Privacy Policy

Last updated 9 October 2026

Who is responsible

Face Card AI (“we”) is responsible for your personal data in Face Card. Write to [email protected] about anything on this page.

Your photos (photo policy)

• On arrival, the photo is resized and its metadata, including any location, is stripped.
• To paint it, our server finds points on your face (a map of where your eyes, lips and cheeks are, sometimes called face geometry), estimates your skin tone and face shape, and paints the look.
• To finish the look, a crop of your face with the look painted on may be sent to our GPU provider, Modal, where our own makeup model makes the makeup look real. Modal keeps nothing: the picture is deleted there as soon as the finished image comes back, usually within a minute.
• The photo is deleted as soon as the render finishes, successful or not, usually within seconds.
• The painted image, the face map and the tone and shape estimates are kept for up to one hour so the app can download them, and are then deleted. The app keeps its own copy on your phone; the web try-on keeps its copy only in your browser.
• We do not use your photo or face map to identify you, we do not compare it with other faces, and we do not use it to train any model. Photos are never included in our backups.

Some places, including Illinois, Texas and Washington, treat face geometry as biometric data. The app asks for your consent before your first photo, and the periods above are our retention schedule for it.

The waitlist

When you join the waitlist we keep your email address, where you signed up, your browser language, the time, and a one-way hash of your IP address (to stop abuse). We use it only to send you one email when your invite is ready, based on your consent. We delete it 12 months after launch, or sooner if you ask.

Your account

The app creates a random account ID when you first open it. If you sign in, we also keep the identifier your provider gives us (Apple or Google) and your email address, which with Apple can be a private relay address. We use these to run the service and keep your looks across devices. You can delete your account in the app at any time; everything tied to it is deleted.

App events and error reports

So we can keep the app working and see which features are used, the app sends us a short note when a few things happen: it opens, you finish setting up, you share a look, snap a practice photo or turn on a reminder, and when something goes wrong (the error message and the screen it happened on). Each note carries your account ID and the app version, never a photo, your face map or your location. We use them only to run and fix the app, never for advertising, and keep them for up to 400 days. Deleting your account deletes them.

Payments

Web payments are handled by Paddle, our reseller and Merchant of Record. Paddle collects your payment details under its own privacy policy; we never see your card. We receive your plan, its status and renewal date, your country and the email you used at checkout. Purchases in the iOS app are handled by Apple in the same way.

Technical data

Our servers keep access logs (IP address, time, page requested, browser) for 7 days, for security. Rate limits use one-way hashes of IP addresses, kept for 2 days. A record of each render (which look, when, how long it took, whether it worked, which version of our photo consent you agreed to, but no images) is kept for 30 days.

Cookies and storage

This website sets no analytics or advertising cookies. Links in our social posts carry a short code naming the post (for example ?src=p-0927a). While you are on the page, it reports that code with each step you take (arriving, opening the try-on, sending a photo, the look being painted, joining the waitlist), together with a random number made for that visit, so we can count which posts bring people who try it on. Nothing is stored on your device for this. Each step record holds only the code, the step, the time and that random number, and is kept for 400 days; it is never stored with your email address. The record of a try-on (kept 30 days, as above) also notes the code. Cloudflare, which protects the site, may set a strictly necessary security cookie. The app keeps your sign-in tokens in your phone’s secure storage; on the web, this browser keeps them in its own storage, together with your photo and your painted look until you delete them (Your photo, under your painted look on the home page).

Who processes data for us

We do not sell personal data and we have no advertising partners. Where data leaves the EU, we rely on the providers’ standard contractual clauses.

Your rights

You can ask for a copy of your data, correct it, delete it, take it elsewhere, object to how we use it, or withdraw consent at any time, by writing to [email protected]. We answer within 30 days. You can also complain to the data protection authority where you live.

Children

Face Card is not meant for anyone under 16, and we do not knowingly collect their data.

Security

Data travels encrypted (HTTPS). Our servers are reachable only through Cloudflare, sign-in tokens are signed with keys that never leave the server, and access is limited to the operator.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it applies.