Privacy Policy
Last updated: February 1, 2026
1. What We Collect
Biometric Data
When you upload a photo, Pheno processes facial geometry data including facial landmarks (68 points), facial proportions, symmetry measurements, and other geometric features. This data is classified as biometric information under BIPA (Illinois), CCPA (California), and PIPEDA (Canada).
This biometric data is used to generate your analysis report. We do not share biometric data with third parties. You may request deletion of your data at any time.
Analysis Results
Numerical scores, grades, and textual analysis results are retained for 24 hours for free-tier scans and indefinitely for paid scans, until you request deletion. Results include facial landmark coordinates, which are biometric data. Your uploaded photo is retained separately — see Image Handling below.
Account Data
If you create an account: email address, hashed password, date of birth (for age verification), and jurisdiction (auto-detected from IP, overridable).
Payment Data
Payment processing is handled by Stripe and PayPal. We do not store credit card numbers. We retain transaction IDs and amounts for accounting purposes.
2. How We Use Your Data
- Generate facial analysis reports (sole purpose of biometric processing)
- Process payments
- Provide analysis history and progress tracking
- Comply with legal obligations
We do not sell, lease, trade, or profit from your biometric data.
3. Image Handling
We retain the photos you upload. When you submit a photo, we store a resized copy of it (maximum 1600 pixels on the long edge) on our servers. This copy is kept indefinitely until you request deletion.
Retained photos are accessible only to Pheno’s operator, through an authenticated administrative interface. They are used to review and improve the accuracy of the analysis system, and to investigate reported problems with a scan. They are never shown to other users, never published, never used for advertising, and never sold or shared with third parties.
A separate working copy of your upload is held for up to 8 hours while your scan is processed and retried if necessary, then deleted. A small preview thumbnail is also retained alongside your result.
You can have every photo of yours erased at any time, for any reason, by emailing phenoface@proton.me from the address you used, or by including the ID of any scan. We will delete the retained photos, the preview thumbnails, and the analysis results, and confirm when it is done.
4. Data Retention
| Data Type | Retention Period |
|---|---|
| Uploaded photos (resized copy) | Until you request deletion — admin access only |
| Working copy used for processing | Up to 8 hours, then deleted |
| Preview thumbnail | Until you request deletion |
| Analysis results | 24 hours (free tier) / until you request deletion (paid) |
| Consent records | 3 years (legal requirement) |
| Payment records | 7 years (accounting requirement) |
| Deletion audit logs | 3 years (compliance) |
5. Your Rights
Depending on your jurisdiction, you have the right to:
- Access: Request a copy of your data
- Deletion: Request deletion of all your data
- Portability: Export your analysis results
- Withdraw consent: Revoke consent at any time
- Opt-out of sale: We do not sell data, but you may exercise this right
To exercise these rights, contact: phenoface@proton.me
6. Security
We implement industry-standard security measures including HTTPS encryption, secure server infrastructure, access controls, and regular security audits.
7. Service Providers
These providers process data on our behalf, under contract, solely to operate Pheno:
- Replicate: Runs the analysis model. Your photo is sent here to be scored, and is not retained by them after processing.
- Railway: Database and storage hosting (this is where retained photos and results live)
- Fly.io: API hosting
- Vercel: Website hosting
- Stripe: Payment processing (PCI DSS compliant)
- PayPal: Payment processing
We do not sell, lease, trade, or otherwise disclose your photos or biometric data to anyone outside this list.
8. Children
Pheno is not intended for use by anyone under 18 years of age. We do not knowingly collect data from minors. If we discover data from a minor has been collected, it will be immediately deleted.
9. Contact
Privacy inquiries: phenoface@proton.me