PolicyVersion 2026-09-30
Biometric data policy
Effective
Some laws treat face geometry as biometric data. We handle anything derived from your face as biometric data, even where a law might not require it. This is our public retention and destruction schedule.
The short version
- 01We collect face data only after your written (electronic) consent.
- 02Your photo never leaves your phone: the face photo and the face mesh are processed on the device only.
- 03We keep derived face ratios with your result, and destroy them on the schedule below.
- 04We never sell, lease or trade biometric data, or profit from it.
1What we collect
- Face photo: checked on your phone for light, sharpness, framing and angle. It never leaves your phone; only the check results (pass, warn or fail) are sent.
- Derived face ratios (for example face length to width), computed on your phone and used only to show a face-shape mix as styling information. They are never part of the score and can’t identify you on their own.
- Older results only: checks before 28 September 2026 sent the face photo once, in memory, to a US-based AI model provider for a quality check (never stored) and kept a photo fingerprint (SHA-256 hash) that can’t be turned back into an image. That fingerprint is destroyed with the result on the schedule below.
- We do not create face templates for recognition, and we never identify anyone.
2Why
To check whether your photo works as an agency digital, and to show your face-shape mix as styling information. We don’t use face data for identification, advertising or any other purpose.
3Consent
Before any camera access we explain what we collect and how long we keep it, and ask for your consent with an unticked checkbox that works as an electronic signature. We record the consent with the policy version and a timestamp. Without it, no face photo is taken.
4Who receives it
No one receives your face photo: it never leaves your phone. No AI service receives face data of any kind; the AI that writes result explanations (DeepSeek) receives reason codes and bucketed values only. Our hosting and database providers store derived ratios on our behalf. We disclose biometric data to no one else unless you consent or the law requires it.
5Retention and destruction schedule
| Data | Where | Destroyed |
|---|---|---|
| Face photo | Stays on your phone. Photo quality is checked on the device. | Never leaves your device. |
| Full-body photo | Stays on your phone. Pose is measured on the device. | Never leaves your device. |
| Face mesh (478 points) and body landmarks (33 points) | Your device only | Never sent, stored or logged. |
| Derived face ratios and body proportion ranges | Our database, with your result | Anonymous: 30 days. With an account: while it's active, deleted 12 months after your last sign-in, or when you delete it. |
In every case, biometric data is destroyed when the purpose for collecting it is satisfied, and no later than 12 months after your last interaction with us, well inside the 3-year limit some laws set. You can have it destroyed sooner at any time with “Delete everything now” on our privacy page.
6Security
We protect biometric data with at least the care we use for our other confidential data: encrypted in transit and limited access.