[Feature] Private/protected images or albums

[DMNh]

The feature

The discussion at #1638 mentions this, but was closed with the addition of archival functionality.

I think that as a separate feature to archival, it would be good to be able to mark individual images and/or albums as private/protected. These images would not show up in the timeline and would require entering the account password or a fingerprint scan to view them.

The rationale behind this feature request is that many people have photos which are NSFW or contain private information and would not want these photos to be viewed accidentally when showing timeline photos to others. This is distinct from archived images, which are hidden from the timeline but are easy enough to view.

In the UI, private/protected images could be accessed from the library tab alongside favourites and archived images. If it were also possible to mark albums in this way, they could be shown with other albums but without a thumbnail image.

Platform

• Server
• Web
• Mobile

[Pheggas]

I would welcome this. As a bonus, it could be password protected or it has a hidden way to open. I noticed some phone galleries has that ability like swipe from specific part of edge to open this "secret stash" or vault. There is no need to enter the password, just know where tap / swipe to open it.

I would love to see described feature above in phone app. I'm not sure if it would be possible on web UI as swipes on the web are not standard. Maybe using a keyboard shortcut (or keystroke pattern like in GTA San Andreas when we were typing the codes for cheats; or arrowkey pattern) to open the vault?

[Vcele]

In terms of Maschine Learning there could also be a suggestion of potentially private photos.

[Pheggas]

Good point. Could @DMNh add those comments / suggestions to original post?

[spusuf]

Photoprism has exactly this, so I'm honestly shocked it hasnt been implemented. There is a config setting for block nsfw upload and hide hsfw from timeline. I prefer Immich so id like to see it implemented.

[xqaz123]

I just installed immich and uploaded lots of old photos. After machine learning searched NSFW which did a great job, and I was thinking.... Why is this not the default behaviour (or at least a checkbox toggle), for immages the machine learning identifies in this way?

[blistovmhz]

eyup. mad props for this idea.
Autodetect NSFW content even before it gets backed up, and at least blur it by default (though honestly i'd rather potential NSFW stuff go directly into a "potentially NSFW" staging album that is properly protected. Same with uploads. The default (if enabled) should be to do best-effort to auto-protect anything NSFW. I'd go with an N confidence interval of NSFW detection and let the user override the protected status later.

[dominikheinz]

I think this would be a good feature.
We could have a toggle in the user account settings to hide/unhide pictures marked as sensitive.

These pictures should then be excluded from not only the timeline, but also the map view, face detection, and excluded in shared albums (maybe the last one should be a separate option)

[ghost]

I feel this would be a good feature to have too.

Right now, "Archive" kind of fulfill the function, but not the form.
I feel like "Archive" should be where you have pictures that already have completed their duty to say so but do not want to delete for reference or safekeeping purposes, while Private pictures would be things that you want to hide on purpose solely for privacy or personal reasons.

And hopefully something better than Apple "Hidden Photos" album comes up... since that is not very private at all!

[Pheggas]

Bump for this

I was thinking about this feature as special album that wouldn't be accessible from album tab like other albums but rather with special hidden button / mouse gesture. Or maybe swiping from side or corner?

[AngelaDMerkel]

I do not think it would be necessary to have a special section for these images a la archived and instead it would be possible to apply a blur to images inline within the timeline if they are marked as being sensitive, and protect them from being unblurred in some way. This would allow users to appreciate their chronology while also obscuring sensitive images from unwanted onlookers. Apple has introduced a feature which blurs sensitive images within their native context and I think this is a much more elegant approach as opposed to simply hiding the images from view altogether.

[l0nax]

VeraCrypt, LUKS, ... is not the correct technology to implement this type of feature.
A more standardized/ ideal way to implement the encryption feature would be to transparently encrypt/ decrypt the DB entries and store a key where the files on disk are encrypted.

There will be no plausible deniability, but this isn't something immich should implement as it's completely out-of-scope.

[AngelaDMerkel]

@tomgade09 I hadn't considered this at all when making my comments. I personally use paperless-ngx to handle those kinds of documents and hadn't considered too highly how other users might make use of their image libraries. I personally only put finished images in my gallery apps and use other document management software for specific things like passports or other critical documentation. I suppose this is a question of what Immich is for and what the goal is, but @bo0tzz makes a clear point: an actual encrypted volume doesn't make sense in this project. 10 years down the line if the project is abandoned or something happens, I prefer to have my images encrypted only by my filesystem on the server I control. If your documents are very precious there are secure solutions to protecting them and I don't think an open source application with web-facing access is the way.

