[Feature] Private/protected images or albums

[DMNh]

The feature

The discussion at #1638 mentions this, but was closed with the addition of archival functionality.

I think that as a separate feature to archival, it would be good to be able to mark individual images and/or albums as private/protected. These images would not show up in the timeline and would require entering the account password or a fingerprint scan to view them.

The rationale behind this feature request is that many people have photos which are NSFW or contain private information and would not want these photos to be viewed accidentally when showing timeline photos to others. This is distinct from archived images, which are hidden from the timeline but are easy enough to view.

In the UI, private/protected images could be accessed from the library tab alongside favourites and archived images. If it were also possible to mark albums in this way, they could be shown with other albums but without a thumbnail image.

Platform

• Server
• Web
• Mobile

[Pheggas]

I would welcome this. As a bonus, it could be password protected or it has a hidden way to open. I noticed some phone galleries has that ability like swipe from specific part of edge to open this "secret stash" or vault. There is no need to enter the password, just know where tap / swipe to open it.

I would love to see described feature above in phone app. I'm not sure if it would be possible on web UI as swipes on the web are not standard. Maybe using a keyboard shortcut (or keystroke pattern like in GTA San Andreas when we were typing the codes for cheats; or arrowkey pattern) to open the vault?

[Vcele]

In terms of Maschine Learning there could also be a suggestion of potentially private photos.

[Pheggas]

Good point. Could @DMNh add those comments / suggestions to original post?

[spusuf]

Photoprism has exactly this, so I'm honestly shocked it hasnt been implemented. There is a config setting for block nsfw upload and hide hsfw from timeline. I prefer Immich so id like to see it implemented.

[xqaz123]

I just installed immich and uploaded lots of old photos. After machine learning searched NSFW which did a great job, and I was thinking.... Why is this not the default behaviour (or at least a checkbox toggle), for immages the machine learning identifies in this way?

[blistovmhz]

eyup. mad props for this idea.
Autodetect NSFW content even before it gets backed up, and at least blur it by default (though honestly i'd rather potential NSFW stuff go directly into a "potentially NSFW" staging album that is properly protected. Same with uploads. The default (if enabled) should be to do best-effort to auto-protect anything NSFW. I'd go with an N confidence interval of NSFW detection and let the user override the protected status later.

[dominikheinz]

I think this would be a good feature.
We could have a toggle in the user account settings to hide/unhide pictures marked as sensitive.

These pictures should then be excluded from not only the timeline, but also the map view, face detection, and excluded in shared albums (maybe the last one should be a separate option)

[ghost]

I feel this would be a good feature to have too.

Right now, "Archive" kind of fulfill the function, but not the form.
I feel like "Archive" should be where you have pictures that already have completed their duty to say so but do not want to delete for reference or safekeeping purposes, while Private pictures would be things that you want to hide on purpose solely for privacy or personal reasons.

And hopefully something better than Apple "Hidden Photos" album comes up... since that is not very private at all!

[Pheggas]

Bump for this

I was thinking about this feature as special album that wouldn't be accessible from album tab like other albums but rather with special hidden button / mouse gesture. Or maybe swiping from side or corner?

[AngelaDMerkel]

I do not think it would be necessary to have a special section for these images a la archived and instead it would be possible to apply a blur to images inline within the timeline if they are marked as being sensitive, and protect them from being unblurred in some way. This would allow users to appreciate their chronology while also obscuring sensitive images from unwanted onlookers. Apple has introduced a feature which blurs sensitive images within their native context and I think this is a much more elegant approach as opposed to simply hiding the images from view altogether.

[l0nax]

VeraCrypt, LUKS, ... is not the correct technology to implement this type of feature.
A more standardized/ ideal way to implement the encryption feature would be to transparently encrypt/ decrypt the DB entries and store a key where the files on disk are encrypted.

There will be no plausible deniability, but this isn't something immich should implement as it's completely out-of-scope.

[AngelaDMerkel]

@tomgade09 I hadn't considered this at all when making my comments. I personally use paperless-ngx to handle those kinds of documents and hadn't considered too highly how other users might make use of their image libraries. I personally only put finished images in my gallery apps and use other document management software for specific things like passports or other critical documentation. I suppose this is a question of what Immich is for and what the goal is, but @bo0tzz makes a clear point: an actual encrypted volume doesn't make sense in this project. 10 years down the line if the project is abandoned or something happens, I prefer to have my images encrypted only by my filesystem on the server I control. If your documents are very precious there are secure solutions to protecting them and I don't think an open source application with web-facing access is the way.

