Privacy policy

Who is responsible

R&R Profile is run by Rudis Kozulins, Slokas iela 130D, Latvia, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). In this policy, “we” means the operator.

Contact for anything in this policy, including privacy requests and reports of underage accounts: info@facelet.org.

The short version

• Your photos are analysed on your device. They are never uploaded or stored by us, and neither are the positions of the points found on your face.
• To start a scan you need an account. We store your email address, how you sign in, the handle and display name you choose, and when you confirmed your age and accepted this policy.
• If you press Save to history, we store that scan’s scores and its measurement values. Nothing is shared until you choose to share it with a friend you accepted.
• You can download all your data and delete your account at any time from your account page.
• You must be 16 or older to have an account.

Your photos and the points on your face

Both analyses run in your browser. The photo you choose, and the landmark points found or placed on it, stay on your device. They are not sent to us or to anyone else, and they are not stored in your account. The side-profile analysis can keep the point positions of an analysis you save in your own browser (see “What stays in your browser” below); those are never uploaded either.

What we store about you

Your account data is stored by our database provider, Supabase (see “Who processes your data”).

• Your sign-in account (kept by Supabase Auth): your email address and whether it is confirmed; a one-way hash of your password, if you set one; when the account was created and when you last signed in; your active sign-in sessions, each with the browser’s user-agent string and IP address; and a log of sign-in events (such as signing in, signing out and password changes), with IP addresses.
• If you use Continue with Google: Google tells Supabase your email address, a Google account identifier, and the name and profile-picture link on your Google account. Supabase Auth keeps these with your sign-in account. We never copy them into your profile and never show them to anyone, including your friends.
• Your profile: the handle and display name you choose; when you confirmed you are 16 or older, and the minimum age at that time; when you accepted this policy, and which version.
• Scans you save to your history (only when you press Save to history): the date and time; front or side; the overall score, or none if too little was measured; for the front, the points, the range of points possible and how much of the face was measured; the norms used (male, female or neutral) and, for the side, the population norms; the scoring version; short photo-quality notes (for example “head angle: warning”, or that the photo was cropped); and, for each measurement, its value, unit, tier, and points (front) or rating (side), or that it was not measured. Also a reference to the result in your browser, so the same result is not saved twice. Never a photo, an image, or a point position.
• Friends: who you are friends with, pending requests, who you blocked, when each happened, and what you share with each friend.
• Records that keep the service safe: each friend request you send (the handle as you typed it and the time), so we can show your sent requests and limit how many you send; and the time of each attempt to finish setting up your account, to limit guessing which handles exist.

We do not use analytics, advertising or tracking tools, and we do not send marketing email.

Why we use it, and on what legal basis

• To provide what you ask for: your account, your saved history and the friends feature. The legal basis is performing our agreement with you (GDPR Article 6(1)(b)). Without an email address and a handle we cannot give you an account.
• To keep the service secure and prevent abuse: sign-in logs, rate limits and request records. The legal basis is our legitimate interest in a safe service that cannot be used to find out who has an account (Article 6(1)(f)).
• To show we asked for and received your confirmation of age and your acceptance of this policy. The legal basis is our legitimate interest in being able to show that we follow the law (Article 6(1)(f)).

Facial measurements. A saved scan’s measurement values describe the proportions of a face. We do not use them to identify anyone, and we hold no photo, image or point position to compare them with, so we do not treat them as biometric data used for identification (GDPR Article 9). They are stored only when you press Save to history, and you can delete them at any time.

The scores are calculated automatically, but no decision with legal or similarly significant effects is made about you from them.

Who can see your data

Only you, unless you choose to share. There are no public profiles, and there is no way to search for, browse or count users. Friends add each other by exact handle.

• Someone who sends you a request sees nothing about you. You see only their handle until you accept.
• An accepted friend sees your handle and display name, when you became friends, and what you share with them. Nothing else, until you choose a sharing level for that friend.
• Sharing is per friend and starts at None. You can change it, or stop sharing with everyone, at any time; the change applies to the friend’s very next request. Removing a friend, or blocking someone, stops sharing both ways at once.

Exactly what a friend can read at each level. Friends never read your saved scans directly: the database gives them only these fields, through one function, and only at the level you chose.

At no level does a friend see your email address, how you sign in, anything from your Google account, your consent records, your other friends, or anything that stays in your browser. Nor, from your saved scans, your account id, the reference to the result in your browser, the build commit stored with the scoring version, or the internal flags confirming standard scoring ranges and whether a score could be given.

People who run the service can access the database to operate and support it (for example to act on a report of an underage account). Supabase, as our processor, may access it only as needed to provide its service.

Who processes your data

• Supabase (Supabase, Inc.) hosts our database, sign-in and the account-deletion function. Our project is in Supabase’s eu-west-2 region, which is in London, United Kingdom. Supabase acts as our data processor, under its data processing agreement, and uses its own sub-processors (such as Amazon Web Services, which runs the London region).
• Cloudflare (Cloudflare, Inc.) serves the site’s pages. Like any web host it processes your IP address and the details of each request, to deliver the pages and protect the site from attacks. It sees no account data and no photo.
• Google is used only as a sign-in provider, and only if you choose Continue with Google. You sign in on Google’s own pages; Google’s privacy policy applies there, and Google decides how it uses the data it holds about you. We receive the details listed above and nothing else (only the “openid”, “email” and “profile” permissions are requested).

