Privacy

Face landmark detection, hair segmentation, the geometry measurements and the recommendation scoring all run in this tab, inside a Web Worker. Camera frames exist in memory for as long as it takes to measure them and are then discarded.

There is no photo upload endpoint on our API. This is a deliberate architectural choice rather than a policy promise: there is nothing on the server for a photo to be sent to.

Anonymous product events, if you allow them: which face-shape bucket was produced, which styles were opened, and which capture-rejection codes were hit. Nothing that identifies you, and none of your measurements.

The server enforces an allow-list on both event names and property keys, so even a bug in the browser code cannot send landmarks or measurements through.

The on-device vision runtime is Google MediaPipe. Google states that image and video inputs are processed on-device and are not sent to Google servers, and also that MediaPipe Tasks sends API performance and utilisation metrics to Google.

That is why we say your photos are not uploaded to our servers for analysis, and not “no data ever leaves your device” — the second claim would conflict with MediaPipe’s own privacy notice.

• No face embeddings and no face recognition.
• No identity matching.
• No age, gender or ethnicity inference.
• No hair-health, scalp or medical inference.

This is a grooming recommendation product, not an identity system.

The anonymous session handle is random, stored in this tab’s sessionStorage, and gone when the tab closes. Derived analysis results are kept there too, so a reload does not throw your work away; your photos are never written to storage.

The API exposes a session erasure endpoint which removes every server-side row tied to that anonymous handle.

This release is intended for adults.