Know where your photo goes.

Selecting and submitting a photo

Selecting a file creates a temporary object URL in your browser. The free scan checks the photo with local landmark detection. When you separately consent to AI analysis and start an account or paid guest analysis, the browser creates a JPEG with a maximum side length of 1,280 pixels and sends it to our analysis API. This canvas conversion does not copy the original file’s EXIF metadata.

Our server sends the JPEG to Replicate to run Google’s Gemini model. Replicate and its model provider process the image to return a score and explanation. Do not submit a photo if you do not want this third-party processing.

Temporary photo storage on your device

With your consent, the browser stores a temporary photo copy and pending analysis details in IndexedDB to continue after sign-in or payment. The pending copy expires after 30 minutes for account flows or 7 days for guest orders. Successful report generation or choosing a replacement photo removes the pending record. This temporary storage stays on the device and browser you are using.

Clearing this browser’s site data also removes its pending photo and guest access information. If you remove guest access information, you may lose the ability to reopen that guest result in this browser. Clearing browser data cannot retract a photo already sent for AI processing.

Reports, account information and retention

We do not store raw photos in the server database, your account or a public gallery. We store generated report text and its ownership in Supabase to deliver and restore account and guest results, including when you do not separately choose Save to my reports. This can include the AI score, feature explanations and recommendations. Reports you explicitly save may also include local measurement values.

Google sign-in stores your account ID, email and display name; secure cookies keep you signed in. Account and guest owners can delete their generated reports. Deleting a report does not delete the associated order or payment records, which are retained as financial records. Downloaded copies remain on your device until you delete them.

Requests pass through our hosting provider and model service. Their processing and operational retention follow their own policies; we do not promise instant provider deletion or zero retention. Replicate’s current policies are available at https://replicate.com/docs/topics/predictions/data-retention and https://replicate.com/privacy.

Website requests and your choices

Our hosting provider processes connection information such as IP address and request metadata to deliver and protect the service. Checkout is handled by Dodo Payments, which receives the customer and billing information needed for payment and receipts. We store orders, payment status, credit transactions and the relationship between a purchase and its report entitlement, not payment card details. There is no public report sharing feature. We do not sell photos.

You can read every guide without choosing or submitting a photo. Only adults may use the tool, and you must have permission from the adult pictured.