Privacy

The short version

A portrait you open is decoded by the browser into memory belonging to this tab. Every operation — the mask, the frequency split, the heal, the red-eye pass, the export — reads and writes that memory and nothing else. Closing the tab ends it. There is no account, no upload, no history and no server-side component of this site whatsoever.

What happens to a file you open

The file is handed to the browser’s own decoder. Two reduced copies are made — one at 2560 pixels on the long edge for the screen, one at 820 for the frame budget during a slider drag — and both live in the worker that does the arithmetic. Your settings are kept as a short list of typed edits in fractions of the frame rather than pixel counts; the export re-runs that same list against the full-size pixels. None of it is written to disk, to local storage, to IndexedDB or to a cache, and none of it survives a reload.

The mask the layers run inside is geometry plus two colour statistics sampled from the region you placed. It is a single-channel array of bytes at working resolution, it is rebuilt whenever a control moves, and it is thrown away with everything else.

The face specifically

This is the part worth being exact about, because the concern a person actually has when a page offers to work on their face is not whether a JPEG travels somewhere. It is whether the face becomes a record.

No face embedding is computed, stored or compared against anything. No template, no descriptor vector, no hash of a face, no similarity search, no identity, no age or demographic estimate, no expression or attribute scoring. Nothing about the person in the photograph is derived, and nothing is retained to derive it from later. The landmark path this site is built around would place points on a face and would do so in the same tab, on the same processor, discarded the same way — and in this release it does not run at all, because the model files are not part of the build.

What is measured, which today is nothing

No measurement runs on these pages. The build reserves a cookie-free, single-domain analytics property and the token for it has never been filled in, so the tag that would load the beacon renders as nothing at all and not one visit is recorded — not here, not by a third party, not in aggregate. Read the source of this page and look for a script from another origin; there is none to find.

If that property is ever configured, this paragraph is rewritten the same day. What such a beacon would see is the address requested, a coarse region derived from the connection and the browser family — and never a file name, a file size, a setting, an image, or the fact that you opened one, because none of that is available to it and none of it leaves this tab in the first place.

Advertising

Google AdSense is what this site is built to be funded by, and advertising is not yet enabled here: the domain is still in review, the switch that turns the placements on sits at off in the source, and every one of them renders nothing — no frame, no script, no reserved band. No advertising network has yet received a request from this page.

Once the domain is approved that switch goes on and the placements resume exactly where they were drawn: two on each tool route, below the reading and never between the rail and the portrait; two on each essay, at its midpoint and above the footer. From that day Google and the buyers it sells to set their own identifiers and form their own picture of your browsing, governed by their policies rather than by this page. What they will not receive from here is anything about your photograph — not a file name, not its dimensions, not a setting, not even the fact that one was opened — because this site never holds any of it to pass on.

Three advertiser categories are named in the source for blocking on this domain and nowhere else in this group: cosmetic surgery, skin lightening and body contouring. That exclusion is an account setting, so it cannot be in force before there is an account; it is written down where it can be checked against the configuration on the day one exists. Any of the three running beside a tool that argues against altering whose face is in the frame would contradict the tool.

Hosting, and what a host can see

The site is a set of static files on a content network. Serving them means the host observes the ordinary facts of an HTTP request: an IP address, a timestamp, a requested path. That is unavoidable for anything reachable over the internet, it applies to the HTML and the fonts rather than to your picture, and it is the full extent of what leaving this page in a browser tab involves.

The HEIC decoder is the one thing fetched on demand, the first time a file in that format appears. What crosses the network is the decoder itself, in one direction, to you.

Children, and why the caps are not conditional

This site cannot tell how old anyone in a photograph is and does not attempt to. That is the reason the ceilings on every control are fixed rather than adjustable per subject: a tool that cannot know who is in the frame has no business offering a setting that would be wrong for some of them.

Changes, and how to check

If this policy changes, the page changes; there is no mailing list to be told on. The claim that matters can be checked without trusting the prose — open your browser’s network panel, retouch a portrait and export it, and count the requests. Apart from this page, its stylesheet, its scripts and its two typefaces — every one of them served from this domain — and the HEIC decoder if you opened a file in that format, there are none. Neither a beacon nor an advertising frame is among them today.