Privacy and biometric notice

What actually happens to your photo

This is every step in the free tools and the written-report purchase. Neither sends the analysis photo over the network. The optional visual has a different, clearly labelled path described below.

1. 1You choose a photo or open the camera.The file is read by your browser. No network request carries it.
2. 2It is drawn onto a canvas in the page.Large images are scaled down here, on your device, to keep the measurement fast.
3. 3A face landmark model runs on your device.The model file is served from this site and executes as WebAssembly inside your tab. It places 478 points on the face and returns coordinates.
4. 4The numbers are computed from those coordinates.Ratios, angles and differences. Arithmetic, in the page.
5. 5When you close the tab, all of it is gone.Nothing derived from your face was written to a server, and none of it is kept in your browser either, with one exception: press a buy button and the photo waits in this tab's session storage, so coming back from the payment page puts you back on your result. It is deleted when you come back, when your report opens, or when the tab closes.

You can check this yourself rather than taking our word for it, and it is worth doing precisely rather than loosely. Open your browser's developer tools, switch to the network tab, and run a measurement. Sort by size and look at every request that leaves after you choose a photo. You will see the model and WebAssembly files download once, and the analytics calls described above, which fire on every page of this site and carry nothing from the measurement. What you will not see is any request carrying your photo or the coordinates, which is the check that matters: an upload can hide as a few kilobytes of coordinates just as easily as as a few hundred kilobytes of image. The site also sends a Content-Security-Policy that names every host this page is permitted to talk to, so you can read that list in the response headers rather than taking this paragraph's word for it.

Biometric notice

Measuring a face from a photo can constitute processing biometric information under several laws, including the Illinois Biometric Information Privacy Act (BIPA), Washington's My Health My Data Act (MHMDA), and the GDPR's rules on special category data. Those laws are written around collection, storage, sharing and retention. This is our notice against each of them.

Collected

Free tools:No photo and nothing derived from it: that is processed in your browser and is not transmitted, unless you ask for the one free try-on, which sends that photo for content screening and image generation when you press its button. Ordinary web analytics about the visit itself, described above, is collected by four third parties.

If you buy a report:The measurement numbers, which your browser sends when you click buy. If you separately request the optional hairstyle visual, the new portrait you choose is sent for content screening and image generation after your explicit agreement.

Stored

Free tools:Nothing about you. There is no database record of you, and no biometric identifier or template is saved anywhere. A daily count of how many measurements happened is kept, with nothing attached to it. If you made the free try-on: the generated image, its task id, the random device id this site keeps in your browser and a one-way hash of your IP address, so each device and network gets one.

If you buy a report:Those numbers, in one row, for 30 days. We do not store the source portrait, landmarks, or face outline. The image service temporarily holds the opted-in portrait under its own retention rules while generating the visual.

Shared or sold

Free tools:Nothing is sold. No biometric data is shared with anyone, because none leaves your device unless you make the free try-on, which sends that photo to our screening and image-generation providers. Analytics about the visit is by definition shared with the four analytics companies named above, and the footer badge tells a fifth that a page was open.

If you buy a report:Nothing is sold. Stripe processes payment, and our screening and image-generation providers receive a portrait only when you explicitly request the optional visual; each handles its own service processing. We never write down the source portrait.

Retention period

Free tools:None, because nothing is retained. The data exists in your tab's memory and ends when you close it. The free try-on's image and its row: 30 days, then deleted automatically.

If you buy a report:30 days, or the moment you delete it below, whichever comes first.

Purpose

Free tools:Showing you measurements of your own face for styling and curiosity.

If you buy a report:Rebuilding your report when you open its link again, and—only with a separate opt-in—creating the requested hairstyle visual.

Automated decisions

Free tools:None that affect you. Nothing here feeds a decision about employment, credit, insurance or access.

If you buy a report:The same. A report is a description of measurements, not a decision about you.

This site is for adults only. Before any measurement runs you tick a box confirming you are 18 or older and agree to on-device analysis. That checkbox is the consent record, and it is checked again at the moment analysis starts rather than only when a button was pressed, so unticking it mid-flight stops the run.