[tomgade09]

@AngelaDMerkel You know, I quite like the look of paperless-ngx. I'm going to check it out further and probably give it a try. Thanks for the tip! Maybe I'm using Immich in a manner different that the developers intend......but I definitely am not going to expose this to the outside world. I don't trust myself to secure it properly for something like that. Just internal network use - so my wife and I can have a joint photo album.

[MRobi1]

The problem with this is when you're showing your elderly mother your vacation photos and have to explain to her why there's so many blurred ones along the way. I'd much rather be able to stash them away in their own folder. I'm equally as worried about the world knowing they exist as I am about them seeing what the photo is.

[spusuf]

Give the user the option. Hide from timeline, move to private folder, blur on timeline, blur in any folder and require interaction to unblur. Options

[spusuf]

+1 this is crucial for a photos backup solution, even if its leveraging the already implemented albums function to create a nsfw album as a master "block all from timeline" group. Then to open the album just use fingerprint or screen lock in the app, pin/immich password as a fallback and for web.
Photoprism has the ability to block nsfw uploads or hide nsfw uploads automatically using machine learning. I'm not even asking for this, just some way of tagging nsfw so it doesnt show in my timeline.

[ma0dan]

this is one of the most important reason for me to choose self-hosted solution
there are some treasure moments i only wanna share with certain people
not in google photos, not in timeline, definetly not in archived

[AlexanderIlyanok]

+1

[frap129]

+1. This feature is the only reason I haven't completely switched from google photos.

[jrasm91]

You said "just excluding photos from the timeline would be a good start". Well, you can already do that, so it sounds like we have a good start.

[frap129]

@jrasm91 I've edited my comment. I wanted to show support this feature request, and added that bit as a potential starting point. I wasn't aware this feature was already in progress.

[jrasm91]

That's fine, I don't see any problem with informing you that archive functionality exists today, so not sure why you commented back with "sure, if you only want one folder with no organization."

I think it is clear we will get other options in the future, and archive isn't planned on being the only one.

[fivestones]

Recently my wife gave birth and I took a bunch of photos. Then about 2 weeks later I was telling a friend how great Immich was. He wanted to see it...and I realized I couldn't show him because close to the top of the timeline were all those photos.

I'd love to have the ability to have photos I mark to not show up on the timeline by default, and with some kind of authentication be able to view a timeline of just those photos, and the option to temporarily include them in the main timeline.

[NicholasFlamy]

You can archive a photo while still having it in an album, or multiple. (Maybe this is a newer feature?)

[thariq-shanavas]

If this is implemented, I feel like there should be a big disclaimer every time a user opens the protected folder that their files are not secure from the server admin, since encryption is a no-go for all the good reasons mentioned here: #450

[bo0tzz]

Folks, if you don't have anything substantial to add please just upvote the original post rather than leaving a "+1" comment.

[mirisbowring]

An additional UseCase is the following:

Me and my partner are on a trip with friends. We create a "Trip yyyy" Album and add all images there. Now we want to share this album to our friends with shared link. This works perfectly right now.
BUT since we also shot many photos of us we don't want to publish all of them. Instead we would like to mark some images "Private" or "internal" which means that only album members can see them and noone with the public link. I don't talk about NSFW images. But not everyone is interested in 200/350 Photos that are only related to the pair.

[jrasm91]

I think the preferred thing to do would just be create a separate album for the target audience, rather than try to have variations of views for a single album.

[mirisbowring]

we are doing it currently but this gets pretty messy after some time.

[mirisbowring]

But i agree that it is not intended to have a super complex view system on albums

[aviv926]

I think that using clip's Embeddings that are created anyway would be a much more accurate and resource efficient idea
There is already something ready like that, you just need to know how to implement it in the code.

https://github.com/LAION-AI/CLIP-based-NSFW-Detector

[Gremious]

I wanted to say, for me personally it would be very important to still be able to share albums with private images, e.g. for sending a link to my partner, or importantly - to friends without accounts. PhotoPrism currently only has an "all or nothing" option which kind of sucks, ether no acc users can't see private photos, or they show up everywhere.

My personal ideal scenario is that I tag images as private and they don't show up when I browse the timeline if I e.g. wanna find a photo in public. However, I can still add them to albums (from a private tab or something) and share them with people without accounts if I so wish.

