Your photo never leaves your device

Most privacy policies explain what a company does with the data it collected. This one is different: we never collect the thing you would most expect us to. What follows is where your photo goes (nowhere), what does leave your device (very little), and how to check both.

What happens to your photo

Every step runs on your own hardware.

1. You choose a file. The browser reads the image from your disk into the tab's memory. Nothing is read from anywhere else and nothing is written back to disk.
2. It is drawn onto a canvas. The image is resized in memory so the models have less to do. It is a copy inside the tab, not a file on your device.
3. Face detection runs. A neural network, loaded as WebAssembly, locates any faces and the eyes, nose, and mouth corners.
4. The face is aligned. The detected face is rotated and cropped into a standard 112 by 112 pixel square, so every face is measured the same way.
5. An embedding is computed. A second network converts that square into 512 numbers describing facial structure and texture. It is the only representation of your face that exists, and it lives in the tab's memory.
6. Comparison happens locally. Those 512 numbers are compared with the 512 numbers for each celebrity in the library, which ships with the site.
7. Everything is discarded. Close the tab or reload the page and the image, the canvas copy, the landmarks, the embedding, and the results are gone. There is no copy elsewhere to delete, because none was ever made.

To state it without ambiguity: no image data is ever sent over the network. There is no upload endpoint, no image API, no storage bucket, no queue. The only network requests are for the page's own static files, identical for every visitor.

How you can prove it

You do not have to believe any of the above. It is testable in half a minute.

1. Open the home page in your browser.
2. Open developer tools (F12, or right-click and choose Inspect).
3. Switch to the Network tab and clear the list.
4. Run a match.
5. Watch the requests: the page, its scripts, and the model weights. You will not see your photo, a base64 blob, or a form post carrying image data.

For a stronger check, load the page, turn off your network connection, and run a match again. It still works.

What is stored on your device

Two things, both ordinary browser behaviour.

• The model files, in your browser's HTTP cache. The detection and embedding models are a few megabytes. Your browser downloads them once and caches them like any other asset, so return visits start faster.
• An optional cached copy for instant loading. Where the browser supports it, a cached copy of the model file may be kept on your device so the tool loads instantly next time. It holds no personal data and is identical for every user.

Both are clearable any time from your browser's settings, under cached files or site data. Clearing them costs one slower page load. We do not use local storage, session storage, IndexedDB, or cookies to keep anything about you.

What exists, where, and for how long

What	Where it lives	Leaves your device?	How long it lasts
Your photo file	Memory of the browser tab	No	Until you close or reload the tab
Resized canvas copy	Memory of the browser tab	No	Until you close or reload the tab
Face landmarks and aligned crop	Memory of the browser tab	No	Until you close or reload the tab
512-number face embedding	Memory of the browser tab	No	Until you close or reload the tab
Match results	Memory of the browser tab	No	Until you close or reload the tab
Model files	Your browser's cache, on your device	No (downloaded once, then reused)	Until your browser clears its cache
Page view and interaction counts	Aggregate analytics reports	Sent, with no identifier	Aggregate totals only
Challenge link	The URL, wherever you paste it	Only if you share it, name and score only	As long as you keep the link

The one exception, stated plainly

There is exactly one path through this site where something you typed leaves your device, and it is not the photo. If you use the image URL option instead of uploading a file, your browser has to fetch that address, and most sites refuse direct cross-origin requests. The tool therefore requests the image through an image proxy (wsrv.nl), which fetches the address on your behalf and hands the bytes back.

Both routes are attempted at the same time — a direct request and one through the proxy — because whichever answers first gives you the result sooner. So the address you pasted does reach the proxy on every image-URL submission, not only when the direct request is refused. It is visible to that proxy in the same way it would be visible to any web server you ask for a file.

The image is then processed locally like any other. Uploading a file from your device avoids the proxy entirely, which is one reason it is the default. The photo itself is never sent to the proxy: only the address of an image you asked us to fetch.

What we measure

Two services, and they are listed here in full rather than in a table nobody reads.

Cloudflare Web Analytics counts page views. It is cookieless, does not profile you, does not follow you to other sites, and does not fingerprint you. What we see is a count: this page was viewed this many times today, from this country, with this referrer.

Google Analytics 4 (measurement ID G-MJTG5PLQ91) is the second, and it is not cookieless. It sets first-party cookies named _ga and _ga_G-MJTG5PLQ91 so that it can distinguish a returning visitor from a new one, and it reports a randomly generated client identifier, your approximate location derived from your IP address, and your device and browser type to Google. Google's handling of that data is governed by Google's privacy policy, not by this one. You can opt out for every site at once with the Google Analytics opt-out add-on, or by blocking the script, which the tool tolerates completely.

There is no consent banner. That is a deliberate choice and you should know its consequence: if you are in a jurisdiction that requires opt-in consent before analytics cookies are set, this site does not currently ask for it. We would rather say that plainly than imply a consent flow that does not exist. The alternative was to leave the promise of "no cookies" standing while loading a cookie, and a false privacy claim is worse than an inconvenient true one.

Alongside both, we record a few interaction counts, such as "an upload was started". These are counters, not events tied to a person. They never include your photo, your result, the celebrity names you matched, or anything derived from your face: the code that sends them is structurally incapable of carrying such a value, because every call takes a fixed event name and one word from a closed list.

What is never collected

• Your photo, in any form, at any resolution, at any point.
• Face data, facial landmarks, or face embeddings.
• Biometric identifiers of any kind.
• Your name, email address, phone number, or account details (there are no accounts).
• Profiles linked to your IP address, and no attempt to build one.
• Advertising identifiers or cross-site tracking data.
• The celebrity names you matched with, or your match scores.

Sharing a challenge link

Sharing is opt-in, and it is the only way anything about your result can leave your device. A challenge link is a short code after the # in a URL, and it encodes exactly two things: the celebrity you matched with, and your score.

It does not contain your photo, any thumbnail, your name, your device, your location, or any identifier that could be traced back to you. Everything after the # is handled by the browser and never sent to the server, so the link is not transmitted to us when someone opens it. If you never generate one, nothing about your result leaves your device. If you do, you decide who sees it.

Third parties that are actually involved

Two, plus your own browser.

• A content delivery network (Cloudflare). It serves the static files that make up this site. Like any web server, it processes the request needed to send you a file, which includes your IP address and user agent. That is standard for every website, and it is not linked to a photo or a result, because the CDN receives neither. The same provider supplies the cookieless analytics.
• Wikimedia Commons. The celebrity photographs come from Commons under free licences. We credit each one and link to its file page on the credits page. Because the images are bundled with the site rather than loaded from Wikimedia at runtime, viewing a result sends no request to Wikimedia.

No ad networks. No social media pixels. No advertising cookies. No analytics resold to anyone. No data brokers, because there is no data to broker.

Children

The tool is intended for a general audience and is not directed at children under 13. Because we collect no personal information from anyone, we do not knowingly collect it from children either. If a parent or guardian has a concern, please email us.

Changes to this policy

If the site changes in a way that affects any statement above, this page will be updated and the date below will change. We have no plans to add uploads, accounts, or advertising, since any of them would break the promise this page is built around. If that ever changed, it would be stated here plainly.

How to contact us

Questions, corrections, or a credit that needs fixing: email hello@starbyface.net. For what the tool is and is not designed to do, see the terms page. For the engineering behind the library, see the about page.

Last reviewed: 12 September 2026.