Privacy Policy

The Face Shape Detector is an independent, free, advertising-supported website providing face and style analysis tools. For the purposes of the UK GDPR and the EU GDPR, the operator of The Face Shape Detector is the data controller for the personal data described here. Privacy questions reach [email protected].

The controller's biggest design decision concerns your photographs.

Photographs stay on the device in your hand. Analysis happens entirely in your browser, and images are never transmitted to, received by, or stored on our servers.

No photo upload endpoint exists anywhere in this system. None was built, none runs privately, and no part of our infrastructure can accept an image from a tool page. Select a photo and your browser decodes it locally, then passes it to the Google MediaPipe Face Landmarker model running as a WebAssembly module inside your own tab. The 468 landmark points and the ratios derived from them are computed in your device's memory and discarded when the page closes.

Four consequences follow directly:

• Nobody here sees your photo, because it never arrives.
• Nobody here can store, share, sell or lose it, because it is never held.
• Nobody here can produce it for a subject access request or a law enforcement demand, because there is nothing to produce.
• No biometric template, faceprint or face embedding is created on, sent to or retained by our servers.

Verify it yourself. Open developer tools, select the Network tab, run any face analysis. Model files download once. No request carries your image.

Quiz and calculator tools work the same way. Color analysis, body shape, body type and Kibbe typing evaluate your answers in browser JavaScript, and those answers reach us nowhere. What we do collect follows.

Collection covers four categories, and only these.

3.1 Contact form submissions

Writing to us means giving a name, email address, subject and message. Those fields are stored in our database so we can reply and keep a record of the exchange.

3.2 Server access logs

Hosting infrastructure records standard web server logs: IP address, timestamp, requested URL, HTTP status, referring URL and user agent string. Serving a page generates them automatically, and they support security, abuse prevention and fault diagnosis.

3.3 Analytics

Google Analytics gives us aggregate usage: which pages get visited, from which countries, on which device types, and how people move through the site. IP address truncation is enabled. The data never builds profiles of identified individuals, and no method exists here for linking a session to a named person.

3.4 Advertising data

Display advertising runs through Google AdSense. Google and its partners set cookies and similar identifiers in your browser and receive technical data about your visit in order to select, deliver, cap the frequency of, and measure ads. Section 6 describes that arrangement.

3.5 What we deliberately do not collect

The public site operates no account system and no login, so it holds no usernames, passwords or profiles. Payment details are never collected, because nothing here is for sale. Nothing asks for or stores your date of birth, gender, postal address or phone number. Photographs, biometric identifiers and quiz answers are never processed on our servers. Data brokers sell us nothing. What remains has a stated purpose and a stated lawful basis.

Purposes and lawful bases pair one to one under the UK and EU GDPR. This table maps them.

Where legitimate interests are the basis, we have weighed our interest in a secure, functioning, funded site against your rights, and limited the data to what that purpose needs. You may object to legitimate interests processing at any time under section 9. Consent, the other basis in that table, is gathered through the cookie mechanism described next.

Cookies here fall into three groups: a few strictly necessary ones for security and for remembering your consent choice; analytics cookies set by Google Analytics; and advertising cookies set by Google AdSense and its partners.

Inside the EEA and UK, non-essential cookies load only after you consent through our banner, and you can change or withdraw that choice at any time via the cookie settings link in the footer. Our cookie policy lists each cookie, its purpose and its duration. Advertising cookies reach furthest, so they get their own section.

Advertising is why The Face Shape Detector costs nothing. We use Google AdSense.

• Google, as a third-party vendor, uses cookies to serve ads here.
• Google's use of advertising cookies, including the DoubleClick DART cookie, enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• You can opt out of personalized advertising by visiting Google Ads Settings at https://adssettings.google.com.
• Google's practices for advertising are described at https://policies.google.com/technologies/ads.
• Broader third-party vendor opt-outs are available at https://optout.aboutads.info and https://www.youronlinechoices.eu.

Third-party advertising vendors and ad networks may also serve ads here. Those cookies sit outside our control, and each vendor's use of your data is governed by its own privacy policy. Google is one of three named third parties receiving anything at all.

