Your photo never leaves your device.
Not "we don't store it." Not "we delete it after 30 days." It is never transmitted. The face model runs in WebAssembly inside your browser; the measurements, skin analysis, morph and report are computed locally; the only things this site ever downloads are its own pages, the model file, and — if you buy — a Stripe checkout page. Nothing is uploaded. The one exception is deliberate and opt-in: the AI mock-up (a Complete-tier extra) sends your photo — only when you tap "Generate" — to draw the suggested haircut. Your scan and measurements are never sent.
Verify it in 30 seconds
- Open this site in Chrome, Edge, Firefox or Safari on a computer.
- Press
F12(or⌥⌘Ion Mac) to open developer tools, and choose the Network tab. - Run a full scan on /scan.
- Look at every request in the list. You will see: HTML/CSS/JS files,
face_landmarker.task(the 3.7 MB model, downloaded to you), the WebAssembly runtime, and — if you click unlock — a Stripe URL. You will not see any request whose payload contains image data, because there isn't one. Filter by "Fetch/XHR" to make it obvious. - Optional: turn on airplane mode / disconnect Wi-Fi after the page has loaded, then run the scan. It still works. That is the whole point.
What we do store
| Where | What | Why | How to clear |
|---|---|---|---|
Your browser's localStorage | Theme, 18+ confirmation, chosen reference population/sex, unlock token, last fingerprint + timestamp | So the site remembers your choices between visits. No image, no landmarks, no measurements — the report is recomputed from your photo each time (deterministically, so it matches). | Clear site data in your browser, or use a private window. |
| Our server | Nothing about you. Static files only. If you buy, Stripe holds the payment record; our verification function receives your Stripe session id and returns a token — it never sees a photo. | — | — |
| Analytics | None in v1. If we add any, it will be cookieless, aggregate, and named here. | — | — |
Biometric data
Facial geometry is regulated biometric data in several jurisdictions (Illinois BIPA, Texas CUBI, EU GDPR Art. 9). Canthion never receives it — extraction and use happen on your device and the results are shown to you and to no one else. We do not train models on your photos because we never have your photos. This is not a policy promise; it is an architecture.
The AI mock-up (the one opt-in exception)
Everything above is true for the scan and every measurement — it is all on-device. The AI mock-up is a separate, optional Complete-tier feature that shows you the recommended haircut and facial hair rendered on your own photo. Because that means drawing hair that isn't in your photo, it cannot run on your device — so when (and only when) you tap “Generate my AI mock-up”, that single photo is sent to our AI image provider (Google's Gemini image model) to create the picture, and the result is returned to you. It is an illustration, not a measurement. We don't store the photo or the result on our servers; nothing happens unless you tap the button; and your facial measurements are never part of it. If you never tap it, nothing is ever uploaded.
Age
This tool is for adults. We ask you to confirm you are 18 or older before it runs; that confirmation is stored only in your browser. If you are under 18, please close the tab — the measurements are not designed for developing faces and, more importantly, this is not a healthy thing to spend time on before adulthood.
Terms, briefly
- Canthion is descriptive measurement, not medical advice, diagnosis or treatment. It is not a medical device.
- Reference values are population means from cited literature; they are not standards, ideals or targets.
- Paid unlocks are one-time and per device/browser; 14-day no-questions refund by email; using the product does not void it.
- You retain all rights in your photos. We never receive them.
- Third-party components: MediaPipe (Google, Apache-2.0), Delaunator (ISC). Attribution in the source.
- Contact: hello@canthion.com
Qoves' current privacy policy states no retention period for adult photos, no deletion mechanism for adults, does not mention GDPR (despite a London HQ) or CCPA, contains no biometric-data language, and reserves the right to use your images "to refine machine learning algorithms." Umax's states a one-year retention of face scans. We are not saying they misuse anything. We are saying the difference between "trust us" and "check the network tab" is the product.