Privacy Policy

Effective August 17, 2026

How your photos are used

Most of the reading is measured on your device: the app turns a photo into proportions (like eye spacing and jaw width, and — when your body is in frame — shoulder and neck proportions) without the photo leaving your phone.

A few things those proportions can’t capture — how thick the eyebrows are, whether the earlobe hangs free, and the apparent sex used to pick the right comparison group — need a look at the actual pixels. For those, the app sends a downscaled copy of the photo (smaller and lower-resolution, but the whole face) to our server, which passes it to our AI provider (Anthropic) to read just those features and return short labels (like “thick eyebrows”). Anthropic processes them for us under its own privacy terms: it doesn’t use them to train its models, and it deletes them under its own retention policy — normally within 30 days. Anthropic works for us here — its commercial terms and data-processing agreement bind it to protect this data at least as well as we do, and it can only use it to do this work for us.

The app tells you this and asks for your OK before the first photo is sent (you can read this policy right there before you decide).

That copy is deleted within 48 hours. It stays on our server just long enough to finish your reading and to let your pictures come across if you sign in on another device right away. After 48 hours it’s deleted automatically. Deleting your account deletes it straight away — see “Deleting your data”.

We never keep the full-resolution original. What we hold is the same smaller copy described above, for those 48 hours.

Separately, the app makes a small avatar thumbnail of each photo. Those are tiny — a face-sized crop, not the photo — and they’re saved with your account so your people still have faces when you sign in on another device. They go when you delete your account.

Some places have specific laws about face data. If you’re using FaceSage from Illinois, Texas or Washington, we don’t keep your photos at all — the reading works exactly the same, we just don’t retain the picture.

What we do receive

Anonymous measurements. Scanning turns a face into a short list of numbers (proportions like eye spacing). These numbers can’t identify a person or rebuild the photo. They’re sent to our server and passed to Anthropic, whose model writes the reading from them.
A downscaled copy of the photo, briefly. Used for the eyebrow, earlobe, and apparent-sex reads described above, and deleted from our server within 48 hours. Our AI provider (Anthropic) processes it for us, doesn’t train on it, and deletes it under its own retention policy (normally within 30 days). Not kept on our server at all in Illinois, Texas or Washington.
What you type. The names you give people and the questions you ask are sent to our server and passed to Anthropic so the reading and answers can use them.
A device code. A random code identifies your device so your reads balance works.
Your email, if you create an account. Verifying an email (for the free reading, sign-in, or a purchase) creates your account: we store the address so you can sign in anywhere and recover your reads. See “Your account and email” below.
Support messages. If you use Contact us, the message and the reply email address you enter are delivered to our inbox and kept as ordinary correspondence.

Readings are written by an AI model (Anthropic’s Claude). Finished readings are held on our server for up to 7 days so an interrupted reading can finish, then deleted after that window. Without an account, the lasting copy of a reading lives only on your device.

Your account and email

An account is just a verified email — no password. When you have one:

Sign-in and recovery. We email you a short code to sign in; your reads balance and unlocks follow the email to any device.
Your people and readings sync. The list of people you’ve scanned — names you gave them, measurements, finished readings, and chat answers — is stored on our server under your account so it follows you across devices and survives a lost phone or cleared browser. The small avatar thumbnails sync too, so your people still have faces when you sign in somewhere else. Deleting your account deletes all of it.
Email from us. We send account email (codes, your finished readings) and occasional tips and offers. Every marketing email has an unsubscribe link — one tap stops tips and offers for good, while codes and readings you request still arrive. Emails are delivered through our email provider (Resend). We never sell or share your address.

What we don’t keep

Full-resolution photos. The original never leaves your device. What we receive is the smaller, downscaled copy described in “How your photos are used”, and that is deleted within 48 hours.
Who a face belongs to. We don’t run face recognition and don’t build a face-ID template. Measurements and labels carry no name beyond what you typed, and we never try to match a face to a real identity.
Anything after you delete your account. Deleting the account removes your balance, unlocks, synced people and readings, stored photos, and your email from our systems.

Faces, bodies, and biometric law

A face reading is built from facial (and, when a photo shows it, body) proportions, plus a few appearance details read from downscaled photo copies. Some laws (such as Illinois’ BIPA and the GDPR) treat this kind of information as biometric. To be clear about how we handle it: we do not identify anyone, build a face-recognition template, or match faces across photos or to any database; we don’t sell this data, and the only outside company that handles it is our AI provider (Anthropic), which processes it for us — it doesn’t train on it and deletes it under its own retention policy, normally within 30 days; and our own downscaled copies are deleted within 48 hours. Because you can scan other people, only scan a photo you have the right to use, of someone who would be okay with it (see the Terms).

Analytics

We collect first-party usage data only: which screens you visit, which buttons you tap, and how you arrived (the referring site’s domain and any campaign tag in the link — never full page addresses). Never the text you type, never names, never photos. There are no third-party trackers or ad SDKs in the app.

If you rate a reading section with 👍/👎, we store that rating to find confusing sections.

We also keep the questions asked in chat as an anonymous list — stored with no device code and no link to you or to who was asked about — to learn which questions matter and improve the suggested ones.

Purchases

Payments go through Apple (in the iOS app) or Whop (on the web), which is the merchant of record for web purchases. We never see your card or bank details — only a receipt that tells us to add reads, plus the email you used at checkout (which becomes your account email, as above).

Deleting your data

You tab → Delete account removes your balance, unlocks, any cached readings, your synced people and readings, the photos we kept, and your account email (including from the tips-and-offers list) from our server, and erases everything the app stored on your device. This can’t be undone. A few things are kept on purpose: anonymous diagnostic logs (timestamps and screen taps, tied only to a scrambled device code) may persist for a limited period; records of past purchases (Apple or Whop transaction identifiers, used to honor refunds and avoid double-crediting); and any support messages you sent, kept as ordinary correspondence. None of these contain photos, readings, or names.

Children

FaceSage is not directed at children and requires users to be 18 or older.

Changes and contact

If this policy changes, the effective date above changes with it. Questions: Contact us in the You tab, or support@facesage.app