Privacy Policy

We practice data minimization — we collect only what the service needs:

• Uploaded photos. The photo you choose to upload for analysis. This is the only sensitive data we process, and only at your initiative.
• Account data (optional). If you sign in with Google, we receive your email address and basic profile information from your identity provider. Sign-in is only required for paid features.
• Purchase records. Order IDs and entitlement status for paid reports. Payment card or bank details are handled entirely by our payment providers (e.g. PayPal) and never touch our servers.
• Usage analytics. Anonymous, aggregated usage statistics via Google Analytics (page views, device type, approximate region). No photos or report content are sent to analytics.

Uploaded photos are stored in a private Cloudflare R2 bucket (encrypted at rest, served over HTTPS only). Each photo is stored under a random, unguessable key and is accessible only through a time-limited workflow needed to render your result. Access to the storage layer is restricted to the service's backend systems.

Automatic deletion within 24 hours. Every uploaded photo is automatically and permanently deleted from storage within 24 hours of upload by a storage-level lifecycle rule — no manual action is required, and deletion cannot be skipped. After deletion, the photo cannot be recovered by us or anyone else.

• We never sell your photos or personal information.
• We never use your photos for advertising, marketing, or any other commercial purpose.
• We never use your photos to train AI or machine-learning models.
• We never publish your photos or make them visible to other users.
• We never share your photos with third parties, except the processing infrastructure strictly required to generate your result (our storage provider and AI analysis provider, both bound by contractual confidentiality and data-protection obligations).

You can request access to, or deletion of, any personal data we hold about you at any time — including immediate deletion of an uploaded photo ahead of the automatic 24-hour deletion. To make a request, email us via the address on our Contact page with the subject line "Data Request". We respond to verified requests within 30 days.

• All traffic is encrypted in transit (HTTPS/TLS).
• Photos are encrypted at rest in Cloudflare R2.
• Storage credentials are server-side only and never exposed to the browser.
• Access to production systems is limited to authorized personnel on a need-to-know basis.
• Automatic 24-hour deletion limits the exposure window of any uploaded photo.

The service is directed at adults and is not available to anyone under 18. We do not knowingly collect or process data from minors. If you believe a minor has uploaded a photo, contact us and we will delete it immediately.

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above. Continued use of the service after an update constitutes acceptance.

For any privacy question or data request, reach us via our Contact page.