[AngelaDMerkel]

This improves on Google's feature set greatly. Currently the Locked Folder in Google Photos hides all the included images from view and from sharing. Having a tag to hide images only from the visible timeline but which allows them to be shared is the best of both worlds. Including a password or some kind of rudimentary authentication preventing those photos from being reshared or downloaded might also be a good and worthwhile feature.
It might defeat the purpose if a shared link easily allows those photos to be redistributed. This might be too much work

[Gremious]

Having now tried a billion self hosted image galleries (most notable after immich being LibrePhotos, which is great, but doesn't implement share links for albums), I can comfortably say that my ideal feature set is the following:

1. Public Photos - for the picture of the food I ate today
2. Archived Photos - for the picture I took of my water meter or my receipt
3. Hidden Photos - for the private pictures I took of myself that I want to share with my partner
4. Private Photos - for the private pictures my partner has sent me, or, for the photo of that document which has my social security number on it in big bold letters.

---

Hidden and private photos would be two separate things that typically stack:

Hiding a photo would exclude it "from not only the timeline, but also the map view and (maybe?) face detection". They are potentially saucy and should simply not show up on the client when I browse my photos with my friends at a bar, but otherwise accessible and shareable. Very similar to archived photos.
I think doing actual face detection is fine, so long as no thumbnails of said faces show anywhere.

Access wise you just go go to the sidebar -> hidden to view them. In an ideal world, I could also click to "show hidden" on the timeline - that way, pictures of a party gone wild can make a good and cohesive timeline of private and public photos together. Not necessary thought, can always just make an album for said party.

Private photos, on the other hand, are additionally hidden in shared albums. Immich has user functionality, so it wouldn't be hard for me to imagine a likely later feature that allows you to share private photos with registered users only via name/email. That way, if you send them an album with privated pics they can actually see them, but if they share the link to anyone else you're safe.

When you private a photo, it might be sensible to automatically set it to hidden.

---

Uses:

Stacking wise, the aforementioned document which has my social security number would likely be private, hidden, and archived all three. I don't want someone peeking over my shoulder, or over my internet. I don't want to see it cluttering my timeline ether, nor to accidentally share it.

Personal pictures I don't intend to share (e.g. those shared to me) would likely be private and hidden, but not archived.
On the other hand, those which I do - hidden but not private or archived.

I guess also, a paranoid user can spin up immich and exclusively set their photos to private by default, but not hidden - having a fully functional timeline but basically guaranteeing that they can't accidentally share something, unless the explicitly publicize it, potentially with a registered trusted user. (A lot of gallery apps work this way, actually, private images by default but you need to e.g. generate a sharelink)

[AngelaDMerkel]

This is a better strategy for segregating different kinds of images than I would have considered; largely owing to it being more granular. I agree with your preferences and would love to see them implemented.

[Symbiot78]

+1 here :-)

[NicholasFlamy]

Edit: Hidden Photos are much less likely to be implemented.

Some talk on Discord about everything: https://discord.com/channels/979116623879368755/994044917355663450/1214412287746777098

So based on reading this thread, I wanted to suggest my take. 2 new levels would likely be enough to fit most peoples needs, including many niche cases. For the purpose of this comment I will call one level "Locked" and the other "Hidden" and my example metadata flags I pulled out of my arse so if someone who uses Digikam knows of metadata values that match these then please comment and I'll change what I listed since it would be useful if they matched existing metadata.

Also, the level of visibility should be customizable. I'll get to that in the subpoints.

