Privacy
Explained plainly · English version: 17 October 2026 · German original: 17 October 2026
malziME shows you what an AI believes it knows about you from a single photo. Everything it writes is a guess – often wrong, never proven.
The AI deliberately also guesses sensitive things such as origin or skin tone. That is exactly what malziME is meant to show: that algorithms make such assumptions. These guesses are not stored permanently.
You can also use one of our example photos (made by an AI). Then you don't send a photo of your own.
The most important points
- Your photo is deleted immediately after the analysis – usually about a minute after you upload it.
- Where and when the photo was taken never reaches us. Your browser removes this information before it sends anything.
- We don't know who you are: no account, no cookies.
- Your IP address is not stored permanently.
- You don't have to trust us: the entire program code is open, and with one click you can check that exactly this code is running here.
What we never do
- No tracking – no analytics tools, no Facebook pixel, no Google Tag Manager.
- No advertising and no selling of data.
- No facial recognition – the AI recognises that there is a face, but not whose.
- No third-party scripts – fonts, the map software and reading the photo data come from our own server.
Are you under 14?
Then you need permission from your parents or guardians to use a photo of yourself. Without that permission, please use one of the example photos – they work just the same.
This is required by the Austrian Data Protection Act (Datenschutzgesetz, § 4(4) DSG).
Who is responsible?
malziland - learning | training | consulting e.U., owner Christoph Krieger. You'll find all contact details in the legal notice.
Questions about data protection: datenschutz@malzi.me
How an analysis works
- Your browser prepares the photo. It makes it smaller (at most 1280 pixels) and sends on only this new, small version. Location, date taken and file name are dropped. It also converts HEIC photos (for example from Samsung phones) on your device.
- The small photo goes to our server in Belgium (EU). Only these travel with it: the make and model of your camera, your language (German or English) and a random number for this one run, so that we can find errors.
- A short wait. When it's busy, your photo waits in a queue on a server in the EU. Nobody looks at it there.
- The AI analyses the photo. This is done by Mistral AI from Paris. Mistral receives the photo – not your IP address and nothing that could identify you. From it, the AI writes two guessed profiles: “Serious” and “Beast”. For the ad suggestions in the Beast profile we ask the AI once more afterwards – without the photo, only with a few sentences from the profile it has just written itself.
- Your result arrives in your browser. It is deleted from the server shortly afterwards – exactly when is listed below under “What we keep”.
- Close the page – everything is gone. Nothing stays behind in your browser either.
If a photo you upload contains GPS data, malziME shows you where it was taken. For this, your browser fetches the address and the map directly from OpenStreetMap – without going through us. The location data never reaches our servers. For the demo photos, your browser does not ask OpenStreetMap anything: the address and the map of their made-up locations are part of the site.
What we keep – and for how long
Your photo about 1 min
How long: We delete it right after the analysis – usually about a minute after you upload it. When it's busy, there is a wait before that.
Double safety net: If that ever fails, our clean-up removes it after about 2 hours. And if that fails too, Google deletes it by itself once it is 1 day old – Google does not promise an exact time for this.
Why: So that the queue works.
Your IP address about 10 min
How long: About 10 minutes, only in working memory, never on a hard drive.
Why: Protection against misuse (too many requests in a row).
Your finished profile (text only) about 15 min
What exactly: Only the text of your profile – the photo itself is not part of it (how long it stays is listed above). Plus the make and model of your camera and your language. No name, no IP address.
How long: About 15 minutes after your browser has collected it. Never collected: after about 2 hours.
Double safety net: If our clean-up ever fails, Google deletes the profile by itself. This starts 24 hours after the upload and usually takes no more than one more day.
Why: So that your browser can collect it.
Technical log 30 days
What exactly: Which step ran, whether it worked, how long it took, how much text the AI processed, plus the random number. No photo, no profile, no IP address – we have switched off Google's access logs that would contain IP addresses.
How long: 30 days.
Why: Finding errors.