If you buy a report

A report is assembled from the numbers your browser already worked out. To pay for one and to be able to open it again afterwards, those numbers have to exist somewhere other than a tab you might close. So they are stored, and this is exactly what that means.

• Your photo still never leaves your browser for the written report; the optional visual does, only with a separate choice.Buying sends measurements only. On the report page, you may choose a new portrait and tick a clear consent box to send it to a third-party AI image service for six hairstyle visuals. It is not automatic, and declining changes nothing about the written report.
• A third-party AI image service temporarily processes an opted-in portrait.We first pass the image through an automated content screen, then forward it to the image service's upload and generation endpoint, and keep only an opaque task identifier so your paid report can retrieve its result. We do not save the source portrait. That service's temporary-file retention and processing rules apply to its copy.
• Neither do the 478 landmarks, or any outline of your face.A contour of a face is close enough to a biometric template that we will not hold one. The cost of that is honest: a report opened on a different device shows every number and every piece of advice, but not the drawings done on your own face. Re-measuring the same photo brings those back, in your browser, in a second.
• What is stored is about 1.4 kilobytes of numbers.Ratios, angles, percentiles and the measurement floors that go with them, the figures the free tools already showed you on screen, plus the average colour of your cheeks as three numbers, which your colour palette is worked out from. Never a pixel of the photo.
• There is still no account and no password.Your report is reached by a link, and the link is the only thing that opens it. We store a one-way hash of it rather than the link itself, so a copy of our database would not let anyone open anybody's report.
• Stripe handles the payment and your email address.They collect it to send your receipt, and they are the record of the sale. We do not store it. Our server sees it in the moment it checks that a payment succeeded, and writes nothing.
• The feedback box is the one thing here that sends what you wrote.If you use it, we store the message, which of the four kinds you picked, the page you were on and the address you leave, if you leave one. The address is there so we can reply and is not used for anything else. Nothing from the measurement goes with it: not the photo, not the numbers, not a session identifier. Write to the address on the contact page and we will delete a message you sent.

Optional hairstyle visual

It is an opt-in image-to-image generation feature, not part of the free scanner. When you choose a photo on your paid report, the browser sends it to our server, which first has it checked by an automated content-screening service and then forwards it to a third-party AI image service using a server-held key. The key is never exposed to your browser, and MeasureFace does not retain the source photo. We retain the task identifier alongside your report for no longer than the report period so the result can be opened. Generated-image links and the image service's temporary source file have their own availability periods; save any result you want to keep.

The one free try-on, before any purchase. Under your result you can press a button to send the photo you just measured for one hairstyle image, through the same content screen and image service. The notice above the button says what it sends; nothing is sent until you press it. We keep the generated image, its task identifier, the random device id this site already keeps in your browser and a one-way hash of your IP address for 30 days, then delete them automatically. The device id and the hash exist only so each device and network gets one free image; we do not store your photo or your measurements for it.

Content screening. Before an image is generated, the photo is checked for nudity and sexual content by a third-party automated screening service. It receives a copy only for that check, and we ask for that copy to be deleted as soon as the check is done. The generated image goes through the same check before it is shown to you. A photo that does not pass is not used, and nothing you paid for is used up.

Acceptable use and content safety

Deleting your data

If you have only used the free tools, close the tab. That is the whole procedure and it is complete: a deletion request is a request that somebody erase a copy they hold, and no copy is ever made outside the tab you are looking at. There is no account to close, no export to request and no record to correct.

If you bought a report, there is one row, and you can remove it yourself right now. You do not have to email anybody, wait for a reply, or prove who you are, because the link is the proof.

If you want to ask anyway. Privacy questions go to the contact page, which is read by the person who runs this site. You will get an answer even when the answer is that there is nothing of yours here to delete.

