Privacy Policy

Who we are

My Face Notes is operated by TangChaoDi, an individual based in China. This policy explains how we handle information when you use myfacenotes.com. For privacy questions or requests, contact support@myfacenotes.com.

The service helps adults explore visible facial features and personal style. You can run local photo measurements without an account. Sending data for AI analysis is a separate, optional choice. Our Terms of Service explain the service and its limitations.

Photos and local measurements

You must be 18 or older. Use your own adult photo or a photo of another adult who has given permission for this analysis and any sharing you request. Do not submit children's photos or photos you are not authorized to use.

When you choose a photo, your browser prepares a copy, limits its dimensions and removes original file metadata by decoding and re-encoding the image. Face landmarks and six measurements are calculated on your device. Choosing a photo and running this local measurement step do not send the photo or landmarks to our server or an AI provider.

Facial photos, landmarks and measurements are personal information and can be sensitive. We use them to describe visible proportions and offer personal-style suggestions. We do not use this analysis to establish or verify identity, match people against an identity database, or determine health, personality or protected characteristics.

Optional AI analysis and third-party processing

The report page identifies the configured AI provider. The current version uses Kie at api.kie.ai. Only after you separately consent and actively request AI analysis does your browser send the prepared photo, face landmarks, image dimensions and report language to our server.

Our server recalculates the measurements from the landmarks. It sends Kie the prepared photo and its dimensions, six measurement values and their definitions, an approximate face-shape label and the requested language. It does not send Kie the complete landmark array. Kie and the model services it uses process this information to generate the analysis.

Third-party processing is governed by those providers' own terms and privacy practices, including their retention and model-training practices. We do not promise that they delete data immediately or that they never use data for training. Our app's storage limits below do not describe those providers' storage.

You can use and export local measurements without requesting AI analysis. You can withdraw your choice before a further AI request. Withdrawal stops future requests that require your consent; it cannot recall data already sent or delete copies held by a provider.

In-app reports and PDF copies

Analysis photos and measurement arrays stay in the current browser tab's memory, except during the AI transmission described above. We do not persist those photos or arrays in our application database, server files, localStorage or sessionStorage. Refreshing or closing the tab clears that local session. Checkout opens in another tab so the original report page can keep its photo.

For paid reports, we store an account-linked purchase record and a SHA-256 digest of the prepared report inputs to bind payment to that particular report and prevent duplicate purchases. This digest is not a facial recognition template, but it remains associated with your account. Successful AI analysis text, including any measurement references in that text, is encrypted in our application database and available for recovery for 30 days after generation. After that period, access is blocked and the encrypted payload is removed when that purchase is next accessed; it may remain stored until that cleanup occurs. We do not promise deletion exactly at the 30-day boundary. Recovering a complete photo-containing PDF still requires the original local photo and measurements.

PDF export runs in your browser. The PDF contains the photo, measurement data and any completed AI analysis available when you export it. It is a file saved on your device; the app does not send it to a PDF service or email it to you. You control its storage and sharing. Clearing a session or requesting account deletion does not delete a PDF you already downloaded.

The treatment of analysis photos is separate from account avatars, support messages and attachments you choose to provide through other features.

Account and support information

If you create an account, we store information needed to operate it: your name, email address, password hash, optional avatar, account timestamps and login sessions. Session records can include IP address, browser information and expiry time. Registration records can include your IP address, approximate country, language and referral or campaign information.

We use this information for sign-in, account administration, security, support and understanding how users reach and use the service. Optional account avatars are stored as account information and are not treated as temporary analysis photos.

If you contact support by email, we receive your address, message and any attachments you provide. If you use an in-app support ticket, we store its subject, messages, attachment links, account association, replies and timestamps. We use these records to investigate and respond to your request. Please send only information relevant to the issue; do not send passwords or payment-card details, and avoid attaching a face photo or report unless needed.

