Legal information
Privacy Policy
Last updated: 26 October 202614 sectionsAbout 18 minutes to read
At a glance
Summary only. The full text below governs.- Your photo is measured in this browser and never uploaded.Section 1
- We hold no face template and no face geometry record.Section 2
- Analytics count named events with a random run identifier, with no photo, score or measurement.Section 3
- Purchase access, and optional history, are stored in your browser.Section 6
- Stripe takes payment on its own page. We never see your card number.Section 7
The short version: your photos never leave your device. Private Color Analysis inputs and derived choices stay in the current browser tab. We have no accounts, no cookies and no advertising. We never receive your face, and we do not want it.
We do store minimal payment-entitlement state when you buy access. Below, we explain exactly what is stored and why.
All 14 sections
When you choose a photo, your browser decodes it into the memory of the tab you are looking at. A face-landmark model then runs on your own device and measures the image there. The measurements, the score and the report are all computed on your device.
No part of the photo reaches our servers or anyone else. The face model runs inside your browser, and the page makes no request that carries image data.
Private Color Analysis keeps selected photos, sampled image characteristics, drape comparisons, preferences and the derived colour direction in tab memory. On your device, it separates face, hair and clothes to show a neutral cape and check the cheeks, and uses optional white paper to correct the photo colour for measurement, with no upload. Photos, segmentation masks and colour measurements stay only in tab memory. It also keeps each photo’s visible-cheek confirmation only in tab memory. Automatic image checks cannot identify every hair, mask, hand or makeup covering; check that both cheeks are visible and uncovered before comparisons, and confirm this with a check box when the automatic check cannot decide. A head covering is fine when both cheeks remain visible. These inputs are not included in checkout or delivery requests and are cleared on navigation or when you leave. Private Color Analysis does not use the optional geometry checkout draft or monthly local history. Repeated comparisons, presentation order, local lighting-review cues and palette-explorer selections also stay in tab memory and are not sent to analytics or purchase services. The palette explorer uses retained local photos and adds no guide delivery. Its PDF and palette PNG are created locally and contain no face photo.
The image stays in the current browser tab while you view the result. It is released when you choose another photo or leave the page. If you choose the unchecked checkout-draft option before payment, this browser also stores a metadata-free image copy in IndexedDB for 30 minutes so you can return after payment. You can continue without saving instead and choose your photo again after payment.
While it measures your photo, the face model produces a set of geometric points. Those points exist only in the memory of your browser tab, and only for as long as the analysis runs. They are never transmitted. If you choose the unchecked checkout-draft option, IndexedDB temporarily stores the metadata-free image copy, score, six measurements, face shape, measurement guides, random run, scan and tab identifiers, a random write identifier to protect newer drafts during cleanup, and expiry information. The app deletes that draft when checkout cannot open, you reset the scan, or on the next visit after expiry; nothing is sent to the operator, Worker, Stripe or PostHog.
The share card is made in your browser, holds no photo, and goes only where you send it.
We do not collect, capture, receive, store, sell, lease, trade or otherwise profit from biometric identifiers or biometric information. We hold no face template and no face geometry record. There is nothing about your face for us to disclose, retain or destroy.
We use PostHog to count page opens and how many people reach each step of the tool. We configure it to store nothing on your device: no cookies, no persistent PostHog browser storage, no session recording and no automatic click tracking. A visit therefore cannot be recognised by PostHog on a later unrelated visit or on another site.
Each page load receives a random run identifier held only in browser memory. It is not derived from your face. Checkout carries that identifier through Stripe and back to the return page so events within that purchase can be joined. We do not send purchaser email or contact details to PostHog and create no new purchaser profiles.
These are all the events we record, and everything each one carries:
- $pageview — you opened a page on this site. PostHog receives the page address and the automatic technical details described below, but no photo, face data, score or measurement.
- $pageleave — you closed or left a page on this site. It carries the same page address and automatic technical details as $pageview, and nothing else. We use it only to measure how long a visit lasted.
- photo_selected — you chose a photo. No other information.
- face_detected — the tool found a usable face. No other information.
- analysis_failed — the selected photo did not produce a score. It is sent once for each photo that fails, whatever the cause. No image detail or measurement is sent.