Outside the EU. Your account data is stored in the United Kingdom, which the European Commission recognises as giving adequate protection. Supabase and Cloudflare are United States companies, and their staff or sub-processors may access data from outside the UK and the EU, for example for support or security. Those transfers are covered by the safeguards in their data processing agreements, such as the European Commission’s standard contractual clauses. Write to the contact address for a copy of the safeguards.

Other requests the site makes

Like any web request, these reveal your IP address and browser details to the service contacted. No photo is sent.

• Supabase (our project’s address on supabase.co): when you sign in, and when site pages load or save your account data.
• Google (accounts.google.com): only when you choose Continue with Google, as a page you visit.
• jsDelivr (cdn.jsdelivr.net) and Google Cloud Storage (storage.googleapis.com): when the front-profile analysis opens, it downloads its face-detection program and models from these two services. The side-profile analysis loads its own from this site.

The site’s fonts and everything else come from this site itself. The site sets no cookies.

What stays in your browser

The site keeps some things in your browser’s storage on this device. We cannot see them. They stay until you sign out (where noted) or clear your browser’s data.

• Your sign-in session (rr-auth, and during sign-in a temporary code): keeps you signed in on this browser. Removed when you sign out.
• Account markers (rr-account-ready, rr-account-user): which account is signed in here, so the analyses can check you are signed in without contacting us, and so a different person signing in on a shared browser does not inherit the previous person’s scan.
• The scan hand-off (fm-results, rr-site-session-start, rr-site-session-plan): the front analysis’s saved results (scores and measurement values) and the scan in progress, so the results page can show and save them. Removed when you sign out or another account signs in.
• The side analysis’s own history (rr-history): analyses you saved in the side app, with their point positions, settings and scores, so you can reopen and compare them. These never leave your browser and stay after you sign out, until you delete them in the side app or clear your browser’s data.
• Short-lived navigation (in this tab only: where to return after signing in, and a scan you tapped before signing in, for up to 30 minutes).
• Display preferences: light or dark theme, and how each analysis shows its guides (rr-theme, rr-ref, rr-follow, rr-cmp, rr-cmp-hl, rr-front-ref, rr-front-labels, rr-front-follow).

How long we keep it, and deleting it

• Your account, profile, saved scans, friends and sharing settings: until you delete them. You can delete any saved scan from your history. Delete my account and all my data (on your account page, or while you finish setting up) deletes your sign-in account and, with it, your profile, saved scans and measurements, friendships, sharing settings and request records, immediately.
• Friend request records: deleted once they are more than 30 days old, by a clean-up that runs once a day (so a record can last up to a day longer), and all of them at once when you delete your account. Until then they are shown in your sent requests and counted towards the limits.
• Records of attempts to finish setting up your account (times only): deleted once they are more than 30 days old, by the same daily clean-up, and all of them at once when you delete your account.
• Sign-in sessions: until you sign out or they expire.
• Sign-in event logs and request logs kept by Supabase (which can include your IP address and email address): up to 7 days. They may remain for that time after you delete your account.
• Cloudflare’s request logs (IP address and request details): kept by Cloudflare for a short time for security and operation, under its own retention periods.
• Backups: any backup Supabase keeps of our database is kept for at most 7 days, so data you delete can remain in one for up to 7 days. Backups are used only to recover from a failure; if one is ever restored, we delete again anything that had already been deleted.

Getting a copy of your data

Export my data on your account page downloads, as a JSON file: your account details (email, sign-in methods, the details your sign-in providers gave us, creation and last sign-in times), your profile, every saved scan with its measurements, your friends, your sharing settings, and your sent, received and blocked requests. For anything not in the file, such as sign-in logs, write to the contact address above.

Age

You must be 16 or older to create an account; you confirm this when you finish setting up. Because some users may be minors, the safest settings apply to everyone: nothing is shared by default, there are no public profiles or user search, and no data from your Google account is shown.

Reporting an underage account: if you believe an account belongs to someone under 16, write to info@facelet.org with the account’s handle. We will look into it and, if the account appears to belong to someone under 16, delete it and all its data, and tell you we have acted. We do not ask you for more than the handle.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (Export my data does this for what we hold);
• correct it (your display name, on the account page; write to us for anything else);
• delete it (Delete my account and all my data does this);
• take it with you in a machine-readable form (the export is a JSON file);
• restrict how we use it, and object to uses based on our legitimate interests.

For anything you cannot do on the account page, write to info@facelet.org from the email address of your account. We answer within one month. We may ask you to confirm the request from that address, so that nobody else can make it for you.

You can complain to a data protection authority: in Latvia, the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv), or the authority in the country where you live or work. We would like the chance to sort it out first, so please write to us too.

How your data is protected

Every connection to the site and to the database is encrypted. The database lets each account read only its own data, and a friend only what you chose to share, and nothing about you can be read without signing in. Passwords are stored only as one-way hashes.

Changes to this policy

If this policy changes in a way that matters, we will ask you to read and accept the new version the next time you use your account, before you can start or save a scan.

Not a medical service

The scores describe facial proportions against reference values, for education and aesthetic reference only. They are not a medical assessment.