Privacy

It is never transmitted. There is no upload endpoint on this site. Whether you use your camera or choose a file, the image is decoded into a canvas element in your own browser, measured there, and never sent anywhere. You can verify this yourself: open your browser’s network tab while running the analysis and you will see no request carrying the image.

The face-detection model runs locally too. We host the model file and its WebAssembly runtime on our own domain rather than loading them from Google, specifically so that running the analysis does not tell any third party that you are doing it.

One thing we do keep, on your device: a small cropped cut-out of your face, stored in your browser’s session storage. This exists so your report can still show your face after you come back from the payment page. It is erased the moment you close the tab, and it is never transmitted either. The original full photo is discarded as soon as it has been measured.

If you would rather nothing at all were kept, skip the photo step, the questionnaire alone still produces a result.

Your quiz answers are stored in your own browser’s local storage so that a refresh does not lose your progress. They stay on your device. Clearing your browser data removes them. The one exception is your guess at your own season, which joins the anonymous tally described below.

Payment is handled by Creem, our merchant of record, on Creem’s own checkout page. Your card details never touch this site. We receive a confirmation that a payment succeeded and the season slug attached to it, no name, no address and no card data are stored by us. Creem’s own privacy terms cover what they hold.

No advertising pixels, no cookies and no cross-site tracking. We use two counters, and both are cookieless. Cloudflare Web Analytics records that a page was viewed, roughly where in the world from, and how fast it loaded. PostHog, a product-analytics tool, records the anonymous steps of the free analysis, that a visitor started it, reached the photo step, finished, or opened the report, and, across the site, which pages get opened and for how long, so we can see where people give up and what they read. PostHog also captures anonymous recordings of on-page interaction, where people click and how far they scroll. Every image, canvas and video is blanked in your browser before anything is sent, so a recording never contains your photo, your face cut-out or the draping view. The text of the page is recorded, and all of it is ours: you tap answers and add a photo, and the one place you can type is the optional note described below, which your browser hides before a recording leaves it. That means a recording can show which season a report displayed, tied to an anonymous tab id and nothing else. Neither counter sets a cookie, and neither can follow you to any other website.

To be precise rather than claim more than is true: PostHog is a real second company, and we would rather name it than pretend the page-view counter is the whole story. We run it in its most private setting. It stores no cookie; the anonymous id it uses to join your own steps together lives in your browser tab and is erased the moment you close it, the same rule that governs your face cut-out above. It builds no profile of you, and every request it makes is routed through this site’s own domain, so your browser never contacts a PostHog server directly. That first-party routing is the same reasoning that makes us host the face-detection model ourselves instead of loading it from Google.

Your photo and your measurements are never in any of this. No analytics event carries your answers, your season, your axis readings or your photo as data. The one place a result is counted is the anonymous tally below, which is kept apart from these counters and carries no id that could join it to them. What either counter learns is anonymous and impersonal, that a step happened, which page was open and for how long. There is one exception, and it is yours to make: if you close the upgrade pop-up and choose to write a line in the optional box instead of tapping one of the ready answers, that line is sent with that one event, up to 140 characters, and nothing else you ever type on this site is sent anywhere. A recording is the one place a season name can appear, as the text of the page a visitor was looking at, with every image removed and no way to connect it to a person. We can see how many people completed the analysis. We cannot see who any of them are.

When your first photo has been read, your browser sends us one short line, so we can publish honest numbers about which seasons people get and how often they guess their own. It holds exactly these things and nothing else: the day (never the time), your country as our hosting provider Cloudflare reports it, the season the photo was read as, the runner-up, how clear the result was (clear, good or borderline), which reference we used to correct the light (the whites of your eyes, a bright highlight, or none), and your own season guess if you made one.

It holds nothing that points back to you. No photo, no measurement, no colour, no IP address, no device details, no account and no id of any kind, so a line cannot be connected to a person, to a visit or to any other line. When we publish figures from it, we leave out any country with too few results to stay anonymous.