The one thing we count

We keep a table of funnel steps: the page was opened, an entry control came into view, a photo was chosen, a measurement finished, the price was on screen, a purchase started, a purchase completed, one of the report's instructions was copied, and a few more of that shape. This list must match FUNNEL_EVENTS in src/funnelEvents.ts exactly, because it is generated from that same list rather than retyped here:

landing_view, heartbeat, measured, measured_own, gap_named, report_sample_opened, price_seen, paywall_shown, checkout_start, unlock_clicked, paid, report_email_submitted, action_copied, entry_seen, consent_checked, entry_upload, entry_camera, entry_sample, photo_selected, measure_error, cta_price_seen, cta_clicked, locked_preview_tapped, first_step_revealed, retake, new_photo_clicked, landing_from, locked_section_tapped, tryon_requested, tryon_ready, tryon_failed, fixplan_preview_seen, photo_average_seen, score_tab_seen, tryon_preview_seen, tryon_preview_started, tryon_preview_ready, tryon_preview_failed, tryon_ready_nudge_shown, tryon_ready_nudge_clicked

Each row carries: an anonymous id (a random value generated in your browser and stored in localStorage — it is not tied to your name, email or any account, but it is a persistent identifier for that browser, so it is not accurate to call it no identifier at all; a row also carries a build id and release cohort id for the code that served it, dwell time in seconds, and the server's clock, to the millisecond. What it does not carry: your name, email, IP address, or anything derived from your face.

Two more fields, derived client-side and validated (not trusted) by the server: source — one of gads, chatgpt, other_utm, search, referral, direct — your first-touch channel, worked out from the URL and referrer the moment you arrive. A Google Ads click is detected by the presence of a gclid/gbraid/wbraid parameter or utm_source=gads; only whether that parameter is present is recorded, never its value, and the value is never stored or sent anywhere by this site. And page_kind — home, tool, content — which kind of page the event happened on. A value we do not recognise (an older build, a tampered value) is stored as "unknown" rather than rejected.

One more field, detail, set only on these events and only to one of the listed values: landing_view (navigate, reload, back_forward, prerender); landing_from (none, self_home, self_page, search, ai, other); measure_error (no_face, multiple_faces, unreadable, not_frontal, not_frontal_yaw_near, not_frontal_yaw_far, not_frontal_pitch_near, not_frontal_pitch_far, not_frontal_roll_near, not_frontal_roll_far, not_upright, out_of_frame, unstable, skewed, bad_geometry, model_failed, model_init, model_detect, too_small, other); cta_price_seen (proportions, frames, bar, first_step, fixplan, tryon_more, photo_offer); cta_clicked (proportions, frames, bar, first_step, fixplan, tryon_more, photo_offer); first_step_revealed (lw, jaw, thirds, spacing); locked_preview_tapped (hairstyle, stylist, first_step, metric, frames, hair_tip, shape_match, tryon); retake (shape_same, shape_changed); new_photo_clicked (header, dock, inline, attractiveness); locked_section_tapped (first, say, shape, proportions, symmetry, eyes, refusals); report_sample_opened (paywall, excerpt); tryon_failed (create, generate); tryon_preview_failed (used, busy, create, generate, timeout, content, blocked, screen); paywall_shown (attractiveness, photo_offer). On a failed measurement it says which kind of failure it was; on the report links it says which link it was; on a second photo it says only whether the face shape came out the same, never which shape. It is never set on any other event.

Price group. While we test two first-report prices, the server works out which price your browser sees from the anonymous id above (a fixed hash, nothing else about you) and stores that group, f290 or f190, on each row and on a report started from checkout, and tells Stripe the same group. Checkout sends the anonymous id for this; it is not kept on the report. Once a paid report has opened in this browser, a note in its local storage (mf_paid_report) says so, and checkout sends a yes/no flag from it so the next report is charged the regular price (group p499).

Bots are classified server-side, from the request's User-Agent header and, when Cloudflare's bot-management signals happen to be present on this hosting plan, those signals too. That classification (why a row was flagged, or that it was not) is stored alongside the row, but it never changes what channel a row claims — a bot hit is not relabelled to hide which source it arrived from, it is separately marked so it can be excluded from the human counts we report. This classification is computed by our server from the request; a client's browser cannot set or influence it. A request is also flagged when several new anonymous ids arrive within two seconds from the same network and User-Agent, which is how a script opening many tabs looks. To compare them, a short one-way hash of the network and User-Agent is kept in a separate table, deleted a minute after the next landing and within an hour at the latest; it is never stored on an event row, and the anonymous ids it flags are remembered for ten minutes so their later events are flagged too. No IP address is part of it.

