Privacy policy

The short version: the face scan runs entirely inside your browser. Your photo is never uploaded to us or to anyone else, we never see it, and we keep no copy of it or of the measurements taken from it. Closing or reloading the tab erases both. The rest of this page explains that in detail, and covers the small amount of ordinary website data we do handle.

Who we are

FaceCheckup (facecheckup.com) is run by its founder and editor, Sukie. For any privacy question or request, email sukielovesupport@gmail.com. We aim to reply within 7 days and will complete any request the law gives you within the time the law sets.

Your photos and face measurements

When you scan a photo, your browser downloads Google’s open-source MediaPipe face model from our own website and runs it on your device. The model finds 478 points on the face in the photo. Our code then turns those points into measurements such as distances, ratios and angles, plus the Balance Score, face shape and style suggestions. All of this happens in your browser’s memory.

• The photo is not uploaded. No request carrying the photo or its measurements is sent to our servers or to any third party. You can confirm this in your browser's developer tools (Network tab) while a scan runs.
• We do not store photos, face points or measurements: not on a server, not in cookies, and not in your browser's storage. The only exception is a share image, which is created and saved only if you press the share button, and only to the place you choose.
• We do not use faces to identify anyone. The scan cannot tell who a person is, and we never compare faces with each other or with any database.
• If you choose to include your photo on a share card, the card is made on your device and sent only where you send it.

Biometric privacy laws

Some laws treat information about face geometry as biometric data. Examples are the Illinois Biometric Information Privacy Act (BIPA), Texas Business and Commerce Code §503.001, Washington’s biometric and health-data laws, and Article 9 of the EU and UK GDPR. FaceCheckup is designed so that we never collect, capture, receive, store, sell or disclose such data. The geometry exists only temporarily in your own browser, under your control, and is discarded when you close the tab. Before any scan we ask you to confirm that you are 18 or over and that the photo is yours or that you have the person’s permission. Do not scan a photo of someone who has not agreed to it.

Our retention and destruction policy for biometric data is simple: because we never receive it, we hold none to retain. If that ever changes, for example through an optional feature that needs an upload, we will publish a new written policy and ask for your separate, explicit consent first. A change like that would never apply to scans you have already made.

Data we do receive

• Standard server logs. When you load a page, our hosting provider (Vercel) records technical data such as IP address, browser type, the page requested and the time. These logs are used for security and keeping the site running, and are kept only for the provider’s standard retention period.
• Emails you send us. If you write to sukielovesupport@gmail.com, we keep the message to reply and to deal with any follow-up, then delete it within 24 months unless we need it longer for a legal reason.
• Purchases. If you buy the Full Face Report, payment is handled by Stripe. We never see your card number. Stripe shares with us your email address, the amount, the date and a transaction ID, which we keep for tax and accounting records and to deal with any problem with your order. Stripe’s own privacy policy applies to the data it processes.

Cookies, analytics and advertising

The scan itself uses no cookies. We store one small setting in your browser’s session storage: whether you ticked the consent box, so you don’t have to tick it again on every page during that visit. It is deleted when you close the tab.

We use two analytics services to understand which pages help people and where the site is confusing. Google Analytics counts visits, pages viewed, rough location (country or city), device and browser type, and how visitors arrived. Microsoft Clarity records anonymised clicks, scrolling and page layout so we can see where a page is hard to use. The scan area is masked from Clarity, and your photo is shown on the page only through a temporary in-browser address that nothing outside your tab can open. Neither service ever receives your photo or face measurements. Both set cookies or similar identifiers. You can read how they handle data in Google’s partner-sites policy and the Microsoft privacy statement.

For visitors in the EEA, the UK and Switzerland, Google Analytics runs in Google’s consent mode with analytics and advertising storage switched off by default, so it sets no analytics cookies. If we add advertising (Google AdSense), Google and its partners may use cookies to serve ads based on your visits to this and other sites, and those ads may be personalised. You can opt out of personalised advertising at Google Ads Settings. Before personalised ads are shown in the EEA, the UK or Switzerland, we will ask for your consent through a consent message.

Children

FaceCheckup is for adults aged 18 and over. We do not knowingly collect personal information from children, and we ask that no one scan a photo of a minor. If you believe a child has sent us personal information, email us and we will delete it.

Your rights

Depending on where you live, you may have the right to access, correct, delete or get a copy of the personal information we hold about you, to object to or restrict its use, and to complain to a data-protection authority. This includes rights under the GDPR, the UK GDPR and US state laws such as the California Consumer Privacy Act. Because we hold no photos or face data, most requests will concern purchase records or emails. We do not sell or share personal information for cross-context behavioural advertising, except through advertising cookies as described above. You can exercise your rights by emailing sukielovesupport@gmail.com, and we will not treat you differently for doing so.

Security

The site is served only over HTTPS. Because face data never reaches our systems, it cannot be exposed in a breach of our systems. Payment data is handled by Stripe, which is certified to PCI DSS Level 1.

Changes

If we change this policy, we will update the date at the top. If a change affects how photos or face data are handled, we will also announce it on the scan itself before it takes effect.