Privacy Policy
Your photo stays on your device. Photos are processed locally, not uploaded or saved by this tool.
What happens to a photo
Your browser decodes your selected file in memory, checks its quality and uses a local model to estimate facial points. Those points and your result stay in memory. We do not write photos, landmarks or results to localStorage, sessionStorage, IndexedDB, Cache Storage or a service worker. Using Change photo, refreshing, leaving or closing the page discards the current session. Returning through browser history starts in the empty state rather than restoring the previous photo. Choosing Download Result creates a PNG locally and saves it through your browser.
What uses the network
The site and its fixed model and WebAssembly files are delivered by Cloudflare from the same site origin. Ordinary HTTP caching may retain public application assets, never your photo. The hosting provider necessarily handles connection information such as IP addresses and requested URLs to deliver the website. A local-processing promise does not mean the page makes no network requests.
Cloudflare currently adds Network Error Logging (NEL) response headers. A supporting browser may send network-failure diagnostics, including requested URLs and connection information, to Cloudflare. This hosting-managed reporting remains enabled; it is separate from this tool's local photo analysis and application events.
Analytics and SDK metrics
We use Google Analytics 4 (GA4) to measure page visits and a strict allowlist of tool interactions, such as starting an upload, completing an analysis, retrying or downloading a result. Event details are limited to predefined categories, such as success or failure and broad timing buckets. We never send photos, pixels, landmarks, scores, file names, image hashes or result details to Google.
GA4 loads a Google-hosted script and sends cookieless measurement requests to Google. Analytics storage and all advertising consent settings remain denied: we do not enable analytics cookies, Google signals, advertising personalization, enhanced measurement, Google Tag Manager containers, session replay or an error-monitoring service. Only the site theme preference is stored by the application. Cookieless does not mean anonymous or offline: Google receives network information such as your IP address and browser information, along with measurement data such as device characteristics and temporary identifiers.
Page addresses are restricted to known FaceCoda routes, with fixed page titles and no query strings, fragments or referring-page URLs. Unknown routes are reported as a generic not-found page. Automatic link, download, form, search and scroll tracking is disabled. Preview visits also use this restricted page information. Google may derive aggregate measurement from cookieless requests; counts are not a reliable record of unique people or repeat visits. See Google's Privacy Policy.
The pinned MediaPipe package includes usage logging code; this tool blocks its outbound transport. The content security policy permits only the GA4 script and collection endpoints in addition to local application resources. No photo-processing data is included in analytics.
Your choices
Use only photos you have permission to use. Do not upload sensitive documents or someone else's photo without consent. The tool has no account or stored history to delete. A result card that you choose to download is your own file; sharing that file is separate from using this site.
Contact: [email protected]