Video of the People Who Keep Appearing in Your Photos | Encore

The short answer

Someone across four years. The friend who is in every trip. Turn on Recognise people in Encore and it gathers the people who keep turning up in your library, then gives each of them a piece of their own, cut on the beat like every other piece. You can name them, or not — naming is not a precondition for seeing them.

Two honest caveats. The by-person recap is still being built — that shelf says so in as many words — and Encore is still marked in development. And "keeps appearing" is a narrow, literal test: a person must turn up in at least three different photos before Encore shows you a row.

Why you are searching for this

The query behind the query is rarely "how do I group faces." It is closer to: I have years of photos of my family and my friends, and no way to watch them as the story they actually are.

The obvious alternative is a search box and a lot of scrolling — type a name into Photos, land on six hundred thumbnails, assemble the year yourself. The other is an app that does the grouping for you, which means uploading the library to somebody's server. Both leave you doing the editorial work, or paying with the photos. This page is about the third option: what an on-device, consent-first way to look back by person actually does, and what it costs.

What "keeps appearing" means here

Photos, not faces. The threshold counts photos, never detected faces. The same person can be detected three times in one photograph — a poster, a mirror, a false positive — and that is one appearance, not three. Counting faces instead produced a roster tail of people labelled "1 photo" who had cleared a bar while only ever appearing once.

Tight on purpose. Faces are grouped by L2 distance between their normalised descriptors, and the cut-off sits deliberately close. When in doubt the system would rather split one person into two rows than merge two people into one — you can merge two rows yourself, and you cannot easily unpick a merged one.

Names hang on faces, not on row numbers. Each person keeps up to five representative faces. When a re-cluster happens — 200 new photos arrive and the group boundaries move — the name you typed follows the representative faces onto whichever new group now holds them, rather than drifting onto a different person because the rows got renumbered.

Groups, and why exact beats clever

The app also detects groups: lineups that keep appearing together, a family, a wedding party, the three friends who travel as a unit. The rule is the same narrowness — a lineup must appear together in at least three photos to count.

What it does not do is mine for overlapping subgroups. It buckets photos by the exact set of people detected in them, deliberately avoiding the cleverer frequent-itemsets approach. The reason is arithmetic: subset enumeration is 2^n, and closed itemsets would put {A, B}, {A, B, C} and {A, C} all on the shelf at once — the same photos shown three times over.

The cost of that choice is honest: one missed detection splits a lineup in two. If someone is in profile in a photo and not detected, that photo lands in a smaller lineup, and you get two similar rows instead of one. The trade is deliberate — missing a group is recoverable, cutting a group wrong is not. In this product, under-reporting beats mis-reporting.

Naming is not a gate, and hiding is not deleting

Naming. A person appears whether or not you have named them. An unnamed row is labelled "Not named yet"; a group you have never named is labelled by how many people are in it. Making a name a precondition turned a page about looking back into a page about entering a contacts list, and the recognising on that page works off the face, not the label.

Hiding. "Don't show this person" takes them off the shelf and out of the by-person pieces — but it is not deletion. Their face data stays, and so does their name, because hiding and naming are two different decisions and collapsing them would quietly eat the name. A hidden person stays on the list at reduced contrast so "Show again" has somewhere to live. Hiding someone in a group removes that whole group, rather than showing the group minus one person, because the group's own name would then describe a lineup that never happened.

If you want the data gone, that is a separate action — Erase face data — covered below.

The three states of consent

The switch is modelled as three states rather than a yes/no, and the middle case is the one that matters: not yet asked.

• Not yet asked — nothing is scanned. The We shelf explains what is about to happen before it offers you the choice, and Settings carries the same switch.
• Turned on — the only state in which scanning is permitted at all.
• Declined — also no scanning, and the app stops asking. It is a final answer, not a pending one.

Collapsing "not yet asked" and "declined" into a single false would be the more convenient implementation and the wrong one: one means ask me, the other means stop asking me, and a single flag cannot tell them apart. It also means no default-on state and no implied consent — and an unrecognisable stored value is read back as "not yet asked" rather than as consent. Being wrong in that direction costs a redundant question; the other way costs a biometric identifier you never agreed to.

What is stored, and for how long

When you turn it on, the app uses Apple's Vision framework to find faces in photos already on the iPhone and converts each one into a 512-number descriptor — a face template. Templates that sit close together become a person. Alongside each template it keeps where that face sits in the frame, which is what makes a face crop possible rather than showing you the whole photo every time.

All of it lives in a database inside Encore's own sandbox on that iPhone. It is not uploaded, not sent to a server, not backed up to us, not sold or leased or traded, and not disclosed to any third party.

Destruction is promised in writing, and the promises are concrete:

• Immediately when you tap Erase face data. Templates, groupings and names are deleted, not hidden.
• On uninstall, with the rest of the sandbox.
• No later than three years after you last use the app, or as soon as the purpose is satisfied — whichever comes first.
• Switching the toggle off stops further scanning but keeps what has already been worked out. Stopping and deleting are separate actions on purpose.

Face data also gets its own database rather than living in the shared photo index. That is not tidiness: when you ask for deletion, the result has to be verifiable. Surgery inside a shared table is hard to eyeball, and a screen still listing people who no longer exist would refute the very thing the tap promised.

Corrections go the other way, too. If you tell the app a face is not that person, or hide someone, a later scan will not overwrite it.

What Encore does differently, and what it does not

The differentiator is not that Encore recognises faces. It is the shape of the consent and the deletion around that recognition — the three-state gate, corrections that survive rescans, the three-year clock, a destroy-on-tap that is actually verifiable, and the fact that the whole thing is separable: every other kind of story Encore builds is made from time, place and image statistics, never from faces. Leaving recognition off costs you the We shelf and nothing else.

The honest limits are just as concrete:

• The by-person recap is still being built. The shelf says so. That is the current state of this feature, not a footnote.
• It counts photos. Someone who appears once a year for three years counts; someone who appears five times in one afternoon does not.
• A missed detection splits a group. Under-reporting is the accepted trade.
• Apple's own face grouping in Photos is not available to third-party apps, which is why the recognition runs here, on-device, rather than reading an existing grouping.
• If you grant only selected photos, Encore tells you plainly that its picks would come from a hand-picked subset and would therefore be misleading — rarity, density and "you never went back" all depend on seeing the whole library. It would rather refuse the inference than produce a wrong one.

Deciding whether to turn it on

The switch costs nothing to flip and nothing to undo. Turn it on and look; if you do not like the answer, one tap in Settings destroys it and the rest of Encore is unchanged.

It is worth turning on if the honest reason you are here is that the people in your photos matter more than any single trip does. It is not worth turning on if you expected the piece to already be finished — that part is still landing. What is already real is the part that is easy to overlook: nothing leaves the phone, and nothing about the people in your photos is decided by somebody else's server.

Encore reads the library you already have and plays it back on the beat. For the wider picture, start with what it looks for in your photos and how to keep what you want. It requires iOS 17 or later on iPhone.