Privacy
Privacy
Orchestra analyzes video from San Francisco street cameras. This page explains what is processed, what the public site publishes, who else handles data, how long it is kept and which cookies are set.
In short
Original camera recordings are kept privately on our servers for counting and model training. Models on our servers analyze unblurred video, and frames kept privately for them may be unblurred. At the owner's direction, signed-in live video and alert clips preserve faces. Analyzed still images and images sent to outside AI models remain face-blurred, though blur can miss faces. Audio is never decoded. Face-blurred frames and crops go to OpenAI for demographic estimates, incident second reviews and training labels, and at most five per hourly analysis for city insights; alert clips are emailed privately to the owner and two team members. No imagery, tracks or camera positions are published here.
What the public site publishes
- Averages of people and vehicles in view per counting camera, citywide and for neighborhoods with at least 3 counting cameras, and each camera’s count history by camera ID and neighborhood.
- Forecasts, their saved versions and how they scored.
- Citywide daily counts of possible incidents flagged for AI review, and how many were rejected, expired without a verdict or confirmed by two AI reviews.
- Current alerts with their kind, neighborhood and age. The alerts feed also carries a camera ID for the Orchestra apps; the site does not show it.
- Sampled demographic estimates over a rolling 7-day window, with sample sizes. They are machine estimates of apparent age, presentation and skin lightness, not census data; no identity or race is inferred.
The site never publishes camera images, clips, tracks of individuals, camera positions or addresses, plate text or model-written descriptions of scenes.
Camera video and faces
- Models on our servers analyze unblurred video: object detection and counting run on it, and frames kept privately to train Orchestra’s detector and motion models may be unblurred.
- At the owner's direction, signed-in live video and alert clips preserve faces. YuNet blurs analyzed stills, archive stills, HD evidence clips and images sent to outside AI models; if blurring fails, the image is withheld. No face embeddings or identities are computed.
- Blurring can miss faces, especially small, turned or poorly lit ones, so it is not a guarantee of anonymity. Bodies, clothing, vehicles, plates and the place itself stay visible in blurred images.
- Original recordings also train Orchestra’s review and motion models. Frames from recordings that only models on our servers read are not blurred; frames sent to OpenAI to label training examples are blurred at full resolution first. Live review models on our servers use the configured private live stream. Images sent to conductor-dev or another outside inference service come from the separately blurred analyzed-frame path.
- Audio is never decoded: only video is decoded from recordings and live streams.
- Images and recordings made before face blurring was introduced are withheld from every image and video endpoint.
- Live camera views are available only to signed-in, approved accounts in the 3D world.
Processors
OpenAI
- Hourly city insights, from counts, forecasts and at most 5 face-blurred frames per analysis.
- Demographic estimates, from at most 32 face-blurred person crops per run.
- Second reviews of possible incidents, and learning samples that improve Orchestra’s own incident review, from face-blurred frames.
- Training labels for Orchestra’s own review model, from at most 8 face-blurred clips or stills an hour, and occasional blinded reviews of model comparisons, from face-blurred frames.
Cloudflare
Content delivery and caching, cookieless web analytics on public pages, and delivery of alert and digest email.
Sign-in, and the mailboxes that receive alerts.
Alerts and digests
Alert emails with video clips that preserve faces under the owner's direction go to the owner and two team members. Once delivered, the email passes through Cloudflare’s email service and is stored by Google, outside Orchestra’s retention and access controls, and can be forwarded. A weekly digest goes to the owner and one team member.
Every hour, possible incidents are compared automatically with San Francisco’s public 911 dispatch records for police and fire/EMS, its records of fires and injury crashes, and police, fire and ambulance vehicles seen on our cameras. Only the record queries, for the areas around our cameras, go to San Francisco’s open data portal; the records and the matches stay private on our servers. A match is a machine reference, never proof.
How long data is kept
- Possible-incident records
- 7 days
- Automatic checks of possible incidents against public records and responders, without images
- up to 1 year, or about 30 days when nothing matched
- Sightings of police, fire and ambulance vehicles on camera, without images
- 35 days, and daily summaries up to 400 days
- Public dispatch, fire and crash records fetched for those checks
- up to 400 days
- Nearby incident-type dispatch calls kept to choose saved video to search
- no time limit yet
- Sampled demographic and vehicle estimates, without images
- about 7 days
- Incident clips of possible incidents that were not confirmed; faces follow the owner's configured mode
- about 1 day
- Incident clips of confirmed alerts, reviewed and test events; faces follow the owner's configured mode
- up to 14 days
- Live video buffered for alert clips; faces follow the owner's configured mode
- about 5 minutes
- Records of repeated emergency-service presence
- 14 days
- Face-blurred stills for camera calibration and training
- up to 30 days
- Face-blurred incident learning examples, also sent to OpenAI
- up to 180 days
- Clips kept as reviewed feedback evidence
- up to 1 year
- Live video snapshots for training the motion model
- 24 to 36 hours, up to 60 while a model test reads them
- Log of live frames and video given to the review model; the HLS mode is recorded
- 72 hours
- Motion-model training caches, part of them unblurred frames from recordings, and its checkpoints
- within size caps totaling 86 GiB
- Frames kept to train the detector and for motion-model experiments, which may be unblurred, and the review model’s face-blurred training frames
- no time or size limit yet
- Copies of original recordings buffered for counting
- until counted, within 24 GiB
- Original recordings used for count history
- from the last 56 days
- Accounts on the access list
- at most 1,000
Orchestra reads original recordings from a private archive without changing them; 56 days is how far back count history reaches, not when the archive deletes them. Counts and forecasts are kept as numbers, without images. Storage limits can remove media sooner than the periods above.
Cookies, storage and analytics
- There are no advertising or tracking cookies. Signing in sets strictly necessary cookies:
__Host-sessionfor your session,__Host-csrfagainst request forgery and__Host-loginduring Google sign-in. - Public pages may keep the latest public numbers in your browser’s local storage for up to 24 hours, so a slow connection can show them labeled “From your last visit”. They never leave your device.
- Cloudflare Web Analytics, which sets no cookies, measures page views on public pages only, not in the 3D world.
Contact
Email contact is being set up. Methods are described on the About page.