Child-protection check 30 days
What exactly: Two entries per analysis: how long the AI took and what the child-protection filter decided (roughly which age the AI guessed and whether a word from our block list came up). No photo, no profile and no number that could link the entry to anything.
How long: 30 days.
Why: Checking that child protection works reliably.
Reports from your browser 30 days
What exactly: When something goes wrong or works: rough details such as type of error, duration, the page opened, browser type (for example “Safari 17 / iOS”), screen size (small, medium, large), language, network, whether a person, an animal or both were in the picture (not the picture itself), and for a photo that could not be opened, its format and size – plus the random number. No IP address, no photo, no file name.
How long: 30 days.
Why: We keep them for 30 days to find rare device errors across several workshops.
Your rating in the reality check 30 days
What exactly: Voluntary: which of the AI's guesses were right or wrong. No photo, no profile, no number linking it to your analysis.
How long: 30 days.
Why: Counting how accurate the AI is on average.
Counter permanent
What exactly: Only totals, for example “11:30–11:40: 42 analyses finished, 2 turned away”: how many photos were accepted, turned away, dropped, finished or failed, how many results were collected, roughly how long it took, how often the AI was asked again, how much text it processed and how many error reports came from which device group at which step – for the analyses also when the most recent ones were and how long the last ones took. No entry per analysis, no number, no age – no link to any person. You can see the overall figures on the statistics page.
How long: Permanently.
Why: Cost protection, statistics, an honest waiting-time display and seeing where things get stuck in operation.
Two things are Google's rules, not ours: Google keeps deleted database entries for up to one hour as a technical backup – this cannot be switched off, and only we could access them. And Google keeps a mandatory log of our own maintenance work for 400 days (our Google account and our computer's address). It contains no data about you and is stored by Google without a choice of country.
In your browser
No cookies, no permanent storage, no analytics tools. Only while the tab is open, the page remembers a few technical things: the ticket for collecting your result and when it arrived, your choice of “Serious” or “Beast”, your language, the ticket for the reality check and a small crash guard. None of this reveals who you are. Close the tab – everything is gone.
What is an IP address?
Every device on the internet has an address, the IP address – just as a house has a postal address. Every website needs it to be able to send you a page.
Receiving is not storing. We do not store your IP address permanently.
Who is involved
Mistral AI France · EU
Receives: The small photo, to analyse it, and afterwards a few sentences from the profile the AI wrote itself (for the ad suggestions). No IP address, no facial recognition. Nothing is stored – unless Mistral's abuse filter is triggered.
Address: Mistral AI SAS, 15 Rue des Halles, 75001 Paris
Google Belgium · EU
Receives: Our server, the queue and the database run there. When the page loads, Google's worldwide delivery network needs your device's IP address – as with every website; we don't receive it and don't store it.
Address: Google Ireland Ltd.
OpenStreetMap United Kingdom
Receives: Only if you upload a photo with GPS data: the coordinates (also as a map section), your IP address and the usual browser details (browser type, language, that the request comes from malzi.me). Your browser asks directly, without going through us.
Address: OpenStreetMap Foundation
IONOS Germany · EU
Receives: Only if you send us an email: your message.
Address: IONOS SE
Your rights
Access
We have stored nothing we could link to you.
Erasure, rectification, restriction
There is nothing we could link to you.
Taking your data with you
You can save your profile as a PDF.
Withdrawing consent
Simply close the page.
Objecting
You can object at any time to anything we do on the basis of legitimate interest (abuse protection, reports, logs) – a short email to datenschutz@malzi.me is enough.
Complaining
To the Austrian data protection authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (dsb.gv.at).
Legal basis: Art. 15, 16, 17, 18, 20, 21, 7(3) and 77 GDPR.
Do you have to trust us? No.
With most websites you have no other option. You read what the provider writes about itself – and you have no way of checking whether it is true.
With malziME you can check.
The complete blueprint is open on GitHub: the page you are looking at right now, and the part that performs the analysis. With every release we publish a fingerprint alongside it – for every single file a sequence of digits that changes as soon as even one character inside that file changes.