[tomgade09]

@AngelaDMerkel You know, I quite like the look of paperless-ngx. I'm going to check it out further and probably give it a try. Thanks for the tip! Maybe I'm using Immich in a manner different that the developers intend......but I definitely am not going to expose this to the outside world. I don't trust myself to secure it properly for something like that. Just internal network use - so my wife and I can have a joint photo album.

[MRobi1]

The problem with this is when you're showing your elderly mother your vacation photos and have to explain to her why there's so many blurred ones along the way. I'd much rather be able to stash them away in their own folder. I'm equally as worried about the world knowing they exist as I am about them seeing what the photo is.

[spusuf]

Give the user the option. Hide from timeline, move to private folder, blur on timeline, blur in any folder and require interaction to unblur. Options

[spusuf]

+1 this is crucial for a photos backup solution, even if its leveraging the already implemented albums function to create a nsfw album as a master "block all from timeline" group. Then to open the album just use fingerprint or screen lock in the app, pin/immich password as a fallback and for web.
Photoprism has the ability to block nsfw uploads or hide nsfw uploads automatically using machine learning. I'm not even asking for this, just some way of tagging nsfw so it doesnt show in my timeline.

[ma0dan]

this is one of the most important reason for me to choose self-hosted solution
there are some treasure moments i only wanna share with certain people
not in google photos, not in timeline, definetly not in archived

[AlexanderIlyanok]

+1

[frap129]

+1. This feature is the only reason I haven't completely switched from google photos.

[jrasm91]

You said "just excluding photos from the timeline would be a good start". Well, you can already do that, so it sounds like we have a good start.

[frap129]

@jrasm91 I've edited my comment. I wanted to show support this feature request, and added that bit as a potential starting point. I wasn't aware this feature was already in progress.

[jrasm91]

That's fine, I don't see any problem with informing you that archive functionality exists today, so not sure why you commented back with "sure, if you only want one folder with no organization."

I think it is clear we will get other options in the future, and archive isn't planned on being the only one.

[fivestones]

Recently my wife gave birth and I took a bunch of photos. Then about 2 weeks later I was telling a friend how great Immich was. He wanted to see it...and I realized I couldn't show him because close to the top of the timeline were all those photos.

I'd love to have the ability to have photos I mark to not show up on the timeline by default, and with some kind of authentication be able to view a timeline of just those photos, and the option to temporarily include them in the main timeline.

[NicholasFlamy]

You can archive a photo while still having it in an album, or multiple. (Maybe this is a newer feature?)

[dumbinacan]

I am here to further express support of this feature. I think most people will be surprised to find that there isn't a way to hide a portion of their photos. I like a lot of the concepts brought up in this thread, but I don't think any that complicated needs to be implemented (I post without looking at the codebase). I think at bare minimum an album that will make any photo in it not appear with the rest of your photos should exist. Something so that you can scroll through photos with other people, and not have to worry about showing something that you don't want. I think being able to make albums that you can mark as hidden would be ideal for organizing your photos, but that is added functionality. I personally think having the ability to remove certain photos from being easily viewed is vital in 2024.

[ragsmaroon]

Hey are we able to close this thread? It's literally on the roadmap already, you don't need to come out in support of the feature and explain to everyone that you don't want your wife to see your ex-girlfriend's nudes. Continuously circlejerking this topic while it's already been slated for development is just insane. Please close it to replies.

[Buco7854]

https://immich.app/roadmap

It's at the top of the roadmap.

[ragsmaroon]

I also have not seen this posted as being on the roadmap anywhere. I’ve only seen threads saying there’s no plan to implement this and to instead use the “Archive” folder. Could you direct me to a thread showing where they have it planned to be implemented?

The thread we're in right now #2451 (reply in thread)

[NicholasFlamy]

https://immich.app/roadmap

It's at the top of the roadmap.

I thought that means it's coming last, after stable.

[Buco7854]

It means that it's the latest thing planned and is coming after immich becomes stable. But it does mean it's planned. I don't really see the issue here🤔.

[NicholasFlamy]

It means that it's the latest thing planned and is coming after immich becomes stable. But it does mean it's planned. I don't really see the issue here🤔.

No issue, just wanted to clarify.

[NicholasFlamy]

If anyone has any useful input, keeping this open allows them to share it. ~~What Marco commented added nothing to the conversation. Marco should have just upvoted the discussion using the up arrow button~~. Edit: I tried to strikethrough this but markdown isn't working?

[dumbinacan]

Curse that one single guy for reading a thread and trying to reply the same way everyone else there was. He and he alone should have known better. Lets all make an example out of him.
SHAME!