1. Locked Photos - These would be defined by something like a metadata flag, for example isLocked.

   • These would be hidden everywhere
     • Customization: Timeline would either not show the photo, or show an icon representing a Locked Photo (such as a lock icon with the text "Tap to View" below the lock)
     • Within albums the images would show the icon so that you would know they're there.
   • Requires authentication to view
     • Tapping on a photo would prompt authentication.
       • Swiping onto a Locked Photo would show the lock icon (with the text "Tap to View" below the lock) and you could either continue swiping (or back out of the image viewer) or tap on the image and it would prompt authentication to view it.
     • Potentially have a button somewhere (probably in settings) to prompt authentication and it would allow viewing Locked Photos as though they aren't locked for a set duration of time.
       • NEW Note: Maybe a checkbox for this could be on the authentication prompt for the user's convenience (in addition to a button in settings if you simply want to go into this "Unlock" state without tapping on an image, you can still tap the button in settings.)
         • NEW2 Note: Biometrics could be prompted as soon as you tap but if you hit cancel it would bring you to the menu where you could chose the option as well as manually type the password or tap "Biometric Authentication" to prompt you again but with the checkbox applied (if you applied it.)
       • This would be a client-specific unlock, so it would not unlock access to all clients logged in, you would have to push this button on another client.
       • For those with niche use cases, for the button in settings, allow an unlimited or multi-year duration, maybe just have a dropdown with like 4 options: 5 mins, 15 mins, 1 hour, Custom.
     • You could share a locked photo with other users on your immich instance, but you would be warned.
       • Making a share link public could be limited to the CLI or something so it's possible but not easy. Or make it require a pin to unlock the pictures and you can give the person the pin code/number. And maybe what @Gremious said with a shared album showing all the non-Locked Photos

2. Hidden Photos - These would be defined by something like a metadata flag, for example isHidden.

   • These would be hidden from the timeline with an option to show them blurred as per @AngelaDMerkel
     • I think they should be shown in albums though
   • No authentication or whatever, this is just a light hide from plain view
   • Similar to archiving
   • NEW Note: Smart albums could make archive more useful. If the capability to change the images based on what albums they are in is added, then you could have some albums that archive any pictures added to them. This would allow for separating your water bills from your pictures which are sensitive enough to not need to show up in your timeline, but you don't need to make "Locked"

So all of that is my optimal future scenario. I also have some ideas about album handling with this:

• Album Groups or Nested Albums would be very helpful to make Locked Albums or Locked Album Groups a thing [Feature]: Nested albums #2073
• A locked album automatically locks all of its pictures
• Maybe there should be a built-in album (it's not really an album but removing and adding photos to it is functionally locking and unlocking photos, the point is you can see all of your locked photos in case you forgot you locked something and "lost" it) of locked pictures, (probably not on the albums page, more like the hidden people page)
• Having smart/automatic albums would likely be helpful. [Feature]: Rule-based smart albums #1673 is about albums that add pictures based on certain rules, but I think that there should also be an album rule that can, for example, make all pictures added become Locked Photos or Hidden Photos. For example, if I don't want to lock the album but I do want the photos themselves to be locked I'd worry that an option within the album options would make the album itself locked rather than just the images, but maybe having 2 toggle switches would be fine as follows: "Lock this Album" switch which when on forces the option "Lock All Photos in this Album" to on.

Then the simple implement today solution that would be better than nothing is just making a locked album system with authentication and the photos are visible nowhere but in the locked album.

@Gremious had similar points to me but I actually came up with a lot of this before I saw that comment but still credit.

[AngelaDMerkel]

Functionally they might be very similar, but semantically, they are worlds apart. I don't want my personal photos, which I want to actually browse on my timeline, be lumped in with my water bill.

This is precisely my purpose for being able to hide (or lock) images. While some images are of limited interest, like a receipt or bill, some are of special interest— thereby justifying their being hidden from only some people in some circumstances. Immich draws its inspiration from Google Photos and Google itself has recently implemented a biometrically protected lock folder to store personally sensitive images rather than archive where I keep my miscellaneous images of no viewing value.

How would you combine this with the mobile app and the potential for biometric authentication?

My proposal for this feature, initially, was to have hidden images blurred in timeline and clicking on any of them could prompt biometrics which would then unhide all images until the app or the lock screen in closed. This has the advantage of being obvious to the user, relatively non intrusive, and seamless with their other meaningful images.

I strongly believe that not having some mechanism to protect sensitive images is a grave oversight in an app meant to be used often in public. No one likes handing your phone to a distant relative at a table and telling them not to swipe right just in case.

[NicholasFlamy]

Immich draws its inspiration from Google Photos and Google itself has recently implemented a biometrically protected lock folder to store personally sensitive images rather than archive where I keep my miscellaneous images of no viewing value.

I tried the Locked Folder on Google Photos. It's way more like my "Locked Photos" than "Hidden Photos" (which I mainly got from your earlier post) but it's also a really lame implementation because it doesn't have any organization. You just throw photos in there.

For your whole blurred image idea, thats a lot less likely as most people won't want it but maybe we could get some options like Hide from Timeline, Show Locked Placeholder, and Show Blurred.