- detection_no_face, detection_no_pose, detection_multiple_faces, detection_extreme_yaw, detection_extreme_pitch, detection_low_resolution and detection_degenerate_geometry — which one of the seven on-device quality checks refused the photo. The name is all we receive: no image, no face detail, no measurement and no score.
- retry_prompted — the tool showed a guided retry after one of five photo checks. It carries only failure_reason as extreme_yaw, extreme_pitch, low_resolution, no_face or multiple_faces. It sends no angle, dimension, filename, image, face detail, measurement or score.
- photo_rejected — the file you chose was not a JPG, PNG or WebP image, was empty, or was above the size limit. The filename, the file type and the file size stay on your device.
- photo_undecodable — your browser could not read the file as an image, or the image held too many pixels. No image detail is sent.
- analysis_errored — an unexpected error stopped the analysis. No error message, image detail or measurement is sent.
- score_computed — the on-device calculation finished. The score itself and all measurements stay on your device.
- paywall_viewed — the single-report offer became visible. It carries no score, measurement, photo, or other face detail.
- report_preview_opened — you opened the synthetic sample report. It carries no score, measurement, photo, or other face detail.
- subscription_upsell_viewed — the Unlimited offer appeared at the end of a purchased single report. It carries no score, measurement, photo, or other face detail.
- subscription_upsell_clicked — you chose the Unlimited offer after a purchased single report. It carries no score, measurement, photo, or other face detail.
- another_photo_clicked — you chose to start another analysis. No other information.
- pricing_dock_viewed — the single-report purchase bar became visible. It carries no score, measurement, photo, or other face detail.
- score_offer_clicked — you chose the single-report offer. It carries no score, measurement, photo, or other face detail.
- sticky_upgrade_clicked — you chose the single-report purchase bar. It carries no score, measurement, photo, or other face detail.
- header_unlock_opened — you opened the purchase panel in the site header. It records only that the panel was shown.
- header_upgrade_clicked — you chose a paid option from the header panel. No other information.
- header_restore_opened — you opened the restore panel in the site header. It records only that the panel was shown.
- header_restore_accepted and header_restore_rejected — whether the restore link you pasted had a valid form. The link, the access token and any part of either is not sent.
- header_account_opened — you opened the account menu in the site header. It records only that the menu was shown.
- header_access_removed — you deleted your access from this device. No token, link or purchase reference is sent.
- upgrade_clicked, checkout_started, checkout_cancelled, purchase_completed and report_unlocked — the five steps and outcomes of a purchase. Purchase events fire only after our Worker verifies the Stripe purchase; they retain the random run identifier rather than identifying a person.
- checkout_rejected, checkout_unreachable and checkout_url_untrusted — the payment page did not open, and which of the three causes stopped it. No error message, address or payment detail is sent.
- purchase_restored and unlock_retry_succeeded — access was restored or a payment confirmation retry succeeded. No session reference, restore credential or token is sent.
- restore_link_copied — you copied the private restore link after purchase. The link and access token are not sent.
- result_card_shared — you shared a locally generated result card through your device share sheet. The event contains no card, score or measurement.
- result_card_downloaded — you downloaded a locally generated result card. The event contains no card, score or measurement.
- share_link_copied — you copied the public, campaign-tagged homepage link. The event contains no copied address, report, score or measurement.
- paid_report_viewed and paid_report_loaded — the full-report flow opened and its content loaded on your device. The score and measurements are not sent.
- report_load_failed and report_retry_clicked — the paid report did not load or you retried it. No report data, token or failure detail is sent.
- single_plan_selected and monthly_plan_selected — you chose one of the two paid options. No other information.
- single_purchase_completed and subscription_purchase_completed — Stripe confirmed the selected purchase type. The event retains the random run identifier and contains no contact, card or billing details.
- single_report_delivered — the one-report credit displayed its complete report. No report data is sent.
- billing_portal_opened and billing_portal_failed — Stripe’s subscription-management page opened or could not be opened. No portal link, token or failure detail is sent.
- history_enabled and history_disabled — you opted into or deleted private history on this device. No history data is sent.
- comparison_viewed and consistency_check_viewed — you opened the local comparison or consistency display. No scores or measurements are sent.
