Product
The full walkthrough — every part of the workflow.
FaceGate moves from a consent gate through enrolment, scanning, classification, human-in-the-loop review, obfuscation, threshold tuning, and an audit trail — every step on the device.
Consent gate
Privacy by design
Transparent from the very first tap.
On-device only — Biometric data never leaves the phone.
Plain-language disclosure — Users see exactly what's processed, and why.
Always reversible — All biometric data can be wiped from Settings at any time.
Screening, not judging — Recognition is a checking aid; the final call is always human.
Enrolment
Building the consent list
Add people in seconds. Two categories do all the work.
Include — People who are cleared to appear in published photos.
Exclude — People who must not appear in published photos.
Quality checks — The app rejects blurry photos or angles that won't match well.
Better with more — A few photos per person noticeably improves accuracy.
Scanning
Scan a batch
Point the app at a folder. Get a verdict per photo.
Gallery or camera — Pick an existing batch, or capture live.
Live progress — See it work face-by-face, image-by-image.
Instant summary — Safe / Unsafe / Review counts after every run.
Works offline — No internet, no cloud, no setup outside the app.
Classification
The verdict
Three buckets. One clear decision per photo.
Safe — Only consented (Include) faces detected.
Unsafe — At least one Excluded person was confidently recognised.
Review — A face is uncertain or unknown — flagged for a human to look at.
Color-coded — Green / red / amber. Readable at a glance, even from across a desk.
Human-in-the-loop
Review when it counts
The app never auto-decides on uncertain matches. You do.
One-tap confirm — Approve a suggested match; the photo is added to that person's enrollment.
Gets better as you go — Confirmed faces strengthen future matches.
Manual override — Force Safe / Unsafe / Review whenever you disagree with the app.
Full undo — Every action is reversible.
Unknowns
Handling new faces
Strangers don't get mis-labelled. They get triaged.
Reassign — Pick from the existing roster if the suggestion is wrong.
Create on the fly — Turn a detected face into a brand-new enrolled person.
Mark as unknown — Tell the app it's nobody on file. Setting controls whether unknowns force review.
Stays private — Unknown faces stay on the phone until you decide what to do.
Living consent
Consent can change. So can verdicts.
Flip a person's status — past photos catch up.
Include ↔ Exclude — One toggle changes how their face is treated everywhere.
Automatic re-classification — Past scans are recomputed instantly to reflect the new status.
No re-scanning required — Stored face data is re-scored, not re-extracted from images.
Audit trail — Every status change is timestamped and logged.
Obfuscation
Cover faces, keep the moment
Hide non-consenting faces without losing the photo.
Pick an emoji — Sunglasses, smileys, or a solid block. Your school's tone, your call.
One-tap cover-all — Obscure every detected face at once.
Originals untouched — The overlay is a separate image; the source file is never modified.
Ready to publish — Export the cleaned-up version directly to a feed or download folder.
Thresholds & model
Tune it to your tolerance
Decide how confident the app needs to be to call a match.
AuraFace v1 — ResNet100 + ArcFace head, Apache 2.0 — the only model cleared for commercial use, and the one bundled in the production build.
Confidence sliders — In plain English: how confident is 'definitely a match' versus 'probably'?
Presets — Strict, Balanced, or Loose, depending on whether you'd rather over-flag or under-flag.
Strict Mode — When in doubt, send it to Review. No automatic clearing.
Audit & storage
Accountability built in
Prove what happened. Manage what's stored.
Full audit log — Every enrollment, classification, and override is recorded with a timestamp.
Storage transparency — See exactly what's on the device (face crops, thumbnails, overlays, database).
One-tap wipe — Delete all biometric data from a single screen, with a clear confirmation.
Export & import — Move the consent list between devices without uploading anywhere.
Design
Polish that respects the work
A product that feels as considered as the problem.
Material 3 design — Modern, accessible, familiar.
Dark mode — Reduces eye fatigue during long review sessions.
Color-coded but not color-dependent — Icons and labels back up every color cue.
Sensible defaults — Most settings are right out of the box; you only touch what matters to you.
Want to put FaceGate in front of your team?
A 20-minute call is usually enough to know whether it fits.