No IP address is stored. Your IP is read from the request to key a short-lived rate limit — the same per-minute cap that stops this endpoint being used as free storage — and it is never written to our database; only the fields listed above land in a row.

There is still no session identifier, no page path stored per row beyond page_kind's three-value bucket, and no referrer string (only the derived source category). Because there is no session identifier, two of these rows can never be definitively tied together as the same visit — the table counts occurrences by a persistent anonymous id, and cannot describe a visit the way a session recording can.

It would be misleading to leave that paragraph standing on its own, so: the third party analytics described below can describe a visit, in far more detail than our own table does. Our table being minimal does not make the page minimal. Both things are happening, and the one that matters more for you is the one below.

The third parties, and what each one gets

This page used to say that we ran no session recording, and gave the reason: on this site the screen has your face on it. That changed. A session recorder now runs, and rather than soften the old paragraph into something technically defensible, here is what happens instead.

Microsoft Clarity

Records your session: a replayable video of the page as you used it, plus clicks, scrolling and rage clicks. It sets cookies the moment the page loads, before you tick anything or choose a photo. It receives your IP address, browser, device and approximate location. The parts of every page that can show your photo, the drawing done on it, or the numbers taken from it are marked in our code to be hidden from that recording, and that marking is in the page itself rather than a setting in their dashboard, so you can read it in the page source. The report page does not load Clarity at all.

Google Analytics

Counts page views and where they came from, with your IP address, browser, device and approximate location. It sets cookies. It does not receive any measurement, and it is not loaded on the report page.

Plausible

The same kind of counting, from a server we run ourselves rather than a shared one. No cookies from this one.

Cloudflare

Serves the site, so it necessarily sees every request and your IP address. They also inject their own analytics script at the edge, which our Content-Security-Policy blocks before it runs.

domainrank.app

Not analytics. The footer shows a ranking badge for this domain, served as an image from them, so fetching it tells them your IP address and that a page on this site was open. On a long page it only fetches once the footer comes near the screen; on a short one it fetches straight away. Our Referrer-Policy sends them this site's address rather than the page you were on. Their response does try to set two cookies, which your browser will usually refuse because they come from a third party, and we neither read them nor receive anything back from them. The report page does not show the badge at all.

saastool.site, tooluck.org, neeed.directory, findly.tools and acidtools.com

Five directory listings in the footer, each shown as a small badge image fetched directly from that directory's own domain rather than through ours. Fetching each one tells that directory your IP address and that a page on this site was open, the same as the domainrank.app badge above. These five are hotlinked instead of proxied because each directory checks, from its own crawler, that the exact image it issued is present at its own address before it will treat the listing as verified -- a copy served from our domain fails that check.

What has not changed, and it is the part worth checking. Nothing derived from your face leaves your device: none of these receive your photo, the landmark points taken from it, or the measurements. That is not a policy promise: the browser is not permitted to send them anywhere, and you can verify it the same way described above, by watching the network tab for a request with a body while you run a measurement.

Masking is not the same as not recording. A masked region is hidden from the replay, but the recording is still a recording of your visit, and a mistake in how a page is built could leave something visible that should not be. That is why the report page, which shows your own measurements behind a paid link, is excluded from the recorder entirely rather than masked. If you would rather not be recorded at all, a tracker blocker or your browser's Do Not Track setting will stop Clarity loading, and the site works exactly the same without it.

What this site is not

It is not a medical device, a diagnostic tool, or a cosmetic consultation, and nothing it prints should be used to decide on a procedure. It does not rate attractiveness and does not rank anyone. The example portraits throughout the site are generated by an image model and are not photographs of real people. The measurements themselves are described with their own precision attached, and any number too small for the method to resolve is shown as unmeasurable rather than as a confident figure.

The tools this applies to

• Face shape detector
• Golden ratio face test
• Face symmetry test
• Canthal tilt test
• Nose shape measurement