What we collect
Photos you upload (processed only to generate your hairstyle previews).
Generated preview images, plus the style/color parameters you chose.
An anonymous session identifier (random token in a cookie) that links your credits and previews. It contains no personal data until you optionally sign in.
If you sign in with Google: your Google account email, name and profile picture.
If you purchase credits: your billing details are processed by Stripe. We never see or store your full card number.
Why we process it
To render hairstyle previews on your photo (the core service you request).
To keep your credit balance and purchase history accurate.
To prevent abuse (rate limiting, blocking non-photo or unsafe uploads).
Face data — the special part
A selfie is biometric-adjacent data and we treat it with extra care: it is used solely for the generation you request, is never used to train models, is never published or shared, and is not combined with other data to identify you.
Depending on your jurisdiction you may have additional statutory rights over biometric data (for example under the Illinois BIPA in the US). We honor deletion requests regardless of where you live.
How long we keep it
Uploaded photos and generated previews: deleted automatically after 30 days.
Signed-in history (if you create an account): kept up to 90 days, deletable any time.
Billing records (order amount, date, Stripe reference): retained as long as tax and accounting law requires, with your identity reference minimized.
You can delete everything yourself right now from the Data Deletion page — no questions asked.
Who we share with
The AI generation provider (your photo is sent to render your preview).
Cloudflare R2 / cloud storage (stores your files, private by default).
Stripe (payments only).
PostHog (anonymous product analytics, only after you consent to analytics cookies).
We never sell your data. Never.
Cookies
Essential: an anonymous session cookie (required for the editor to work) and security cookies. No consent needed.
Analytics: a PostHog cookie, loaded only if you accept analytics in the consent banner.
Your rights
Access, correction, deletion and objection — email us and we act within 30 days.
One-click deletion: the Data Deletion page wipes your photos, previews and session immediately.
Security
All traffic is encrypted (HTTPS). Uploaded photos and results are stored privately and served only to your session. Access inside our systems is limited to the services listed above.
Contact
[email protected] — a human answers.