Third parties are few. Personal data goes to nobody beyond this list, except where the law requires disclosure or a legal claim must be established, exercised or defended.

None receives a photograph, because none ever reaches our infrastructure. Some process data outside your country.

Transfers happen because our hosting and our processors may store or handle data outside your country, including in the United States. Where personal data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with any applicable adequacy decision, including the EU-US and UK-US Data Privacy Framework where the recipient is certified. Copies of the safeguards are available on request to [email protected], the same address that handles the rights below.

9.1 Under the UK and EU GDPR

Rights you hold: request access to the personal data we keep about you; have inaccurate data rectified; have your data erased; restrict our processing; receive your data in a portable, machine-readable format; object to processing based on legitimate interests, including any profiling; and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Because so little is held, most requests resolve quickly. If you have never written to us, we typically hold nothing capable of identifying you, and we will say so.

9.2 Under the CCPA and CPRA

California residents hold the right to know what personal information we collect, use and disclose; to request deletion of personal information collected from you; to request correction of inaccurate personal information; to opt out of its sale or sharing; and to face no discrimination for exercising any of them. No financial incentive is offered here, so no notice of incentive applies.

9.3 We do not sell your personal information

Personal information has never been sold by us, and none was sold in the preceding 12 months. The personal information of anyone under 16 is never knowingly sold or shared. Advertising cookies served through Google AdSense may constitute "sharing" for cross-context behavioral advertising under the CPRA; opt out using the cookie settings link in our footer and at https://adssettings.google.com.

9.4 How to exercise a right

Email [email protected] with the words "Privacy request" in the subject line and name the right you are exercising. Because no accounts exist, identity is verified by matching the address you write from against the data held; where verification falls short of a reasonable standard we say so rather than release data to the wrong person. Responses go out within one month under the GDPR and within 45 days under the CCPA, extendable once for a complex request, in which case we tell you before the deadline. Nothing is charged unless a request is manifestly unfounded or excessive.

An authorized agent may submit a CCPA request on your behalf with written proof of authorization.

9.5 Complaints

Complaints about our response go to your data protection authority. In the UK that is the Information Commissioner's Office at https://ico.org.uk. In the EEA it is the supervisory authority for your country of residence, your workplace, or the alleged infringement. Age limits apply to the service too.

Children are not the audience for The Face Shape Detector. You must be at least 13 years old to use the site, or at least 16 within the European Economic Area. No personal data is knowingly collected below those ages. If you believe a child has submitted personal data through our contact form, email [email protected] and it will be deleted.

Security starts with HTTPS and TLS across every page. Access to the contact database is restricted to the few people who need it, behind unique credentials and multi-factor authentication. Administrative access sits apart from the public site, which has no login at all. Dependencies get patched on a regular cycle, and admin access is logged.

The strongest control here is architectural: images never arrive, so no breach of our systems can expose one. No system is perfectly secure, and we claim otherwise nowhere. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals where the law requires it. Any material change to these arrangements gets announced in advance.

Changes follow shifts in our practice, our processors or the law. The effective date at the top always reflects the current version. Material revisions, meaning a new data category, a new processor receiving personal data, or a new purpose, are announced with a notice on the site for at least 30 days before they take effect, and where consent is the basis we ask for it again.

Privacy questions, rights requests and complaints go to [email protected]. General messages can use the contact form at https://thefaceshapedetector.net. Accuracy and corrections are covered by our editorial policy.

To recap the practice described here: The Face Shape Detector processes almost no personal data, because the analysis that defines the site runs entirely in your browser. No image is transmitted to, received by, or stored on our servers, and no photo upload endpoint exists. What remains is four categories, contact messages, access logs, Google Analytics measurement and Google AdSense advertising data, each tied to a lawful basis under Article 6 and each held for a stated period: 24 months, 90 days, 14 months, or whatever Google sets.

Cookies need consent across Europe and the UK before any non-essential one loads. Three named third parties receive anything, none of them a photograph. Transfers abroad rely on Standard Contractual Clauses and the UK Addendum. GDPR and CCPA rights are exercisable by email, children under 13 are outside the audience, security is architectural before procedural, and material changes get 30 days of notice.

Rights requests, complaints and privacy questions all reach [email protected].