PolicyVersion 2026-09-26
Biometric data policy
Effective
Some laws treat face geometry as biometric data. We handle anything derived from your face as biometric data, even where a law might not require it. This is our public retention and destruction schedule.
The short version
- 01We collect face data only after your written (electronic) consent.
- 02The face photo is processed in memory and never stored; the face mesh never leaves your phone.
- 03We keep derived face ratios with your result, and destroy them on the schedule below.
- 04We never sell, lease or trade biometric data, or profit from it.
1What we collect
- Face photo: re-encoded on your phone and sent once for a photo-quality check. Held in memory, never written to disk or storage.
- Derived face ratios (for example face length to width), computed on your phone and used only to show a face-shape mix as styling information. They are never part of the score and can’t identify you on their own.
- A photo fingerprint (SHA-256 hash) so the same photo gives the same result. It can’t be turned back into an image.
- We do not create face templates for recognition, and we never identify anyone.
2Why
To check whether your photo works as an agency digital, and to show your face-shape mix as styling information. We don’t use face data for identification, advertising or any other purpose.
3Consent
Before any camera access we explain what we collect and how long we keep it, and ask for your consent with an unticked checkbox that works as an electronic signature. We record the consent with the policy version and a timestamp. Without it, no face photo is taken.
4Who receives it
Anthropic receives the face photo in memory for the quality check and deletes images after processing. Our hosting and database providers store derived ratios on our behalf. We disclose biometric data to no one else unless you consent or the law requires it.
5Retention and destruction schedule
| Data | Where | Destroyed |
|---|---|---|
| Face photo | Re-encoded on your phone (no location data), sent to our server and to Anthropic in memory for a quality check | Never written to disk or storage. Dropped right after the check; Anthropic deletes images after processing. |
| Full-body photo | Stays on your phone. Pose is measured on the device. | Never leaves your device. |
| Face mesh (478 points) and body landmarks (33 points) | Your device only | Never sent, stored or logged. |
| Derived face ratios and body proportion ranges | Our database, with your result | Anonymous: 30 days. With an account: while it's active, deleted 12 months after your last sign-in, or when you delete it. |
In every case, biometric data is destroyed when the purpose for collecting it is satisfied, and no later than 12 months after your last interaction with us, well inside the 3-year limit some laws set. You can have it destroyed sooner at any time with “Delete everything now” on our privacy page.
6Security
We protect biometric data with at least the care we use for our other confidential data: encrypted in transit and limited access.