Privacy

[TODO before launch: this page describes what the software does and has not yet been reviewed by a lawyer. Photographs of faces are regulated differently from one country to the next, and the wording below, the retention periods and the analytics settings all have to be confirmed in that review. Keep every statement here true of the deployment it is served from.]

Your photo

A photo you upload is resized in your browser, sent once to our server, held in the memory of the single request that analyses it, and passed to the vision provider that writes the report. It is not written to disk, to object storage or to logs, it is not used to train anything, and it is not shown to anyone.

No face is matched against any database, no face template or biometric identifier is computed or kept, and nothing about your identity, age, health or origin is inferred or recorded. The analysis describes proportions visible in the picture and nothing else.

The report

The written report is text. It is stored only on a deployment with storage enabled, under a link that cannot be guessed, so that you can come back to it. An unpaid report is deleted after 72 hours; an unlocked one is kept for up to a year and then deleted. The report page is marked as not to be indexed, and the same instruction is sent in the HTTP headers, so search engines do not list it.

Deleting a report earlier than that: write to the contact address below with the link, and it is removed.

Payments

Payments are processed by Polar, who act as merchant of record. We receive a confirmation that a purchase happened and the number of analyses it bought. We never see or store card details. Analyses you have bought are held against an anonymous purchase id — there is no account and no profile attached to it.

Analytics

Product events are counted — a landing page seen, an upload started, an analysis finished or failed, a checkout opened — through PostHog on EU infrastructure. No image, no report text, no file name, no email address and no IP-based person profile is sent with them. The events carry a random per-session identifier that is not tied to you and is discarded when the tab closes.

Rate limiting

To stop abuse, a one-way hash of your IP address is kept for at most one day and counted against a per-minute and a per-day limit. The address itself is never stored in readable form.

Children

This is a styling tool for adults. Do not upload a photo of a child, and do not upload a photo of another adult without their agreement.

Contact

Face Shape Detector · hello@face-shape-detector.com