Privacy

The short version

• Camera frames and photos are processed in your browser and never leave your device.
• The landmarks and measurements are kept in this browser tab only, and are gone when you close it. The snapshot of each angle is held in memory and never written to storage at all.
• Our server is involved only if you buy the Full Face Report: it creates a Stripe checkout and later asks Stripe whether it was paid. Nothing about your face is part of either step.
• No advertising trackers, no cookies.

What happens during a scan

1. Before the camera. You confirm you are 18 or older and, if you like, choose how to be rated (as a man, as a woman or no preference). The camera is not opened until you press Start.
2. The camera. Your browser asks for permission. The video is shown only on your screen. It is not recorded and not streamed anywhere. The camera is switched off when the scan finishes, when you leave the page and when you navigate to another page.
3. Each frame. Google’s MediaPipe Face Landmarker, an open-source model, runs inside your browser as WebAssembly. For each video frame it returns 478 landmark points, the angle of your head and a set of expression values (used only to ask you to relax your face). The frame itself is then discarded. The model and its WebAssembly files are downloaded from our own website the first time; they are program files and contain nothing about you.
4. The five captures. When your head holds still at each angle, the scan keeps the landmarks from 8 consecutive frames and one snapshot image, scaled down to at most 720 pixels. The snapshots stay in the tab’s memory so the report can show the five angles. They are never written to storage and disappear when you close or reload the tab.
5. The analysis. The frames are combined and measured, and the score is calculated, on your device, in under a second.

If you upload a photo instead of using the camera, your browser opens it locally and measures it the same way. The photo is never uploaded.

At no point is a frame, a photo, a landmark or a measurement sent over the internet. Our pages carry a Content Security Policy that tells your browser to block the page from connecting to any other website, so the code could not send them elsewhere even by mistake. You can check this yourself: open your browser’s developer tools, go to the Network tab and run a scan. You will see the page download the model files, and no upload.

What is stored on your device

We use your browser’s own storage, not cookies, for two things:

• Your latest scan, in session storage: the landmark coordinates (numbers, not images), the head angles, the time of each capture, your rating preference and the measurements calculated from them. This lets every tool and the report use the same scan without scanning again. Browsers delete session storage when you close the tab.
• Proof of purchase, in local storage (key faceform:paid): the Stripe checkout session ID and the time it was confirmed, so the report stays unlocked on this browser for 24 hours. After that we ignore it and remove it.

You can clear both at any time by clearing this site’s data in your browser settings.

Payments

If you buy the Full Face Report, you pay on a checkout page run by Stripe, our payment provider. Stripe collects your payment details and an email address for the receipt, and processes them under Stripe’s privacy policy. We can see the payment, its amount, the email address and the country in our Stripe account, which we need for accounting and refunds. We never see your full card number.

When Stripe sends you back, your browser sends our server the checkout session ID, and our server asks Stripe whether that session was paid. The answer is yes or no. The report is then built on your device from the scan already in your browser tab.

Server logs and hosting

Our website is hosted on Vercel. Like any web host, Vercel keeps short-lived technical logs of requests to the site (such as IP address, browser type and the page requested) for security and reliability. These logs contain no images or measurements, because those are never sent.

Analytics

Faceform currently runs no analytics. If we turn on privacy-friendly analytics, it will count page visits and steps such as “a scan finished”, never measurements or anything about your face, and we will update this page first.

Biometric data

Measurements of a face can count as biometric data under laws such as the EU and UK GDPR and the Swiss Federal Act on Data Protection. Because frames, landmarks and measurements are processed only on your device and never reach us, we do not collect, store or receive biometric data about you.

Scanning other people

Only scan yourself, or someone who has agreed to it and is 18 or older. Everything stays on your device, but it is still their face.

Children

Faceform is for adults. You confirm you are 18 or older before the camera opens and again before checkout.

Your rights and contact

Faceform is operated by [operator name and address, to be added before launch]. For any privacy question, or to ask about the payment records we hold (such as access, correction or deletion where the law allows), email hello@faceform.app. You also have the right to complain to your data protection authority.

See also our terms.