Legal
Privacy Policy
Version 1.3 · Effective 22 October 2026
This policy explains what Your Face Report ("we", "us") collects, why, who processes it, how long we keep it and how you can delete it. Your Face Report (yourfacereport.com), based in the United States, is the data controller. Questions: support@yourfacereport.com.
The short version
- Free tools never upload your photo. Face detection and every measurement run inside your browser.
- The paid report uploads your photo only after you tick three unticked boxes, including explicit consent to process your facial data.
- We treat facial geometry as biometric data. We never sell it, never use it for advertising and never use it — or let our providers use it — to train AI models.
- A report and its photo are kept for at most 12 months, and you can delete them at any time.
- We use no advertising or analytics cookies.
1. What we collect
| Data | When | Why |
|---|---|---|
| Your photo | Only when you buy a report, after consent | To create your report |
| Facial landmarks and measurements (478 points and the ratios derived from them) | Computed in your browser; sent with your photo when you buy a report | To score your proportions and draw them on your photo in the report |
| AI observations about your photo (color season and contrast, perceived age range, hair type, cosmetic skin notes) | When your report is generated | To write your color, styling and skincare guidance |
| Your written report and AI-generated images (hairstyle previews, styling concept) | When your report is generated | To deliver what you bought |
| Email address | At checkout (collected by our payment partner) or from Google sign-in | To find your report when you sign in with Google, and to answer support requests |
| Google account name, email and profile picture | Only if you sign in with Google | To keep your reports in one account |
| Consent records (what you agreed to, when, a keyed hash of your IP address, browser type) | When you tick the consent boxes | To prove consent, as the law requires |
A random browser identifier (cookie yfr_anon) | When you visit | To show your report on the device you bought it with, before you sign in |
| Order details (product, price, status, date) | When you pay | Bookkeeping and refunds |
We do not receive or store your card details. Payments are processed by Waffo Pancake (see section 4).
2. Facial and biometric data
Measurements of facial geometry can identify a person, so we handle them as biometric data under laws such as the Illinois Biometric Information Privacy Act (BIPA), Washington's My Health My Data Act, the Texas CUBI Act and Article 9 of the EU/UK GDPR.
- Purpose: only to produce the report you asked for. Nothing else.
- Consent: we ask for explicit, separate consent before your photo leaves your device. The boxes are never pre-ticked.
- No sale, no training: we never sell, lease or trade biometric data or profit from it beyond providing your report, and we do not use it to train AI models.
- Retention: your photo, measurements and report are destroyed after 12 months at the latest, or earlier when you delete them. Photos uploaded for an order that is never paid, and the measurements sent with them, are deleted within 3 hours.
- Withdrawing consent: delete your data (section 7). Processing stops and the data is destroyed.
3. How the analysis works
- On your device: Google's MediaPipe Face Landmarker, served from our own website, finds 478 landmarks in your photo. Our measurement code runs in your browser. For free tools, this is the end — nothing is sent anywhere.
- For a paid report: your photo (re-encoded in your browser to remove location and device metadata) and the landmarks are sent to our servers. We recompute your measurements, then:
- Google Gemini reviews the photo (input safety check, color season, perceived age, hair) and generates the hairstyle previews and styling concept;
- every generated image is checked by Gemini against your original for safety and likeness before we keep it;
- Anthropic Claude writes your report from our measurements.
- Both models are reached through OpenRouter, restricted to providers that do not retain prompts or images (zero data retention) and do not train on them.
We do not make decisions with legal or similarly significant effects about you. Scores describe proportions within typical ranges; they are not a judgement of you.
4. Who processes your data
| Provider | Role | Data |
|---|---|---|
| Vercel Inc. (USA) | Website hosting | Requests, IP address (in server logs) |
| Supabase Inc. (servers in the United States (AWS us-west-1, Northern California)) | Database and private file storage | Everything listed in section 1 except card data |
| OpenRouter Inc. (USA) | Routes requests to AI models, zero data retention | Photo, measurements, report text while processing |
| Google LLC — Gemini API | Photo review, color analysis, image generation | Photo and prompts while processing, not retained or used for training |
| Anthropic PBC — Claude | Report writing | Measurements and observations, not retained or used for training |
| Waffo Pancake (Hong Kong) | Merchant of record: checkout, payment, tax, refunds | Email, payment and billing details, order |
| Inngest Inc. (USA) | Runs the report-generation steps | Report identifiers and processing status |
| Google LLC — Sign-In | Sign-in with Google | Name, email, profile picture |
Each provider acts on our instructions under its data processing terms. Some are in countries outside yours; where required, transfers rely on standard contractual clauses or equivalent safeguards.
5. Cookies
We use only cookies needed for the site to work: a language preference (NEXT_LOCALE), the random browser identifier (yfr_anon) and, if you sign in, session cookies from our sign-in system. We do not use advertising, analytics or tracking cookies. If that changes, we will ask first.
6. How long we keep data
| Data | Kept for |
|---|---|
| Photos, landmarks, measurements and consent records for unpaid orders | Deleted within 3 hours |
| Paid report: photo, landmarks, measurements, AI observations, report, images, PDF, moderation records | Until you delete it, at most 12 months |
| Payment notifications (contain your email) | 90 days, then reduced to a delivery record |
| Order records (product, price, date, status) | As long as needed for bookkeeping; your email is removed when you delete your data |
| Account (if you signed in) | Until you delete it |
| Consent records for a paid report | Deleted with the report or your account, at most 12 months |
7. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or California law) you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time.
- Delete everything: sign in with Google and use Delete my data. Your reports, photos, images, measurements, consents and account are destroyed.
- Delete one report without an account: open it in the browser you paid with, or from its private link, and choose "Delete this report".
- Anything else: email support@yourfacereport.com. We reply within 30 days, usually much sooner.
You may also complain to your data protection authority.
8. Age
Paid reports are only for adults (18+). You confirm your age before paying, and our input check stops processing — and deletes the photo and everything measured from it — only if the person clearly appears to be a child (an estimated age entirely under 18). You can then upload a different photo. Free tools store nothing, and the site is not directed at children under 13.
9. Security
Photos and reports are stored in private storage, never on public URLs; links to images expire after an hour. Private report links contain a random secret of which we store only a hash. All traffic is encrypted (HTTPS).
10. Changes
If we change this policy materially, we will update the version and date above and, where we have your email, tell you before the change takes effect.