Zero-Knowledge Architecture & Algorithmic Specification

How PopiScan Works: In-Browser Privacy & Mathematics

A comprehensive guide explaining how PopiScan processes photos entirely inside your device's browser sandbox, the computer vision algorithms powering face detection and consent matching, and why zero biometric data ever leaves your computer.

💡 The TL;DR 🔒 Browser Sandbox & Privacy 📐 Algorithm 1: Viola-Jones & Haar Math 🧠 Algorithm 2: Biometric Embeddings 🎨 Algorithm 3: Canvas Redaction Math ⚖️ PopiScan vs Cloud AI 🇿🇦 Legal Grounding (POPIA Act 4) 🔍 How to Audit Yourself

💡 The TL;DR — High-Level Plain English Explanation

PopiScan is not a website that uploads your photos. It is an offline-capable software program delivered directly into your browser tab. When you drop photos into PopiScan, your images never travel across the internet, touch a server, or enter an external database. Your computer’s own processor performs 100% of the face detection, consent checks, and image redactions inside your browser's private working memory (RAM).

Step 1

Photos Read into RAM

Files are read into local volatile memory via HTML5 File APIs. No network requests are made.

Step 2

On-Device Vision

Client-side computer vision models locate face bounding boxes directly on hidden graphics canvases.

Step 3

Local Roster Check

Faces are checked against your consent registry stored strictly in your browser's isolated local storage.

Step 4

Instant Redaction

Restricted individuals are blurred, masked, or pixelated in memory before you download the safe file.

💻

Local Device (RAM)

Photos loaded via drag & drop into memory

➔

🎨

Hidden Canvas

Rasterization into raw RGBA pixel arrays

➔

📐

Haar-Cascade Vision

O(1) Integral Image contrast classification

➔

👥

Local Storage Registry

POPIA Section 35 consent cross-referencing

➔

🛡️

Sanitized Export

Permanent pixel overwrite & local download

✈️ The Airplane Mode Proof

You can test this right now: open PopiScan, turn on Airplane Mode or disconnect your Wi-Fi, and drag an album of 50 photos into the scanner. PopiScan will detect faces, identify consent conflicts, and generate blurred/pixelated downloads with zero internet connectivity.

🔒 How PopiScan Stays 100% In-Browser: The Sandbox Architecture

Modern web browsers enforce strict security boundaries known as the Web Application Sandbox. PopiScan leverages this architecture to create an ironclad privacy perimeter around your media files:

Volatile Memory Execution (RAM Only): When photos are dropped onto the interface, they are parsed via the browser's native FileReader.readAsDataURL() and URL.createObjectURL() interfaces. The binary data is held temporarily in browser memory and is freed via JavaScript garbage collection as soon as the tab is closed or cleared. No temporary files are written to server hard drives.
Origin-Isolated Storage (Zero Cloud DB): Your POPIA Consent Registry (the names, legal statuses, and IDs of students, staff, or attendees) resides exclusively inside the browser's window.localStorage partition. This storage is keyed to your origin (popiscan.co.za) on your physical machine. We do not have a user account system, a remote SQL database, or an administrative backend.
Zero Egress Network Boundary: The PopiScan web server is an ultra-lean Alpine Nginx static server whose only function is serving pre-compiled HTML, CSS, and JS files on initial page load. Once loaded into your browser, PopiScan initiates 0 HTTP POST, PUT, or WebSocket connections. There are no analytics trackers, no advertising beacons, and no telemetry pings.

📐 Algorithm 1: Viola-Jones Detection & The Integral Image Transform

Real-time face detection on high-resolution event photographs (e.g., 24-megapixel DSLR shots) would grind an average laptop or phone to a halt if evaluated pixel-by-pixel. PopiScan solves this using an optimized client-side implementation of the Viola-Jones Object Detection Framework with Haar-like Cascade Classifiers (via tracking.js).

Here is the exact mathematics enabling this pipeline to process millions of pixels in milliseconds:

Mathematical Concept #1 — Summed-Area Table (Integral Image)

II(x, y) = ∑_{x' ≤ x, y' ≤ y} I(x', y')

The Problem: Evaluating whether a region contains facial features requires summing the brightness of hundreds of thousands of rectangular pixel sub-windows.
The Solution: In a single pre-processing pass, PopiScan converts the canvas image into an Integral Image $II(x,y)$, where each coordinate stores the sum of all pixels above and to the left of $(x,y)$.

Using the recurrence relations below, the Integral Image is constructed in a single linear $O(N)$ sweep across the image buffer:

Single-Pass Recurrence Relations

s(x, y) = s(x, y - 1) + I(x, y)

II(x, y) = II(x - 1, y) + s(x, y)

Where $s(x,y)$ is the cumulative row sum, with initial condition $s(x, -1) = 0$ and $II(-1, y) = 0$.

