Privacy Policy

Written by the operator, not by a lawyer. This policy describes what the service actually does, written from the code rather than from a template, and REKTO DIGITAL LLC has accepted it as it stands — but no qualified lawyer has reviewed it. You are entitled to know that before you upload anything.

Last updated: 14 October 2026. Operator: REKTO DIGITAL LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Contact: privacy@levelprotocol.app.

What is collected

Photographs. Up to seven standardized views that you upload, an optional outfit photograph, and weekly progress photographs if you use check-ins. Location, device and other data embedded in a photo file is removed when it is uploaded. These are the most sensitive data here and are treated as such: they are stored in private object storage, are never given a publicly addressable URL, and are not included in analytics of any kind.

Account details. Your email address and display name, which you give when you create an account; your date of birth, used only to enforce the 18+ requirement; the state or country you say you live in, used only to decide whether photographs may be collected from you at all; locale and timezone. Your password is held by our authentication provider, Supabase, and is never stored or seen by this service.

What you write. Journal entries, organizer items, coach messages, weekly check-in notes and support requests.

What the service produces about you. Analysis findings, preview scenarios, selected recommendations, plan weeks, missions, momentum events, reports and professional cards.

Commercial records. Subscription and entitlement state, notification preferences and delivery records, referral codes and attributions, the creator-link identifier attached to a purchase made through one, and versioned consent records.

What is not collected

There is no advertising cookie, no cross-site identifier, and no profile of people who browse the site without an account. Third-party analytics runs only if you allow it, as described under Google Analytics below. We do count, on our own servers, how many visits reach the home page and how many press its sign-up button. That count uses no cookie and no IP address or device information; the only identifier is a random one held in the page’s memory while it is open, never written to your device, and gone when you leave or reload. The two other exceptions, both about links somebody else shared with you, are described next.

Your photographs, journal text, coach messages and support descriptions are never sent to the analytics provider. Data is not sold, and it is not shared for anyone else’s advertising.

The exceptions: referral and creator links

Following a referral link — an address beginning /r/ — is the single case where something is recorded before you have an account, and it is recorded whether or not you go on to create one.

Two things happen. A first-party cookie named level_referral is set for 30 days so a referral can still be credited if you sign up later; it holds the referral code and nothing else, and it is httpOnly, so page scripts cannot read it. In the European Economic Area, Switzerland and the United Kingdom it is set only if you have agreed to referral cookies, and nowhere if you have turned them off under Cookie choices below; without it, the referral is simply not credited. And one row records that the link was followed: the code, the landing path, the date, and an identifier derived by hashing that date together with your IP address and browser user-agent. The IP address and user-agent themselves are not stored, and the hash changes each day, so it cannot follow you between days or across sites — it exists to stop one person’s repeated clicks counting as many referrals.

Deleting your account removes the referral codes you own and the click records belonging to them. A click recorded when you followed someone else’s link is not attached to your account and does not identify you, so it is not removed with it.

Creator links. Some creators promote LEVEL through Cloutish, a creator marketing platform that pays them a commission on the sales their links bring. A creator link sends you here with an address carrying clt_click_id= and an identifier Cloutish issued for that click. Arriving that way sets a first-party cookie named level_cloutish_click for 30 days; it holds that identifier and nothing else, it is httpOnly, and a later creator link replaces it. Nothing about the visit itself is recorded.

In the European Economic Area, Switzerland and the United Kingdom that cookie is set only if you agree to it. Arriving there through a creator link shows a short notice, “A creator sent you here”, with two choices of equal weight: Allow and No thanks. Until you choose, the identifier stays in the address bar and is not stored; leave without choosing and it is gone. Either answer is kept for 12 months in a second first-party cookie, level_referral_consent, so that you are not asked again on every link. It holds only your answer, the version of the question and the time you gave it, nothing that identifies you, and it is httpOnly. If you said no, later creator links set nothing and do not ask again while that answer is kept.

If you then buy, the identifier is attached to the payment at Stripe, and LEVEL tells Cloutish — from its server, never from your browser — that the click led to a sale: the identifier, a Stripe payment reference, the amount before tax and its currency. If that payment is refunded in full or disputed, Cloutish is told the sale was reversed. Only the first payment is reported, never a renewal. Cloutish is not given your name, your email address, your photographs or anything else about your account; it can connect the sale to the click it recorded when you followed the link, under its own privacy policy, and to nothing held here. The identifier stays on the Stripe payment with the rest of the billing record, for as long as that record is kept.

Google Analytics

The public pages of this site (the home page, guides, pricing and similar) can use Google Analytics 4 to count visits and see which pages help people. It runs only after you press “Allow” on the notice that asks, wherever you are; until then nothing is requested from Google. Once allowed, Google sets first-party cookies named _ga and _ga_… (kept up to two years) and receives the address of the public page you are on, the page that sent you, your browser and device type, and an approximate location Google derives from your IP address. Advertising storage, ad personalisation and Google signals are turned off.

It never runs behind sign-in or on a shared result: your account, photographs, questionnaire answers, analysis, plan and coach messages are never sent to Google Analytics. Your answer is kept in this browser’s storage (level_analytics_consent_v1), and you can change it under Cookie choices below; turning it off removes the _ga cookies from this site.

Cookie choices

Wherever you are, you can withdraw an agreement to the creator-link cookie, or turn it off before one is ever set. Either removes level_cloutish_click from this browser and records the refusal in level_referral_consent, so later creator links neither set it nor ask; a purchase you make afterwards is not credited to a creator. Turning it off also stops the level_referral cookie being set by a /r/ link you follow afterwards. Clearing this site’s cookies in your browser removes all of them, your answer included, so the next creator link would ask again.

Consent

Before any photograph is collected you are asked five things separately, and each answer is recorded with the version of the wording you were shown: that you are at least 18; that you accept the Terms of Service and this policy; visual analysis; private photo processing and storage; and the measurement of your facial geometry, which says what is measured, why, and how long it is kept. Revocations are stored as new records rather than overwriting the original, so the history of what you agreed to remains inspectable. Photograph processing does not begin until the required consents are present, and revoking one stops the processing that depends on it.

Who else processes it

These are the external services the code actually calls, and each is limited to what its function needs:

• OpenAI — analysis, preview generation and coaching. Photographs are sent for this purpose, and so are the questionnaire answers the analysis uses (your goals, style preferences, time, budget, climate, routine, products, sensitivities and preferences), never your location or email address. A category you exclude in the questionnaire is not sent for analysis at all. Under its API terms OpenAI does not train on this data and may keep it for up to 30 days to detect abuse, after which it is deleted.
• Independent identity and segmentation validators, run on Modal — confirm a generated preview is still recognisably you and that edits stayed within their intended region. They receive your photograph and the preview, compute their scores in memory, return the scores and keep nothing.
• Supabase — the database and private file storage that hold your records and photographs, in Paris, and the sign-in service that holds your password.
• Vercel — hosts this website and the servers that run it, in Paris; your requests to the site pass through it.
• Stripe — payments. Card details are handled by Stripe and are never received or stored by this service.
• Cloutish — creator-link commissions. For a purchase made through a creator link, and only then, it receives the click identifier, a payment reference and the amount before tax, as described above.
• Resend — email delivery: the confirmation and password-reset emails every account receives, and reminders when you have enabled them. It receives your email address and the message.
• PostHog — product analytics, restricted to an allow list of funnel events (such as signing up, finishing the photos, viewing results, completing a step) and a few properties (counts, and which product), sent against a pseudonymous identifier with person profiles disabled. The same events are kept first in our own database.
• Google Analytics (Google Ireland Limited, with Google LLC) — visit counts on the public pages, only with your agreement, as described under Google Analytics above. Data may be processed in the United States under Google’s data processing terms and the EU–US Data Privacy Framework.
• Sentry — error monitoring, with request bodies, authentication headers and private media identifiers excluded.

Each remains inactive until its credential is configured. The current live state is published at the machine-readable platform status.

Apart from Google Analytics on the public pages once you allow it, nothing else is contacted by your browser. The guided capture and the weekly check-in measure your face on your own device rather than on a server, and the code and model that do it are served from this site — not from an outside content network, which would otherwise see your IP address at the moment you open the camera. No photograph is uploaded for that step.

Your controls

Export. You can download your data as structured JSON covering every collection listed above, scoped to your account.

Deletion. You can delete your account. This removes your rows across every table that holds them and the private objects behind your media, and it requires an exact confirmation and a matching email address. What remains afterwards is a receipt that records the deletion occurred without naming who requested it.

Notification preferences. Email delivery is off unless you enable it, with quiet days and pause controls.

Limits worth stating

This service is 18+ and is available everywhere except Illinois, China and Russia. The rules covering photographs of a face differ by country and, in some countries, by state. Some places set steps LEVEL has not completed yet — a representative in the European Union and the United Kingdom, an impact assessment, a lawyer’s review in Texas and Washington, a filing in Quebec, an authorisation in Morocco — and LEVEL is working through them; the consent, storage, deletion and no-training commitments on this page apply everywhere in the meantime. Illinois stays closed until LEVEL holds the written release its Biometric Information Privacy Act requires. China and Russia require data about their residents to be stored on their own soil, and LEVEL does not do that, so they will not open. You are asked where you live before any photograph is collected, and if your answer is somewhere that is closed you are told why rather than simply refused. It offers observational presentation guidance. It does not diagnose medical conditions, calculate attractiveness or human worth, or instruct structural change to appearance. Results are withheld rather than published when the underlying evidence is uncertain.

You sign in with an email address and password. Access is only as private as that password, so use one you use nowhere else.

Retention and jurisdiction

Data is kept while your account exists and removed when you delete it. Photographs go sooner if you stop using LEVEL: after twelve months without a capture or a completed mission they are destroyed automatically, and a record is kept that this happened, without keeping what was in them. Deleting your account deletes everything this service holds about you, your consent records and your subscription records included. Payment records are the exception, and they are not held here: Stripe, which processed the payment, keeps its own record of what was bought, when and for how much, for as long as the law requires it to, under its own privacy policy. They contain no photograph and no analysis. The receipt that records a deletion took place is kept indefinitely and names nobody.

Why we are allowed to hold this

Every category above is collected for one of three reasons, and nothing is collected for a reason not listed. Your consent, given separately and recorded with a version, is the basis for processing photographs, for analysis and preview generation, and for email notifications, and in the European Economic Area, Switzerland and the United Kingdom for the creator-link cookie, and everywhere for Google Analytics; you can withdraw any of them and the processing that depends on it stops. Performing the agreement you entered is the basis for your account, your plan, your missions and your billing records — we cannot deliver a subscription without them. A legal obligation is the basis on which Stripe keeps payment records after your account closes, as described above.

Consent here means what it says: it is asked before anything is collected rather than after, it is separate for each purpose rather than bundled into one box, refusing it costs you nothing but the feature it belongs to, and withdrawing it is a control in your account rather than a support request. Withdrawing storage of your photographs deletes them, the previews made from them and the face measurements taken from them; withdrawing facial-geometry measurement deletes the measurements. A consultation brief you share includes an AI preview of you only if you choose to include it.

Where it is, and where it goes

Your records and your photographs are stored in the European Union, in Paris, whichever country you are in. That is a deliberate choice and not an accident of hosting: it is the strictest regime available to us, and holding the data there does not weaken any protection you have where you live.

LEVEL is operated from the United States, so the people who run it access data held in the EU. Our processors are named above; the ones that receive photographs are OpenAI, for analysis and preview generation, and the independent identity and segmentation validators on Modal. Both process in the United States, so a photograph sent to them for that step is transferred there. The validators check that a generated preview is still recognisably you and that edits stayed inside their intended region. That check computes a facial measurement in order to compare two images of you. It produces a similarity score, which we keep; the measurement itself is not stored by us and is not used to identify you anywhere, against any database, or for any purpose other than confirming a preview of you is still you.

What you can require of us

Wherever you live, and whether or not your local law compels us: you can obtain a copy of everything we hold about you, in a structured file you can read; you can have inaccurate records corrected; you can have your account and its contents erased; you can withdraw any consent you gave; and you can object to a use you did not expect. The export and the deletion are controls in your account rather than requests you have to make, and they run immediately.

We do not sell personal information, we do not share it for anyone else’s advertising, and we do not use it to train anyone’s models. If you want to exercise something not covered by the in-product controls, write to privacy@levelprotocol.app and we will answer within thirty days.