Data Privacy While Sleuthing

UpdatedOctober 28, 2026

ByEpsteinWiki

Snapshot

Research can expose more than the evidence you meant to collect. A screenshot can capture a private notification. A photo can carry location data. A folder intended for research can upload into a personal cloud library or a shared workspace.

The safest routine is to collect only what you need, preserve an unchanged original in restricted storage, and share a separate copy checked for private information. Before investigating a possible photo leak, establish what actually happened. Giving an app access to photos, backing them up to a cloud account, and sharing them with other people are different events.

If you discover an unexpected upload, stop further automatic uploads and review sharing access. Do not rush to delete your library. First secure and verify an independent copy of anything you need to keep. This guide covers personal privacy and responsible handling of research material, not access to anyone else’s accounts or devices.

Understand what photo access actually means

App permission determines which photos an app can read on your device. Broad access can expose more material to that app than a single selected upload requires. Permission alone does not establish that every photo was uploaded or made public. Conversely, removing permission does not recall files already transmitted.

Google Photos backup saves photos and videos to a Google Account. Google describes backed up items as private unless shared. Check the selected account and the backup status of individual items rather than assuming that everything displayed in the app is in the cloud. On Android, review device folders too: screenshots and downloads may be included, not only camera photos.

Shared albums introduce another audience. An album may have named members, a sharing link, or both. A link can be forwarded beyond the intended group. An unguessable link is not the same protection as access restricted to verified recipients.

Partner sharing can automatically share backed up photos according to its settings. Review whether it includes all photos, a date range, or selected people. Face and date filters are not perfect. A partner may have saved independent copies that your later changes cannot remove.

Public posting is a further step, such as placing an image on a public website or social account. An unexpected cloud backup is a privacy concern, but it is not, by itself, evidence that the internet can see the images.

Respond to an unexpected upload without losing the originals

Work from a device and account you control. If someone else may be monitoring your device or might retaliate when access changes, obtain trusted safety support before making visible changes. Do not send a helper your password, recovery codes, or entire photo library.

Establish the scope. Note the account, device, approximate dates, affected folders, and any sharing settings. Keep this incident note private. Distinguish what you observed from what you fear might have happened.
Stop further uploads. In Google Photos, open your profile, then Photos settings and Backup, and turn backup off. Check other devices using the account. This stops future automatic backup on the affected device; it does not remove existing cloud copies or sharing access.
Restrict unintended sharing. Review albums, links, partner sharing, and any other destinations separately. Stopping backup is not a substitute for this review.
Preserve what you need. Save originals to a secure location outside the affected sync system, ideally an encrypted offline drive. Confirm files actually open and that the copy includes the material you intend to preserve. A thumbnail, shortcut, or cloud placeholder is not sufficient.
Plan removal only after preservation. Decide whether you need to restrict access, remove selected cloud copies, or undo a device backup. These are different operations. Read the current instructions for your device before confirming anything.
Verify the result. Recheck the account, upload status, relevant sharing settings, and independent copies. Keep a short record of what changed. If evidence of unauthorized account access exists, review account security as well.

Google’s deletion guidance warns that deleting through the Photos app can remove device copies and propagate to devices with backup enabled. Its selective cloud removal procedure first turns backup off on every device where copies should remain, then uses the website. Reenabling backup can cause uploads or device deletions. The documented Undo backup option removes cloud items currently on that device while retaining device copies; it is not a guarantee that every item in the account is covered. Other devices and saved partner copies complicate the outcome. Use the device specific help, do not improvise bulk deletion, and do not empty trash or permanently delete during initial containment.

Album sharing controls require both removing members and turning off link sharing to make an owned shared album private. Removing someone alone can leave link access available. These changes can remove collaborators’ contributions, so preserve necessary context first. Disabling sharing cannot erase copies recipients already downloaded.

Stopping partner sharing is a separate control. It restricts ongoing access through that feature, but does not remove photos already saved into the other person’s account. Do not promise that a change has recalled every copy.