- report_printed — you opened the browser print or PDF flow. The report itself is not sent to analytics.
- report_overlay_viewed and report_pdf_downloaded — you used the local measurement overlay or downloaded a locally generated PDF. No guide, photo, report or filename is sent.
- report_explanation_helpful and report_explanation_not_helpful — the event name records the chosen helpful/not-helpful button and carries no text, score, measurement, photo, guide, or report content.
- verification_retake_started and verification_retake_delivered — you began or received the included verification retake. No score, measurement or photo detail is sent.
- baseline_started and baseline_completed — you began or completed a three-photo baseline in browser memory. No baseline value or photo detail is sent.
- progress_dashboard_viewed — you opened the private local progress charts. No score, measurement, setup label or history data is sent.
- history_exported and history_imported — you downloaded or opened a local history file. The file and everything in it remain on your device.
- photo_protocol_started and photo_protocol_completed — you began or completed the local Photo Optimization Protocol. No task or completion date is sent.
- colour_started — you began a Private Color Analysis consultation or a new verification. No Private Color Analysis detail is sent.
- colour_comparison_completed and colour_preview_viewed — you completed the local drape comparisons or viewed the preview. No photo, preference, choice or colour direction is sent.
- colour_checkout_started — a trusted Stripe checkout link was ready and you were sent to it. No consultation information is sent.
- colour_report_delivered — an authorised colour guide was displayed. No guide content or colour direction is sent.
- colour_palette_exported — you prepared a local PDF or palette PNG download. No file, filename or guide content is sent.
- colour_usefulness_yes and colour_usefulness_no — the one feedback choice you made for a displayed colour guide. No written feedback or guide detail is sent.
Like any web request, these events arrive at PostHog with your IP address, the address of the page you are on, and the browser and operating system your device reports. PostHog uses the IP address to derive an approximate country. We do not use it for anything else.
Purchase type is recorded by the event name. PostHog receives no purchaser email, card details, payment credential or new person profile. Earlier versions sent purchaser email and created analytics profiles; those historical records are not removed by this change, and you can request their deletion using the contact address below.
The page address we send is the site name and the path only. We remove the query string and anything after the “#” before the event leaves your browser, so a payment reference or a restore link can never reach our analytics.
Each event also carries the campaign values that were already in the link you clicked, such as utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid and fbclid, and the address of the site that linked you to us. We use these only to learn which channels bring people here. For the UTM fields, campaign text is bounded, and values shaped like email addresses or payment credentials are discarded. We remove the query string from that linking address too, so search terms you typed on another site do not reach us. If you arrive by typing our address or from a bookmark, there is no linking address to send. When you return from Stripe, the return address carries the same campaign values back, so the checkout and purchase steps keep the source of your visit. For Stripe attribution, we use only the linking site’s host name, never its full address.
We never combine any of this with information about your face, because we hold none.
While a page here is open, visible and in recent use, your browser sends a small signal to our API about once a minute. The signal carries one random identifier, so that each open tab is counted once and the site can show how many people are using it at that moment. If you stop using the page, the signals stop a few minutes later.
The identifier comes from your browser’s random generator when the page loads. It is not derived from your face, your photo, your purchase or your analytics visit, and it exists only in the memory of the open tab.
Our server keeps only that identifier and the time of its last signal, computes one number from them, and deletes them about three minutes after the signals stop. Only the count is ever shown. Nothing is stored on your device for this feature.
If you buy access, your browser saves an access token, the plan type, and the Stripe Checkout session reference in local storage. A one-report delivery identifier is held in local storage for idempotent retry. If you open a restore link, local storage also holds that link’s token, and a marker that the token still waits for our server, until the server accepts or refuses it. These values contain no photo, landmark, score, measurement, filename or image metadata.
For an optional checkout draft, session storage holds one random per-tab handle so the draft can be opened only in its originating tab. It contains no photo, face, score, measurement, report, purchase or identity information and lasts only for that browser tab session.
Monthly subscribers may opt into private local history. If enabled, local storage contains only a random scan identifier, timestamp, score, the six measurements, and optional labels you enter for camera, lighting, expression and setup, for at most 50 scans. Entries older than 365 days are pruned. Photos, filenames, MIME types, dimensions, landmarks, measurement guides and object URLs are never placed in history.