When production checkout is enabled, Waffo Pancake provides the hosted payment page. We send the product, price, account email and an internal order reference to Waffo. We do not send it your analysis photo, facial measurements or AI report. Waffo collects payment and billing information directly under its own policies. We receive and store payment status, transaction and order identifiers, amount, currency, purchase email, timestamps and refund information to confirm purchases, provide access and handle billing issues. Our application does not receive or store full payment-card numbers or security codes. Test mode is restricted to administrators and does not grant production report access.

Cookies and browser storage

Cookies and browser storage support sign-in, preferences and referral attribution:

• Authentication cookies maintain your login. Login sessions normally have a seven-day lifetime and may renew with use.
• A language cookie remembers your selected language for up to 400 days. Theme preferences can be saved in localStorage. User-center or admin navigation preferences can use localStorage and a seven-day sidebar cookie.
• When a visit includes campaign parameters or an external referring page, first-party cookies remember that initial source for up to 30 days. The source can be associated with your account when you register. These attribution cookies are currently set when that information is present, without a separate cookie-consent prompt.
• Where the cookie-preference feature is enabled, a cookie records your accept or reject choice for up to 365 days. If email verification is enabled, localStorage can hold the last resend time associated with your email to limit repeated requests.

LocalStorage preferences remain until replaced or removed through the app or your browser. You can delete or block cookies and browser storage in browser settings; doing so may sign you out or reset preferences. This does not delete account or support records stored by us.

Google Analytics, Plausible, advertising scripts and third-party live-chat widgets are not currently enabled on the public site. First-party account and referral statistics still exist. We will update this notice if the tools or purposes change.

Hosting, security and technical records

Cloudflare hosts and delivers the website and application database. It processes network requests and technical information, including IP addresses, as needed to provide and protect the service. Our AI endpoint also uses the request IP in memory to enforce a short interval between requests.

Application and hosting logs may record request times, status information and errors for reliability and security. Our AI format-validation diagnostics record fixed error stages and permitted field paths, rather than photos, API keys or full model responses. We do not claim that all technical records are deleted when you close a browser tab.

We use access controls and other reasonable safeguards, but no system or transmission method is completely secure. Keep your account credentials and downloaded reports private.

Sharing and international processing

Information is shared with service providers when needed for hosting, accounts, support or the AI analysis you request. Kie receives the analysis information described above; our hosting and email services process the information needed for their respective functions. We may also disclose information where required by law or necessary to address fraud, abuse, security incidents or legal claims.

We do not sell your personal information or use analysis photos to build advertising profiles. A report is not publicly posted by the analysis flow; you decide whether to share an exported copy.

The operator is based in China. Cloudflare, Kie and their service providers may process information in other countries or regions, whose privacy protections may differ from those where you live. Applicable legal requirements govern international transfers. We do not promise a particular processing location or a safeguard we have not confirmed with a provider.

Retention

Local photo sessions and encrypted AI result recovery follow the periods described above. Purchase records, input digests and payment records are retained for fulfillment, support, fraud prevention, refunds and applicable recordkeeping obligations. Downloaded PDFs remain under your control. Kie and other providers apply their own retention practices to information they receive.

Account records are retained while needed to provide the account and address related security or support matters. Support correspondence and technical records are retained as needed to resolve requests, protect the service and meet applicable legal obligations. We do not currently apply a single fixed automatic deletion period to all account and support records. When a deletion request applies, we review what can be removed and whether any information must be retained for a legal obligation, security issue or dispute.

Your choices and rights

Depending on applicable law, you may have rights to access, correct, receive a copy of or delete your personal information, restrict or object to certain processing, withdraw consent, or raise a concern with a relevant privacy authority.

Email support@myfacenotes.com to make a request. Tell us which account or information it concerns and what you want us to do. We may request proportionate information to verify your identity before disclosing or changing account data. The current account interface does not provide a self-service deletion button.

We will respond according to applicable requirements and explain any limitation on a request. We cannot restore a cleared local photo session or an expired AI result, delete copies you or others downloaded, or directly remove information held independently by an AI provider. We can explain the data-sharing path relevant to your request.

Changes and contact

We will update the date above when this policy changes and make material changes available on the site. Questions about the service or this policy can be sent to support@myfacenotes.com.