[AngelaDMerkel]

@NicholasFlamy Google's implementation is a little crude, yes, but it gets the essential job done which is more important.

most people won't want it

I'm aware, but I think is solves a lot of the organisation and privacy issues in one. Either way, any solution which exceeds only having an archive is completely adequate.

[Gremious]

No, I actually agree with you. It's still needs a way to distinguish between stuff that you don't want showing up in the timeline that's kind of sensitive and water bills.

That's nice to hear :)

While some images are of limited interest, like a receipt or bill, some are of special interest— thereby justifying their being hidden from only some people in some circumstances.

Thats a realy good way to put it. My water bills I don't want on my timeline, but party images I actually do! Clear distinction. I just need them out of view sometimes.

---

How would you combine this with the mobile app and the potential for biometric authentication?

I would not mind doing it the way bitwarden does it. Sorry I couldn't find a great picture of it online but it looks like this, and there's a password input field above those buttons as well, offscreen.

So you tap on a photo, a menu pops up where biometrics are immediate, and you can just tap and view. But if you wanted something special, you can tap cancel, select a dropdown item, and re-press unlock with biometrics or put in your password.

My experience wtih bitwarden has been pretty smooth.

---

but it's also a really lame implementation because it doesn't have any organization.

Yeah and you can't share em, ether, so I never bothered. I used to just have 2 google accounts, so that my main one had a clean timeline. It works but I would much rather something better.

but maybe we could get some options like Hide from Timeline, Show Locked Placeholder, and Show Blurred.

Yeah I think that would be nice, personally.

[NicholasFlamy]

So you tap on a photo, a menu pops up where biometrics are immediate, and you can just tap and view. But if you wanted something special, you can tap cancel, select a dropdown item, and re-press unlock with biometrics or put in your password.

I like that, that's probably the way to go.

[karldonteljames]

I was just going to open a request for this and after reading some of the ideas here that would far surpass any of the alternative solutions options. I'm really enjoying immich and would love to see this implemented.

[johanjongsma]

@AngelaDMerkel @NicholasFlamy @Gremious
I also like to see a feature for hiding a subset of the photos implemented in immich and as this issue is already under discussion for a long time, but at the same time, nothing gets decided, I'd like "us" to come to an agreement and propose that as 'the solution' to Alex and the team. Anybody who likes to chime in is more than welcome to. I strive to have a proposal we can all stand behind by April 30th, 2024.

My proposal, please copy the text in your response and improve where relevant:
_We want all photos on the timeline by default, except the ones NSFS (Not Suitable For Sharing), for whatever reason. So, if an asset has one of these flags and the flag is not unlocked, it will automatically not show up in either timeline, search, or album.
An asset can get a special flag field 'visibility' with values such as 'default', 'private' (NSFW), and 'hidden' (receipts). To display the assets with either flag, the user needs to click 'somewhere' in the menu (TBD), and a biometric or pin code prompt will be shown to unlock the visibility. When unlocked, those assets will be displayed in the timeline/album / search similarly to the other assets. If the app is exited, the screen lock kicked in, etc, the visibility flag will go back to 'default'.

Archive is a state similar to deleted, but not trashed._

This seems to me to be a clean and relatively easy-to-implement solution that should cover more than 95% of the use cases.

What do you think?

Johan

[jordanlambrecht]

@alextran1502 I'm not sure what else is on your roadmap, but this feels like it should be a big one. Not only is it highly requested, but it's a security vulnerability for many people. As others have said, it's a big decision factor when users are choosing between Immich and other options. I think, at least in the interim, adding an option for a simple password protect to the archives folder along with the ability to archive entire albums would be a good temporary solution.

[alextran1502]

@jordanlambrecht There are many big items on the roadmap, at least initially. You can check out my personal list here https://github.com/orgs/immich-app/projects/4

[jordanlambrecht]

@alextran1502 I hear you and I know there are. I appreciate the work you do and hope that didn't sound ungrateful. Just tossing in my two cents as a user.

[alextran1502]

@jordanlambrecht No worries, man! I hope to give the community better visibility on the stuff we are working on and planning to work on soon so people know what to expect!

From a fellow Cornhusker

[jordanlambrecht]

@alextran1502 Woah!! Small world!

[Spinnich]

Just adding an upvote as I'm looking forward to seeing this feature added. As always, amazing app! Love that we just got "Jump-to-date from memory view on the mobile app" as I had been really wanting to see that personally as well.

[madcar86]

Up vote for locked album