Mathematical Concept #2 — O(1) Constant-Time Rectangular Area Lookup

AreaSum(R) = II(D) - II(B) - II(C) + II(A)

Given any arbitrary rectangle $R$ defined by corners $A(x_1, y_1)$, $B(x_2, y_1)$, $C(x_1, y_2)$, and $D(x_2, y_2)$, the total sum of all pixel values inside $R$ is computed with exactly 4 memory lookups and 3 arithmetic operations. This achieves true $O(1)$ constant time complexity, completely independent of whether the face is 20 pixels or 2,000 pixels wide.

Haar-Like Contrast Features:

Human faces share universal biological lighting signatures: the bridge of the nose is consistently brighter than the flanking eye sockets, and the upper forehead is brighter than the brow ridge. PopiScan applies rectangular Haar wavelet filters:

Two-Rectangle Filters: Measures the differential contrast $f = \sum_{\text{dark}} I - \sum_{\text{light}} I$ between horizontally or vertically adjacent bands.
Three-Rectangle Filters: Computes the difference between a central strip and two surrounding regions (ideal for the nose bridge and eye line).
Four-Rectangle Diagonal Filters: Evaluates diagonal shear transitions across cheekbones and jaw contours.

Mathematical Concept #3 — AdaBoost Classifier & Attentional Cascade

H(x) = \text{sign}\left(\sum_{t=1}^T \alpha_t h_t(x) - \theta\right), \quad \text{where } \alpha_t = \frac{1}{2} \ln\left(\frac{1 - \epsilon_t}{\epsilon_t}\right)

In a typical $24 \times 24$ pixel sub-window, there are over 160,000 possible Haar feature combinations. The AdaBoost algorithm selects a compact sequence of the most discriminative "weak learners" $h_t(x)$ with optimal weights $\alpha_t$ based on training error $\epsilon_t$.

These classifiers are structured as a degenerate decision tree cascade: Stage 1 uses just 2 Haar features to reject ~50% of non-face background windows in sub-microsecond time. Over 99% of background candidates are rejected within the first 3 stages, dedicating CPU power only to genuine face candidates.

🧠 Algorithm 2: Biometric Vector Embeddings & Hypersphere Metric Learning

For advanced identity matching across the consent roster, PopiScan's codebase stages deep convolutional feature extractors (via face-api.js MobileNet / ResNet-34 backbones running via WebGL/WebAssembly).

Rather than storing sensitive facial photos, modern neural architectures convert facial geometry into a compact mathematical point in a high-dimensional vector space:

Mathematical Concept #4 — 128-Dimensional Unit Hypersphere Projection

f: \mathbb{R}^{W \times H \times 3} \longrightarrow \mathbb{R}^{128}, \quad \text{subject to } \|f(x)\|_2 = \sqrt{\sum_{i=1}^{128} f_i(x)^2} = 1

The neural network maps an aligned face image into a 128-dimensional Euclidean feature vector constrained to the surface of a unit hypersphere $\mathbb{S}^{127}$. In this latent space, distances correspond directly to identity similarity, regardless of lighting, pose, or expression.

The feature extractor is trained using the Triplet Margin Loss function, which enforces that biometric vectors of the same individual cluster tightly together while pushing different individuals far apart:

Mathematical Concept #5 — Triplet Margin Loss Formulation

\mathcal{L}(A, P, N) = \max\left(0, \; \|f(A) - f(P)\|_2^2 - \|f(A) - f(N)\|_2^2 + \alpha\right)

Where $A$ is an Anchor face, $P$ is a Positive face (same person), $N$ is a Negative face (different person), and $\alpha$ is the minimum enforced safety margin.

Identity Verification via Metric Distances:

When matching detected faces against the local consent roster, PopiScan compares the extracted vector $\mathbf{u}$ against enrolled vectors $\mathbf{v}$ using Euclidean Distance and Cosine Similarity:

Euclidean L2 Distance & Cosine Metric

d(\mathbf{u}, \mathbf{v}) = \sqrt{\sum_{i=1}^{128} (u_i - v_i)^2} \quad \text{and} \quad \text{sim}(\mathbf{u}, \mathbf{v}) = \frac{\mathbf{u} \cdot \mathbf{v}}{\|\mathbf{u}\|_2 \|\mathbf{v}\|_2} = \cos(\theta)

For normalized vectors on the unit hypersphere, Euclidean distance and Cosine similarity are mathematically equivalent: $d(\mathbf{u}, \mathbf{v})^2 = 2 - 2\cos(\theta)$. A threshold cutoff of $d < 0.6$ establishes a statistically confident match.

🎨 Algorithm 3: Canvas Redaction Mathematics & Irreversible Anonymization

When a subject is flagged as RESTRICTED (e.g. parental consent withheld under POPIA Section 35), PopiScan allows one-click privacy sanitization directly onto the HTML5 Canvas before exporting. The math behind each redaction mode ensures irreversible anonymization:

1. Gaussian Spatial Blur (Frequency Low-Pass Convolution)

I_{\text{blur}}(x, y) = \iint I(x - u, y - v) \cdot \frac{1}{2\pi \sigma^2} e^{-\frac{u^2 + v^2}{2\sigma^2}} \, du \, dv

In the frequency domain via Fourier Transform, $\mathcal{F}\{I_{\text{blur}}\} = \mathcal{F}\{I\} \cdot \mathcal{F}\{G\}$. Applying a 16px Gaussian kernel acts as an aggressive low-pass filter that eradicates high spatial frequencies. Biometric edge features, iris geometry, and contour gradients are mathematically destroyed, preventing neural feature extractors from identifying the subject.

