The Mediathek data model Diagram

Identity

A photo or film is its SHA-256: the same id everywhere
People, pets, places and events are minted ids
Names are labels; merging keeps the old id pointing on

Who may read

A vault's group reads its assets, albums and A-Box
The household's group (admins) curates its vaults
Operators run the platform, they read no content

What stays on the PC

Face and pet fingerprints and crops
Where the files came from (sources and keys)
The cloud gets boxes and ids, never fingerprints