Kikimi's Privacy-First Face Recognition: On-Device Biometrics with Consent-Gated Matching

Kikimi engaged Taller to rebuild how the app handled biometric data, so its core features could scale without putting user privacy or the company's compliance at risk.

Every uploaded photo's faces went to a server-side recognition service for matching, with no mechanism to separate people who had given consent for biometric processing from those who had not. Honoring per-user consent was not possible on that architecture, which capped the app's discovery features and its entry into new markets across the US, EU, and Canada, each with its own biometric privacy regime. Meanwhile, the invitation and onboarding flow had broken outright when Firebase Dynamic Links was discontinued.

Taller designed a privacy-first hybrid recognition system where consent decided the path each face took. Consenting users' faces could be matched server-side through AWS Rekognition. Everyone else's faces were grouped entirely on the device using MobileFaceNet embeddings with cosine-similarity matching at a carefully tuned threshold. The split was invisible to users. An ownership-based photo data model, immutable server-side, drove sharing and hiding. People discovery was rebuilt as an opt-in on an anti-abuse-aware connection model. Deep linking and onboarding were rebuilt on Kikimi's own backend with Universal Links after the Firebase Dynamic Links sunset. All of this was delivered inside a large legacy UIKit/VIPER codebase.