Private Color Analysis does not save photos, profiles, comparisons, preferences, cheek confirmations or completed guides in a draft or history. It separately stores its access token and a random delivery handle with its token binding and completion marker so the service can safely retry or prevent reusing a completed delivery. Before clearing a paid checkout return from the address, it also saves only the validated Stripe Checkout session reference and the time it was saved in local storage, so a failed verification can resume after reload. It accepts that pending reference for up to 365 days and removes it after expiry on the next visit or after that checkout is verified and its access token is saved. A later cancelled checkout or a different restored purchase does not erase an earlier pending return. If device storage refuses the pending reference, the checkout return remains in the address until access is safely saved; analytics are suppressed while that credential is present. These values contain no photo or colour profile. Downloaded files are saved where you choose.
The optional 30-day protocol stores only its start date, task identifiers and completion dates. History is off by default. You can delete one entry, use “Delete all toolkit data,” export or import a validated local JSON file, or clear site data in browser settings.
If you choose a PDF with your annotated photo, the browser writes that PDF to the download location you choose. A PDF without the photo is also available. Both are created locally and never sent to us.
Stripe handles payment completely. You enter your card details on a page that Stripe hosts, not one that we host. We never see or store your card number. When checkout opens, the browser sends our Worker the plan, the random run identifier, and this visit’s source: the path of the first page opened here, the host name (not the full address) of the site that linked here, utm_source, utm_medium, utm_campaign, utm_content and utm_term values from the link, and first-source and medium labels such as direct. Values that look like an email address are dropped. The Worker attaches these values to the Stripe Checkout Session and its payment or subscription as metadata, and adds them to the Stripe return address so the return page keeps the same source. This attribution is held only in browser memory and is not stored on the device. It never includes a photo, score, measurement, filename or image detail.
Stripe collects what it needs to take the payment and send you a receipt, which includes your email address and billing details. Stripe handles that information as its own controller, under its own privacy policy.
When the browser confirms a Checkout session, our Cloudflare Worker verifies the settled payment and exact product with Stripe before returning the access entitlement and, if present, its validated random run identifier. The Worker does not return the purchaser email. Optional analytics failure does not block the paid report; payment verification failures can be retried. The Stripe webhook updates access and sends no analytics events.
Our Cloudflare Worker stores the minimum state needed to enforce purchases: plan type; Stripe customer, Checkout-session and subscription references; paid-through time; single-credit expiry; up to two single-delivery identifiers and their times; normalized subscription status; and processed webhook event identifiers. It does not store purchaser email, request body, photo, filename, image metadata, landmark, measurement, score or analytics identity.
Stripe sends signed webhook notices for subscription payment and status changes. The Worker verifies each notice and retrieves current subscription state before updating access. Entitlement tokens and restore links are credentials and are never logged.
Cloudflare serves this site. Like any web host, Cloudflare processes the technical details of each request, including the IP address and the browser type, in order to deliver the page and to protect the site from abuse.
The site also has:
- No accounts. There is nothing to sign up for.
- No advertising, and no ad networks.
- No selling or sharing of personal information.
- No email marketing. Stripe uses your email for payment and receipts. We do not send it to PostHog.
- No cross-site tracking, and no third-party tracking pixels.
This site is not intended for children under 13, and we do not knowingly collect information from them. If you are under 18, you must have the card holder’s permission before you buy anything.
Depending on where you live, you may have the right to see, correct, export or delete the personal information a business holds about you, and to object to how it is used.
We have no account for you, no photo and no measurements. Earlier versions could create a PostHog purchaser profile linked to the receipt email. You may ask us about or request deletion of those historical analytics records using the contact address below.
For anything Stripe holds as part of your payment, you can contact Stripe directly, or write to us at support@omogleai.com and we will help.
Our hosting provider, our analytics provider and our payment provider run servers in several countries, including the United States. The limited information described on this page may be processed there.
If we change how the tool handles data, we will change this page and update the date at the top.
If a future change affects the photo-privacy promise above, we will flag it at the top of this page.
Write to support@omogleai.com.