Limit photo permissions before the next research session

Android app permissions can be reviewed in Settings, Apps, the relevant app, then Permissions. Names differ by device and version. Check Photos and videos, Files, Camera, Microphone, Contacts, and Location. Grant only what the task requires.

Android’s photo picker supports choosing individual photos and videos for an app rather than handing over a whole library. Use a selective picker when available. Check the actual selected items before submitting, especially when personal and research images are adjacent.

Apple’s permission controls are under Settings and Privacy & Security. Review the relevant app’s Photos access and choose the narrowest option available for your version and workflow. Do not assume that granting photo access also authorizes contacts or location access. Apple also provides App Privacy Report to review permission use and network activity; it is useful context, not proof that nothing was uploaded.

Recheck permissions after installing a new app or changing a workflow. A tool that only needs one document should not automatically receive access to unrelated personal material.

Separate research storage from personal cloud libraries

Use a clearly named research folder with known storage and backup behavior. Keep personal camera rolls, family albums, contact lists, and private messages out of the research workspace. A separate browser profile or account can reduce accidental mixing, but it is not an anonymity guarantee or a security boundary against a compromised device.

Before using a new folder, check whether it belongs to a cloud drive, shared team space, desktop backup, or photo library. Test the workflow with a harmless file and confirm where it appears. Check downloaded attachments, screenshot destinations, and automatic chat media saving rather than only the main evidence folder.

iCloud Photos synchronizes changes across devices, including deletions. With optimized storage, the full original may be in iCloud while the device holds a smaller version. This is why an independent verified backup matters before changing or removing cloud content. Turning off one provider does not disable another provider installed on the same device.

Prefer a deliberate backup plan over having no backup at all. Limit access, protect the account, and keep a separate recovery copy appropriate to the sensitivity of the material. Do not assume a folder marked private is inaccessible to service administrators, account intruders, or anyone already signed into the account.

Collect useful evidence without collecting everything

Start with the question you are trying to answer. Save the smallest amount of material that preserves the relevant context. Do not scrape unrelated personal profiles or assemble dossiers on private people simply because the information is accessible.

For each retained item, record the source URL, page or document title, publisher, access date and time with time zone, and relevant page number or location. Distinguish publication dates from the time you captured the item. Record whether you obtained an original file, a screenshot, a transcription, or a copy supplied by someone else.

Keep the original unchanged in restricted storage. Make working copies for cropping, annotation, conversion, or redaction, and label them clearly. Maintain a short transformation log. A screenshot records what was displayed; it does not independently prove authenticity, authorship, or the truth of its contents.

For sensitive projects, a file checksum can help track whether a preserved file changed after collection. It cannot prove that the source was truthful or establish an earlier history you did not observe. Do not imply a formal evidentiary chain of custody merely because you saved a file and a checksum.

Review both metadata and visible details

Photo location metadata can reveal where an image was taken. Inspect the copy you intend to share for location and other unnecessary metadata. Preserve potentially relevant metadata in the restricted original rather than stripping it from the only copy.

Visible clues can be just as revealing: an address on an envelope, a browser account avatar, open tabs, notifications, a child’s school name, a reflection, a case number linked to a protected person, or a document filename containing a source’s name. Check the entire frame, not only the main subject.

For screen recordings, review every frame and the audio. For documents, examine comments, tracked changes, author fields, embedded attachments, and previous versions where applicable. Renaming a file does not remove information inside it. Removing location metadata does not make a recognizable place unrecognizable.

Redact the copy that will actually be shared

Redaction must remove information from the released file, not merely cover it in an editable layer. A black rectangle placed over PDF text, a transparent marker, a blur, or a crop in an editable document may leave recoverable content. Do not use those as your only protection.

PDF redaction tools distinguish marking content from applying redactions. Apply the changes and save a separate output. Document sanitization addresses hidden material such as metadata, comments, and layers that visible redaction can miss.

For an image, create a new exported copy whose sensitive pixels are actually replaced with opaque pixels, rather than sharing the editable project or original. Reopen the exported file in another viewer. For a PDF, also test text selection, copying, and searching for the removed information. These checks help catch mistakes but are not a substitute for a proper redaction tool and review.

