Short version
Free: no account and no photo upload. Full Report: Google account, sufficient wallet credits, explicit cloud-processing consent, transient photo processing, and saved report text without the photo.
Free analysis: local data flow
- You choose a JPG, PNG, WebP, HEIC or HEIF image — or, on the two multi-photo tools, two or three of them. HEIC/HEIF files are converted to JPEG locally in your browser before analysis.
- The browser decodes it into an in-memory canvas and loads the site-hosted MediaPipe runtime and Face Landmarker model.
- Face detection, landmarks, image-quality checks, geometry calculations and result rendering run on your device.
- On the multi-photo tools, every image is measured in turn on the same device; nothing is uploaded to compare them.
- The images and full result remain in the tab until you reset, reload or close it. A file is created only when you choose download.
The free analyzer does not call a photo-analysis API. Loading the model and WebAssembly files is an ordinary static-asset request and does not transmit the selected photo.
Credit-powered Full Report: cloud data flow
- Access: Google sign-in creates an account session. Stripe’s signed webhook—not the success page—adds the purchased credit pack to the wallet.
- Local preflight: the browser checks face count, pose, light and clarity before any photo transmission.
- Consent: you confirm adulthood, photo rights and named cloud processing.
- Transient processing: the resized image goes over HTTPS to our Worker, then through OpenRouter to the configured eligible model endpoint.
- Saved output: D1 stores the returned report JSON, version, model identifier and timestamps. The original and resized photo are not written to D1, R2 or another application store.
“No application photo storage” does not mean “no third-party processing.” Network and model providers handle the paid photo long enough to complete the requested report under their policies.
Processors and purpose
| Party | Data handled | Purpose | Boundary |
|---|---|---|---|
| Your browser | Selected image, landmarks, local results | Run every free tool and paid preflight | Free photo stays here. |
| Cloudflare | Network metadata; paid account, billing IDs, report JSON and transient paid photo | Site delivery, Worker execution and D1 storage | Application code does not persist the photo. |
| Google OAuth | Basic profile, verified email and OAuth exchange data | Optional account sign-in | No Drive, Contacts or Gmail scopes requested. |
| Stripe | Checkout, payment method, billing and transaction data | Hosted payment and signed payment events | Our application does not receive full card details. |
| OpenRouter | Paid prompt, resized photo, response and request metadata | Route the Full Report request | Requests require zero-data-retention and deny data collection. |
| Configured model provider | Paid prompt and resized photo | Return structured report data | Only an eligible privacy-filtered endpoint is requested. |
Current provider documents remain authoritative: OpenRouter zero-data-retention routing, Stripe security, and Cloudflare privacy.
What the application stores
- Free use: no application photo or result record.
- Account: Google profile name, verified email, optional avatar, linked-provider record and seven-day session records. OAuth tokens are encrypted before database storage.
- Billing: Stripe Checkout and Payment Intent identifiers, amount, currency, product and payment status. Full card details stay with Stripe.
- Credit wallet: current balance and an append-only ledger for top-ups, report spending, automatic returns and refund adjustments.
- Full Report: scores, observations, recommendations, version, provider model identifier and timestamps. No photo.
- Consent and webhook records: versioned confirmation events and bounded Stripe event-processing records for audit and idempotency.
Account and saved report data remain until the user deletes the account or asks us to act, subject to legal retention requirements. Pseudonymous payment records may need longer retention for tax, accounting, fraud prevention, disputes or law. Provider-side retention follows each provider’s policy.
Security controls
- same-origin checks for browser mutation requests;
- bounded JSON and image payloads with limited MIME types;
- Google OAuth through Better Auth with signed, secure cookies and server-side sessions;
- encrypted OAuth tokens in D1;
- Stripe-hosted Checkout and raw-body webhook signature verification;
- idempotent payment fulfillment and atomic credit debit/return records;
- secrets in Worker secret bindings, never browser code or versioned configuration;
Cache-Control: no-storeon account, billing and report API responses.
Your controls
- Use every free tool without creating an account or transmitting a photo.
- Do not purchase or submit a Full Report if you do not want the named processors to handle the image.
- Decline optional analytics.
- Delete local free results immediately in the tab.
- Delete your account and saved report text from the Account page, subject to billing-record limits.
- Contact contact@airateface.com about a privacy concern.