2. Spatial Downsampling & Mosaic (Pixelation)

\bar{C}_{\text{cell}} = \frac{1}{B^2} \sum_{u=0}^{B-1} \sum_{v=0}^{B-1} C(x_0 + u, y_0 + v)

The face bounding box is subdivided into discrete spatial grids of size $B = \max(8, \lfloor W_{\text{face}} / 10 \rfloor)$. Every pixel within each cell is replaced by the arithmetic mean color $\bar{C}_{\text{cell}}$. This drops the spatial resolution well below the Nyquist-Shannon sampling limit required for facial recognition.

3. Cryptographic Pixel Overwrite (Opaque Black Mask)

\text{PixelBuffer}[4(y \cdot W + x) + c] \longleftarrow \text{RGBA}(10, 12, 16, 255)

PopiScan uses ctx.fillRect() to directly overwrite the underlying Uint8ClampedArray memory buffer. The original pixel data is completely destroyed in RAM before the sanitized image is compiled via canvas.toDataURL('image/jpeg', 0.92). Because the original bytes no longer exist in the exported file, no algorithmic "unblurring" tool or inverse neural network can ever recover the redacted face.

⚖️ Architectural Comparison: PopiScan vs. Cloud-Based Vision APIs

The table below contrasts PopiScan's browser-first model against conventional cloud-hosted artificial intelligence services (such as AWS Rekognition, Google Cloud Vision, or Azure Face API):

Compliance & Security Vector	PopiScan (Client-Side)	Cloud AI APIs (AWS / Google / Azure)
Photo Ingestion & Egress	Zero Upload — Stays in local RAM	Full Ingestion — Photos uploaded over WAN
Server-Side Storage Risk	0 Bytes — No database or storage bucket	High — Images cached in cloud object storage
POPIA Section 19 Breach Exposure	Zero Attack Surface — Nothing to breach	Severe — Centralized cloud honeypot vulnerability
POPIA Section 35 (Child Biometrics)	Protected — Minors' photos never leave custody	High Risk — Third-party processing of special data
POPIA Section 72 (Cross-Border Transfer)	100% Domestic — Executes on user's device	Non-Compliant unless strict adequacy agreements exist
Offline Capability	Full Offline — Works in Airplane Mode	None — Requires active high-speed internet
Cost & Metering	100% Free & Open Source (GPLv3)	Per-Image API Billing ($1.00 – $2.50 per 1,000 scans)

🇿🇦 Legal Grounding Under POPIA (Act 4 of 2013)

PopiScan was specifically engineered to address the statutory obligations imposed upon schools, religious institutions, athletic clubs, and corporate event organizers under South African privacy law:

Section 19 (Security Measures on Integrity and Confidentiality): Responsible Parties are legally obligated to secure personal information against unlawful access, destruction, or disclosure. By processing photos strictly on the user's hardware without intermediate cloud relays, PopiScan completely removes the risk of cloud database leaks, employee credential theft, or S3 bucket exposure.
Section 35 (Prohibition on Processing Personal Information of Children): Section 35 strictly forbids the processing of personal and biometric information concerning a minor child unless carried out with the prior consent of a competent person (parent or legal guardian). PopiScan enables administrators to identify and sanitize opted-out children before event albums are published, without ever exposing those children's photos to third-party cloud infrastructure.
Section 72 (Transborder Information Flows): Transferring biometric data outside the Republic of South Africa requires satisfying stringent statutory conditions (such as binding agreements or foreign privacy adequacy). PopiScan performs 100% of calculations within your local machine, completely eliminating cross-border data transfer liabilities.

🔍 How to Verify PopiScan's Privacy Guarantee Yourself

You do not need to take our word for it. PopiScan is designed to be fully verifiable by any privacy officer, IT administrator, or security auditor in under 60 seconds:

Open Browser Developer Tools: Press F12 (or Ctrl + Shift + I on Windows/Linux, Cmd + Option + I on Mac).
Switch to the Network Tab: Click on the Network tab in Developer Tools and filter by Fetch/XHR.
Process a Batch of Photos: Drag a batch of high-resolution images into PopiScan and watch the scanner analyze faces.
Inspect Outbound Traffic: Observe that zero HTTP requests are dispatched. The network activity monitor remains completely blank.
Review the Source Code: Inspect the open-source client codebase on GitHub. Every line of code running in your browser is licensed under GPLv3.

← Back to Batch Scanner ⚖️ Read Legal & Liability Disclaimer