How we handle face data

A ColorScan scan uses your camera to take a short sequence of photos while your screen changes color. Those photos contain your face. This page explains what happens to them and how long anything derived from them is kept.

We do not keep the photos. They are sent to our processing service, held in memory while your color measurements are computed, and discarded when that request finishes. They are never written to storage, never backed up, and never reviewed by a person. There is no photo storage in our production system for them to be written to.

What we keep instead is a set of numbers: the measured colors of your skin, hair, and eyes, plus quality information about the capture itself. Because color measurements can relate to ethnicity, we treat them as sensitive information. We never sell them and never use them for advertising.

Retention schedule. Your measurements are kept for the life of your account, or until 24 months of inactivity, whichever comes first. You can delete them yourself at any time and the deletion happens immediately. Records of what you agreed to, and when, are kept for five years after an account is deleted, because those records are what we would rely on if anyone ever questioned whether you had consented.

Destruction. Photos are destroyed when the request that created them ends, which is a matter of seconds. Measurements are deleted from our database when you delete them or when the retention period above runs out.

Your choices. Scanning requires your agreement, which you give on a screen of its own before the camera opens. You can withdraw it at any time from your account, and you can ask us to delete everything we hold about you. The Privacy Policy covers the rest of what we store and why.