Biometric Data Policy
This policy explains how LookFlex handles face geometry, a type of data that laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI) and Washington's biometric identifier law treat as biometric. It is publicly available, as those laws require.
Last updated:
On this page
Summary
Scope and definitions
This policy is published by [Company legal name] (“we”, “us”) and covers the LookFlex website and iPhone app. “Face geometry” means the landmark points that describe the shape of your face, and the measurements calculated from them. We treat all of this as biometric data under this policy, even though LookFlex does not use it to recognise or identify anyone, and even where a particular law might not. It supplements our Privacy Policy.
What we compute and why
For each scan, an on-device face model (MediaPipe Face Landmarker, running inside the app) computes:
- 478 three-dimensional landmark points across your face;
- 16 facial proportions derived from them, such as eye spacing, facial thirds, jaw width and lip ratio;
- a left-right symmetry map, a face shape estimate, head pose and capture quality checks;
- a measurement margin for each reading, found by measuring the photo three times, and a record of how the photo was taken (head angle, lighting, focus, face size in the frame, expression strength and the hour), used only to compare scans fairly;
- the skin zones used to read skin from the photo's pixels.
We use this only to produce your results, explain them with overlays, build your daily plan and track your progress between scans and, if you keep backup on, to bring your results back when you sign in on another iPhone. We do not use it to identify you, to recognise you across photos, to match you against other people, to verify your identity, to infer your race or ethnicity, or for advertising.
Where it is processed
All of the computation above happens on your iPhone. The landmark points, measurements and your photo are stored in the app's own private storage. The landmark points and the photo are never stored on our servers, and we do not have a copy. The measurements are stored on our servers only if you keep backup on, as described in What backup stores. If you back up your iPhone, your own backup may include this data, and we have no access to that.
What is sent when AI analysis is on
LookFlex can add AI analysis, a second opinion from an AI vision model. When it is on, the scan shows an AI step, and your iPhone sends our server:
- a copy of your photo resized to at most 1024 pixels on the longest side;
- the derived measurements, symmetry, face shape and skin readings (not the 478 landmark points);
- your profile answers, such as age bracket, goals and skin type.
Our server checks the request, forwards it to Anthropic (Claude models), and returns the result to your device. It does not keep the request: it is held in memory only while it is processed, it is never written to storage, and its content is not logged. Our server records only that a scan read happened and when, to apply scan limits. Anthropic processes it as our service provider under its commercial terms, which do not allow it to train models on this data. It may keep request data for a limited period under those terms, for example to detect abuse.
The Lab feature sends a resized photo, your face-shape label and your top improvement areas (not your measurements) to Google's Gemini API to generate an illustrative image, on the same terms. The details are in the Privacy Policy.
What backup stores
Backup is optional. It is offered when you sign in, and you can turn it off at any time in Profile. While it is on, our servers store your scan results: your scores, the 16 facial proportions, symmetry, face shape, skin readings, the measurement margins and how each photo was taken. These are derived from your face geometry, so we treat them as biometric data under this policy.
Backup never stores the 478 landmark points, your photos or their thumbnails. The app leaves them out, and our server checks every backup and refuses image data and landmark points. The outlines of the skin zones and the symmetry midline, which are positions on your photo, are blanked before a scan is backed up. A scan restored on another iPhone therefore shows its numbers without the photo.
Turning backup off deletes the backup from our servers and leaves the data on your iPhone. Deleting your account deletes the backup too. Signing out deletes nothing: the backup stays on our servers until you turn it off or delete your account. If the account is not used for 35 months, we delete the backup.
Your consent
Before your first scan, LookFlex shows a consent screen. You must tick an unticked box agreeing to LookFlex processing your face geometry as described in this policy, and a second box agreeing to the Privacy Policy and Terms of Service, before you can continue. This is your written release, given electronically. The app records the date and time of each agreement and the version of the policy you agreed to, on your device, and includes it in your data export. If you keep backup on, that record is part of the backup.
Backup has its own consent. The sign-in screen tells you that signing in turns backup on, and we record the date and the version of that notice. You can withdraw that consent at any time by turning backup off.
If we change how we use face geometry in a way that needs fresh consent, the app will ask you again before your next scan. You can withdraw consent at any time by deleting your account in the app, which erases your scans, and not scanning again.
Retention and destruction schedule
We keep face geometry only as long as needed for the purpose you gave it for, on this schedule:
| Where | What | Kept until |
|---|---|---|
| Your device | Landmark points, measurements and the photo of each scan | You delete it. Profile, then Delete account permanently erases every scan on the device, and deleting the app from your iPhone removes them from the phone too. |
| Our servers | Resized photo and derived measurements in an AI request | The end of that request (seconds). Never written to storage. |
| Our servers, only with backup on | Scan results: scores and measurements derived from your face. Never landmark points or photos. | You turn backup off or delete your account. If the account is not used for 35 months, we delete the backup then, inside the three-year limit below. |
| Our database host's own backups | Copies of the backed-up scan results | [owner to confirm: how long the database host keeps its backups of the database, after which deleted data is gone from them too] |
| Anthropic | The same AI request | The limited period in Anthropic's terms, after which it is deleted |
| A Lab request: the resized photo, face-shape label and your top improvement areas | The limited period in Google's Gemini API terms, after which it is deleted |
Because the data on your device is under your control and we have no copy of your landmark points or photos, we cannot delete those remotely. The purpose of collecting it ends when you stop using LookFlex, so we ask that you then delete your account in the app, which also erases the app's data on your iPhone. On our servers we do not wait for you: a backup is deleted when its account has not been used for 35 months. An anonymous account has no backup, so it holds no biometric data on our servers, and if it has made no purchases it is deleted after 12 months without use. In no case will we, or anyone acting for us, keep biometric data longer than the earlier of the date its purpose is satisfied or three years after your last interaction with LookFlex.
No sale, lease or trade
We do not and will not sell, lease, trade or otherwise profit from your biometric data, or any data derived from it.
Limits on disclosure
We do not disclose, redisclose or otherwise share biometric data, except:
- to our service provider Anthropic, solely to perform the AI analysis you asked for, as described above;
- to our service provider Google, solely to generate a Lab image you asked for, as described above;
- to our database host, solely to store the backup you kept on, as described above;
- with your further consent;
- where required by law or by a valid warrant or subpoena.
Security
We protect biometric data with at least the care we use for our other confidential information, and to the standard of care in our industry. It is sent only over encrypted connections (HTTPS). In an AI request it is processed in memory on our servers and never stored or logged there. With backup on, the scan results are stored in our database, and every request to read or change them is checked against the session that made it, so only your own account can reach them. On your iPhone it is protected by the phone's own security, so please use a passcode.
Your rights and choices
- The consent screen tells you whether AI analysis is on before your first scan. If you do not want a photo sent for AI analysis, do not continue.
- Backup is your choice. You can turn it off at any time in Profile, which deletes the backup from our servers.
- You can export your data, including face geometry, from Profile, then Export my data.
- You can delete it at any time from Profile, then Delete account. This deletes your account and any backup on our servers and erases the app's data on your iPhone.
- For questions, or anything about data held by our providers, email [email protected].
Changes to this policy
We will post any change here and update the date at the top. Material changes to how we use biometric data will not apply to you until you consent to them in the app.