For the record, I didn't see anywhere here that it was on a roadmap. Maybe there was somewhere else I could have read that information, but I didn't know. I've been trying to become more active in open source projects, and thought joining conversations like these was a good low stakes way to dip in a toe.

[NicholasFlamy]

I'm sorry I came off that way, your comment simply told your use case without any new suggestions. The point of this discussion is to suggest new ideas and contribute.

[Paulie420]

Just want to chime in here. I'm playing around with putting 'hidden' photos/videos in the Archive section - I think this solves the part of those pictures/videos showing up in the main library, but haven't tested that out much.

I think these features would be well received and are things that I am hoping for;
Archive:

• Archive Albums
• Archive Hidden Photos/Albums

Better yet:
Archive for files you want to ARCHIVE - user can see them easily, but they aren't in the main library. (Add albums within archive...)

Hidden files - Hidden behind a password, completely invisible from library/archive unless user goes there on purpose, with access. Albums to be able to separate out different hidden files.

I really hope these features get on the radar - thanks Immich, the software is AWESOME - but right now I can't let other people into my library... I've also thought about creating another user for 'hidden' files and just migrating those completely out of the main library. Would team Immich chime in on how the dev team sees handling these types of 'wanted to be hidden' files? Another user; how do ya'll see it???

[HWiese1980]

Archiving has downsides, hasn't it? Aside from the fact that it is alienating a feature with a totally different purpose...

Hidden files would be great. Especially when they are locked behind a password or only accessible through ones own profile.

Tagging and the ability to set filters to what is shown on the main page and everywhere where pictures are shown would also work. I could tag certain albums and pictures NSFW and set the filter to hide albums and pictures with the NSFW tag from every public display, while only being able to reach them through my own profile.

[Gremious]

This is very very clunky, but the way I do it for now, is that I just have 2 accounts. It's how I used to do it with google photos as well.

Unforutnatley, uploading from phone on immich is kind of sad right now, you can't select a few individual photos to upload those specifically, and selecting an album to auto-backup retains that setting across accounts, so that's kind of unusable for this purpose (and is maybe a security issue depending on who you ask).

There's also no easy switch between multiple logged in accounts, unlike in GPhotos where you can just swipe your pfp.

But nevertheless, if you have 2 accounts, you can login and upload your safe photos to one, and then login and upload your not-safe photos to the other. Then you have a clean and a dirty timeline and albums you can share. Probably fine to duplicate some photos if you want a particular mixed album until this feature actually comes out.

If you have "containers" in your browser where you can be logged in on both accounts in 2 differnt tabs, and you have your photos synced with your pc/network drive or something, then it a bit less of a hassle to do that.

[Gremious]

You can now.

Edit: As of 1.107.0 Note: the show all and select backup separately was reverted but the manual upload was not.

oh bless, thank you for mentioning

[etique57]

Thanks for the hint! but did you manage to have it work? I'm on 117 both server & app but I can't see "all local assets" as mentionned in the release note.

[NicholasFlamy]

@etique57 I edited my message (only a minute after I sent it) with a note about that feature being reverted. You can read about it in: 1.107.1
(The upload feature still exists, the show all images without selecting them for backup was reverted.)

[etique57]

thanks I totally missed the .1!

[Gremious]

Ok it took me a hot second to figure out, so I'll write the comment
Basically this: #1684 (reply in thread)

You have to disable the auto backup on your phone, and then select e.g. you Recent Images DCIM folder as a backup album
It won't back it up automatically now, but i'll show up on the timeline when you refresh, and you can then select individual image to upload

No auto-clean up like GPhotos, but you can select images and then hit "delete from device"

No multi account support on mobile so you also have to re-log, but still, works nice enough

[bo0tzz]

I think this FR was unintentionally closed; I've reopened it and locked it instead, since there's not much more to add to the discussion.

[bo0tzz]

This is now implemented.

[alextran1502]

@j21w91 ah interesting! Can you help open a GitHub issue so we can track and resolve it?

[MatthewGregoire42]

with the expectation that none of the server-side processing will operate on secure files

That would mean either

1. anything in that folder is useless and unviewable because it hasn't been processed.

2. a whole separate process especially for E2EE folders.

Neither are feasible.

@bo0tzz @NicholasFlamy Thanks for the reply.

And I'm curious, so this server-side processing needs access to the raw data inside an image file in order for users to access the image? If you need image metadata in order to internally track the existence of a file, you could just not encrypt the metadata. And this would still allow things like geotagging/showing up in chronological timelines/etc, although the contents of these images would be hidden unless you provide the encryption key when retrieving images from the server.

