Posting #selfies to social media may seem like harmless fun (especially if you’re not one of the millions of Americans who consider the pursed-lips “duck face” pose for your profile photos), but new documents reveal that, while you were trying to share your weekend activities with friends and followers, the NSA might have been collecting your social media self-portraits.

The documents, part of Edward Snowden’s stash, show that the NSA is intercepting millions of photos per day and matching them up to individual users in order to create a massive facial recognition database in case they ever need to identify you.

The National Security Agency intercepts “millions of images per day” for use in a previously undisclosed facial recognition database, James Risen and Laura Poitras report in The New York Times, citing documents leaked by former NSA contractor Edward Snowden.

In addition to using faces to track and identify targets, one top-secret PowerPoint presentation released by the Times showed efforts to use other information unique to individuals, including iris scans, fingerprints, voices, and manner of walking.

It is unclear, according to the NYT, whether any Americans’ photos were collected. According to the legal rubric in place for NSA surveillance, the NSA must obtain a warrant before collecting any images of American citizens. Of course, given what we know about how the NSA operates within the legal rubric, there’s significant concern, particularly considering this report from the Guardian in February, which detailed how the NSA’s British counterpart, GCHQ, used images collected off webcams.

Whether individual privacy is implicated depends on where the NSA is getting the images, of course. We already know that the NSA has agreements with various social networks and Internet application providers to turn over sets of information, and that could include photos posted to those networks, which should remind you to read those terms of service next time.