Check the final upload, caption, filename, alt text, and attachment list. A correctly redacted image does not help if the original is attached beside it. Have a second trusted reviewer inspect especially sensitive releases. Never try to reconstruct a protected identity from redactions or encourage others to do so.

Protect research accounts and open links cautiously

Account security guidance recommends unique strong passwords, current software, screen locks, recovery options, and review of connected apps. Use a password manager and protect the email account that controls password resets. Store recovery codes securely, separately from casually shared research notes.

Multifactor authentication adds protection against stolen passwords. Prefer passkeys or hardware security keys where supported for resistance to phishing. Never approve an unexpected sign in prompt or give someone a verification code because they claim to be helping with research.

Open official sites through a known address or bookmark when a message asks you to log in. Check the actual domain rather than trusting link text, a logo, or a document title. Do not bypass browser warnings, enable document macros, install an unexpected extension, or run an executable to view purported evidence. Pause and ask a trusted technical reviewer when a file requires unusual software or access.

Private browsing limits some records left on the device, but does not make activity invisible to websites or network operators. Downloads remain after the session closes. Keep sensitive research away from shared devices and accounts whose administrators you do not trust.

Treat reverse image search and AI uploads as disclosure

Uploading an image to a search engine, transcription service, online converter, or AI assistant gives that service a copy to process. Do not assume that a free tool, private browser window, or disabled history setting means the file never leaves your device.

Google’s visual search guidance explains that images are processed for searches and that history settings affect saved images. Its newer media history guidance describes a gradual settings rollout and circumstances in which saved media may support model improvement or human review. Labels may differ between accounts. Review the controls actually shown, not an old screenshot of someone else’s settings.

Use an already public source image or a minimal, sanitized working copy when suitable. Do not upload unpublished survivor material, private correspondence, identification documents, or an entire phone library to identify a single object. If sanitizing would expose a source or defeat the task, do not upload; choose a different method or obtain an appropriate review first. A search result is a lead to verify, not an identification verdict.

Protect survivors and collaborate deliberately

Public availability is not the same as a good reason to republish. Give particular care to survivors, witnesses, children, and private people who appear incidentally in records. Avoid unnecessary names, contact details, addresses, intimate images, and identifying combinations of facts. Do not infer criminal involvement from proximity, a photograph, a mention in records, or a matching name.

Do not seek to uncover identities protected by redactions or anonymity. Do not contact relatives, employers, neighbors, or witnesses as an informal verification shortcut. Sensitive contact and publication decisions require a separate ethical and editorial review, not just technical confidence.

Share only with people who need the material for a defined task. Verify the recipient and account before granting access. Prefer named recipients and restricted permissions over broadly reusable links, but check whether members can invite others. Do not share account passwords. Agree who may download, forward, edit, retain, or publish material, and when access should end.

Keep source identities separate from general research notes where practical. Use a restricted source register rather than putting names in filenames or group chat titles. Set a retention review date so unnecessary private copies do not accumulate. Preserve material subject to an applicable preservation requirement; do not use routine cleanup to destroy evidence.

Checklist before you share

Can I explain why this material is necessary?
Have I preserved an unchanged original in restricted storage?
Do I know which account, folder, and services hold the working copy?
Have I checked app permissions, automatic uploads, album links, and partner sharing separately?
Have I removed unnecessary visible details and metadata from the release copy?
Have I applied redactions and reopened the actual exported file to inspect it?
Have I checked captions, filenames, alt text, audio, and all attachments?
Are the recipients verified and their permissions limited to the task?
Could this identify or harm a survivor, child, witness, or unrelated private person?
Have I clearly separated documented facts, interpretations, and unresolved questions?

Related guidance

Code of Conduct sets the project standards for confidentiality, lawful research, source contact, and survivor privacy.

Sources

Official guidance checked on October 28, 2026. Interfaces and settings can change; follow the current device specific help before making changes.

PostedOctober 28, 2026

ByEpsteinWiki

Tags: