Privacy Policy

Draft pending legal review. Identifiers in brackets must be completed by the operator before this page is relied upon.

Last updated: [DATE]. Operator: [LEGAL ENTITY], [REGISTERED ADDRESS]. Contact: [PRIVACY CONTACT].

What is collected

Photographs. Up to seven standardized views that you upload, plus weekly progress photographs if you use check-ins. These are the most sensitive data here and are treated as such: they are stored in private object storage, are never given a publicly addressable URL, and are not included in analytics of any kind.

Account details. Your email address and display name, provided by the ChatGPT workspace you sign in through; your date of birth, used only to enforce the 18+ requirement; locale and timezone.

What you write. Journal entries, organizer items, coach messages, weekly check-in notes and support requests.

What the service produces about you. Analysis findings, preview scenarios, selected recommendations, plan weeks, missions, momentum events, reports and professional cards.

Commercial records. Subscription and entitlement state, notification preferences and delivery records, referral codes and attributions, and versioned consent records.

What is not collected

There is no general visitor tracking: no pageview logging, no advertising or third-party analytics cookie, no cross-site identifier, and no profile of people who browse the site without an account.

Your photographs, journal text, coach messages and support descriptions are never sent to the analytics provider. Data is not sold, and it is not shared for anyone else’s advertising.

The one exception: referral links

Following a referral link — an address beginning /r/ — is the single case where something is recorded before you have an account, and it is recorded whether or not you go on to create one.

Two things happen. A first-party cookie named level_referral is set for 30 days so a referral can still be credited if you sign up later; it holds the referral code and nothing else, and it is httpOnly, so page scripts cannot read it. And one row records that the link was followed: the code, the landing path, the date, and an identifier derived by hashing that date together with your IP address and browser user-agent. The IP address and user-agent themselves are not stored, and the hash changes each day, so it cannot follow you between days or across sites — it exists to stop one person’s repeated clicks counting as many referrals.

Deleting your account removes the referral codes you own and the click records belonging to them. A click recorded when you followed someone else’s link is not attached to your account and does not identify you, so it is not removed with it.

Consent

Processing categories are consented to separately and recorded with a version: analysis, media processing, customer API access, and privacy handling. Revocations are stored as new records rather than overwriting the original, so the history of what you agreed to remains inspectable. Photograph processing does not begin until the required consents are present, and revoking one stops the processing that depends on it.

Who else processes it

These are the external services the code actually calls, and each is limited to what its function needs:

• OpenAI — analysis, preview generation and coaching. Photographs are sent for this purpose.
• Independent identity and segmentation validators — confirm a generated preview is still recognisably you and that edits stayed within their intended region.
• Stripe — payments. Card details are handled by Stripe and are never received or stored by this service.
• Resend — email delivery, when you have enabled notifications.
• PostHog — product analytics, restricted to an allow list of seven events and nine numeric properties, sent against a pseudonymous identifier with person profiles disabled.
• Sentry — error monitoring, with request bodies, authentication headers and private media identifiers excluded.

Each remains inactive until its credential is configured. The current live state is published at the machine-readable platform status.

Nothing else is contacted by your browser. The guided capture and the weekly check-in measure your face on your own device rather than on a server, and the code and model that do it are served from this site — not from an outside content network, which would otherwise see your IP address at the moment you open the camera. No photograph is uploaded for that step.

Your controls

Export. You can download your data as structured JSON covering every collection listed above, scoped to your account.

Deletion. You can delete your account. This removes your rows across every table that holds them and the private objects behind your media, and it requires an exact confirmation and a matching email address. What remains afterwards is a receipt that records the deletion occurred without naming who requested it.

Notification preferences. Email delivery is off unless you enable it, with quiet days and pause controls.

Limits worth stating

This service is 18+. It offers observational presentation guidance. It does not diagnose medical conditions, calculate attractiveness or human worth, or instruct structural change to appearance. Results are withheld rather than published when the underlying evidence is uncertain.

Authentication is provided by the ChatGPT workspace that fronts this service, which supplies your identity to it. Access is only as private as that account.

Retention and jurisdiction

Data is kept while your account exists and removed when you delete it. Retention periods for records that must outlive an account — payment records required for tax purposes, for example — and the legal bases, transfer mechanisms and jurisdictional rights that apply to you are matters for [LEGAL ENTITY] and its counsel to state here.