWS servers and that facial geometry information and screenshots are not shared with other third parties. It also describes a separate third-party registered-sex-offender check for participating US residents, with a stated Maine exception, using names and date of birth. That does not justify treating every kind of verification data as subject to one sharing rule.
For your own decision, identify the recipients of the particular information that concerns you. A hosting-provider name alone does not explain every use, and a statement about facial geometry does not necessarily describe what happens to extracted ID details. Also check the operator’s cross-border processing explanation rather than assuming your data stays in your country.
Understand The Deletion Route Before Uploading
You may be comfortable with a check today but want to withdraw later. Before submitting anything, find out whether removing verification data requires account closure, whether individual records can be removed separately and what happens to your account if you do so.
Tinder’s ID + Photo Verification notice says deleting facial geometry requires deleting the Tinder account. It gives the same account-deletion route for information extracted from the ID and the redacted ID copy. The stated reason is to prevent misuse or confusion around continued verified status. By contrast, it says members can request deletion of the two video-selfie screenshots through support.
Photo Check describes account deletion as its general route for deleting Verification Data, but also states that residents of the EEA or Switzerland can delete that data within account settings. Its notice separately provides a request route for video-selfie screenshots.
These are meaningful differences. Someone willing to lose a badge may not be willing to reset matches or close an account. Establish that consequence while you still have the option not to upload.
Keep the request route separate from the completion schedule. Being able to submit a deletion request does not itself tell you when each record disappears or which exceptions apply. If a notice says information is deleted “upon account closure” in one place but gives a post-closure retention period elsewhere, ask the operator to reconcile the wording for the record you want removed.
Keep Operator Verification Separate From A Match’s Request
Do not share identity documents, banking details, passwords or your home address with a match.
An operator’s documented verification process and a stranger asking for a passport photo are not interchangeable. The former should have an identifiable feature, a privacy notice and a defined submission route. A match’s wish for reassurance does not make them an appropriate recipient of your identity document.
If someone sends you a “verification” link in a conversation, open the operator’s app or official website independently and check whether the request exists there. Do not let relationship pressure decide where you upload. You can discuss intentions and boundaries without sending a document to the person you are getting to know.
Our guide to recognising scam warning signs addresses pressure within a conversation. That is a separate assessment from whether you accept the dating operator’s handling of your data.
Decide Whether The Answers Are Enough
You have enough information to consider submitting when you can explain, in ordinary words:
- Which check you are completing and whether it is required.
- What you upload and what additional records the process creates.
- Which company is responsible and which recipients can receive the information.
- How long each important record remains, including after account closure.
- How to request deletion and what that means for continued account use.
Clear answers do not require you to agree. Account-lifetime storage of face geometry might be acceptable to one person and a reason for another to decline. The point is to choose based on the actual arrangement, rather than assuming that a disappearing selfie means no identity information remains.
Where an answer is missing, send a focused question: “For this feature in my country, do you retain the original video, audit images, face template or redacted ID, and can I remove each without closing my account?” You do not need to attach your ID to ask how it would be handled.
If you are still comparing dating services, include these answers alongside communication and access terms. Do not replace an unanswered privacy question with an assumption that another service collects less.
Our role today is educational guidance while FilWest remains prelaunch, not an alternative live verification service. Before submitting to an operator, make sure you understand what remains after the check and accept the route for removing it. If the operator cannot resolve a material gap, pause the upload. Continuing a dating conversation is not a reason to consent to identity-data handling you cannot yet explain.