Anyone can look at it: malzi.me/build-info.json. It lists the date, the published version and the digit sequence of every file.
Checking it yourself takes a minute and needs nothing but a terminal – no prior knowledge, no installation:
git clone https://github.com/malziland/malzime.git
cd malzime
sh scripts/pruefe-live.shThe program downloads every file from this website, recalculates its digit sequence and compares it with the blueprint. At the end there is one of three results: everything matches, discrepancy found – or measurement problem, if the check itself did not run cleanly. A measurement error is never reported as a passed check.
Why both routes? The button below is convenient, but it runs on this page. Anyone who had full control over this website could also serve a lying verification program. The command-line route, by contrast, starts from a fresh copy of the source code and is independent of this page. Incidentally, the button's verification program is itself part of the open source code and is itself listed in the fingerprint – it checks itself along with everything else.
Calculates directly in your browser – no terminal, no installation. Nothing is transmitted to us: your browser downloads the files and does the maths itself.
So that this does not stay an empty gesture, we have tied our own hands: our publishing program refuses to start at all if we had changed something that is not openly visible.
There is one thing we cannot prove to you, and we would rather say so openly: the last step runs on Google's machines. We have no access there – nobody outside does.
What we can show: which program code was handed over. That, too, is in the fingerprint, file by file, and you can read it.
What nobody can show: that Google's machines are running exactly this code and nothing else. There is no method for that today – not for us and not for any provider that uses cloud services. This is not a gap we overlooked; it is the state of the art.
In detail: the legal particulars
For parents, teachers and anyone who wants to know exactly.
Legal bases
Your photo and the OpenStreetMap request: your consent (Art. 6(1)(a) GDPR) – you give it by uploading a photo; under 14, your parents' consent is also required (§ 4(4) DSG). No upload, no processing. The secure operation of the website – abuse protection, reports, logs and the evaluation of the child-protection filter – and answering emails: our legitimate interest (Art. 6(1)(f) GDPR).
Mistral AI
Mistral AI processes the photo on our behalf as a processor (Art. 28 GDPR) and, as a French company, is directly subject to the GDPR. We use the EU regional endpoint: according to the contract, the image analysis runs in data centres in the EU or EFTA. For ancillary services Mistral may temporarily use sub-processors outside the EU, in that case with safeguards under Art. 46 GDPR (standard contractual clauses); the list is in the Trust Center. On our paid access, inputs and outputs are not used for training according to the provider's commitment. Zero Data Retention is enabled for our organisation, confirmed in writing by Mistral on 11 August 2026: inputs and outputs are not stored or logged for longer than technically required to produce the answer. Mistral still checks requests automatically for illegal content such as child abuse or violence. We last verified and documented these commitments directly in the Mistral dashboard on 11 August 2026; we check them again at least every six months and before major releases. Contractual basis: Mistral Data Processing Addendum. Mistral's data protection officer: DPO@mistral.ai.
Google Ireland Limited only provides the infrastructure: Firebase Hosting for the website, Cloud Functions for
our server, Cloud Storage for the queue and Cloud Firestore for the counter and queue management – all in the
region europe-west1 (Belgium). Your browser sends your photo and all analysis data directly there,
not through the worldwide delivery network. Google processes the data as a processor
(Art. 28 GDPR) and may not use it for its own purposes. Contractual basis:
Google Cloud Data Processing Addendum. Since May 2026 we have used no Google AI services – neither Vertex AI nor Cloud Vision.
OpenStreetMap
For the United Kingdom, where the OpenStreetMap Foundation is based, there is an adequacy decision by the European Commission.
No automated decision
The profiles are guesses and only show what algorithms might claim. Nothing is decided about you – this is not automated decision-making within the meaning of Art. 22 GDPR.
This English text is a translation. The German version is the legally binding one: malzi.me/datenschutz. Where the two differ, the German text applies. Names of Austrian institutions, courts and registers are given in the original — a translated name cannot be looked up anywhere.