Handing a clear photo of your face to a website gives most people pause — and that instinct is entirely sound. So the conclusion comes first: in this product, your photo never leaves your device. The analysis does not ship your photo to a server; it ships the algorithm to your browser. That is not marketing language — it is a technical fact you can verify with your own hands in two minutes.
The principle: the model runs inside your browser
A modern browser stopped being a mere window onto pages long ago; it carries the machinery for serious local computation. When the analysis page opens, it downloads a compact face-landmark model into your browser, and from then on all the work — detecting the face, pinning hundreds of landmark points, converting them into the Three Courts, Five Eyes and other ratios — happens locally on your phone or computer. The photo exists as pixels only in your device's memory, is used for the computation, and is discarded; it is never written to any server.
What actually travels? A small parcel of coordinate data: the landmark positions as numbers, the ratios derived from them, plus whatever optional context you chose to provide (an age range, say). The server uses that parcel to match the rule library and compose your reading. Coordinates are abstract geometry — they contain not one pixel of the image. The server never sees your face at any point.
Sceptical? Verify it in two minutes
- Open the analysis page in a desktop browser, press F12 for developer tools, and switch to the Network tab.
- Upload a photo and run one full analysis while watching every request that passes.
- Inspect the request bodies: you will find model files coming down and small JSON parcels going up — and no image upload anywhere. A photo weighs megabytes; a coordinate JSON weighs kilobytes. The difference is visible at a glance.
Worth adding: the share card on the report page is also rendered locally, on a canvas in your browser — producing a picture of your reading requires no photo to travel either.
Why we insist on this architecture
First, the nature of the data: a face photo is highly sensitive biometric material, and the strongest protection is not 'storing it carefully' but 'never collecting it at all'. What a server does not hold can never leak, never be misused, never be cracked open. Second, it happens to be better engineering: local computation removes the upload wait, and on weak connections the flow is actually faster. Third, it turns a privacy promise into privacy architecture — 'no upload' is not a clause that could be quietly amended someday; it is how the product physically works.
One honest boundary to close on: coordinate data is not a photo, yet we treat it to the sensitive-data standard anyway — encrypted in transit, deletable after use, with a deletion entry point on the privacy page. Collect as little as the technology allows, and hand the right of erasure back to you: those two together are the full meaning of 'your photo never leaves the browser'.