[rouke-broersma]

And I'm curious, so this server-side processing needs access to the raw data inside an image file in order for users to access the image? If you need image metadata in order to internally track the existence of a file, you could just not encrypt the metadata. And this would still allow things like geotagging/showing up in chronological timelines/etc, although the contents of these images would be hidden unless you provide the encryption key when retrieving images from the server.

You're basically describing that a separate processing flow would need to be created for e2ee images. Take for example machine learning. If you keep this metadata public you can infer from the metadata what the image is about. Ok so don't include machine learning metadata. What about person recognition? Probably should not include that. Geo data? Well, if someone wants to hide photos behind e2ee, why would they want the location data about that photo to be accessible without the decryption key? Maybe you don't want the server admin to know you were in that location. Metadata about photos is almost immediately and directly content. It must be included if you're using e2ee.

[MatthewGregoire42]

@rouke-broersma I understand what you're saying, but this is not true in all cases, since it entirely depends on how you define your threat model. In any real-world case where immich is deployed, I doubt people care about CIA agents on their network trying to track political dissidents. Immich can afford a significantly more lax threat model: maybe users don't care about whether server admins know when and where a photo was taken, they just want to keep its contents confidential.

You're right that leaking facial recognition and ML metadata would likely be too much. So clearly those can be encrypted, and like I suggested in my first comment, those features would be unavailable for encrypted photos. It's very much not an all-or-nothing thing.

[rouke-broersma]

Which, if you don't actually care that much, you can now do with the locked folder. E2ee is not necessary for your scenario.

The inverse is simply not true. If you're so worried about the server owner having access, or someone else gaining access to your photos that you want e2ee, then you absolutely should care that the metadata is encrypted as well. Any scenario that doesn't require metadata encryption also does not realistically require photo encryption.

Look I would also like more advanced privacy features. I would like multiple locked albums, encrypted albums etc. But it's not simple, so it'll take time. You can't handwave away the complexity.

[NicholasFlamy]

Check out #18470 if you're like me and really want organization for private photos.

[willoma]

This is only a single hidden album, with even less possibilities than the archive.

I have some pics I don't want to show my family, but I need to share them with a doctor. I have made an album that I shared with her, and after upgrading I put these pics out of the archive, then in this private area : they all disappeared from the album where she expects to see the latest photos of my surgery. I had to get them all out of the private area, back in the unprotected archive (so that at least they do not appear in my home page)...

And in the private area, I can't sort pics and show only some of them to some selected people, it's all or nothing.

Clearly, this feature is below expectations...

[rouke-broersma]

I think this is a matter of expectation.

• Locked photos aren't meant to be shareable
• The archive view is for hiding pictures on the timeline, but can still be shared

The two features are there to provide those use cases.

Using an archive feature for sharing feels counter intuitive tbh. I associate archiving with not needing the content anymore while also not having decided that you actually want the content deleted. A step before recycling. I had never thought that you can share from the archive if I hadn't read this.

[willoma]

I think this is a matter of expectation.

Exactly what I was saying. The implemented feature is below mine 🙂

[LogStw]

Using an archive feature for sharing feels counter intuitive tbh. I associate archiving with not needing the content anymore while also not having decided that you actually want the content deleted. A step before recycling. I had never thought that you can share from the archive if I hadn't read this.

Agreed, never would have found this feature if not for this thread. Would be great if there was a "Hide from Timeline" option as opposed to having to archive all the pictures in an album, and having a second copy of the picture in Archive as well as the Album.

I have a lot of pictures of VIN's, Serial numbers, asset ID's, etc that I don't care to see in the timeline, but are important to have. I never would have thought to archive the photos in an album, as that is counter-intuitive to what an album is.

[Gremious]

The archive view is for hiding pictures on the timeline, but can still be shared

Unfortunately, this means that my cool party photos that I am actively interested in (e.g. not "archiving") but definitely want to hide from the timeline in the presence of others, and my old bills, would be mixed together.

If simpler, I would appreciate the feature of having multiple user-made "archives", i.e. sections that hide images from the timeline. That way I can at least categories e.g. bills, medical photos, nsfw photos, etc. and still browse/album/share them.

[ckewok]

This is the single biggest missing piece IMO for my catalog of photos. Instead of creating a locked folder or having an archive, the best way I have seen to handle this is using custom views https://manual.mylio.com/24.3/en/topic/browse-by-category-with-spaces as I discuss in my comment on 18645.

[fivestones]

Just to connect people subscribed here: #18645 is a feature request to let private photos optionally/temporarily be part of the rest of the immich feature set. So by default private photos aren't shown anywhere but there is an option to temporarily have them show up in the timeline, in search, in albums, on the map, etc.