Your photo never leaves your device

Most privacy policies explain what a company does with the data it collected. This one is different: we never collect the thing you would most expect us to. What follows is where your photo goes (nowhere), what does leave your device (very little), and how to check both.

What happens to your photo

Every step runs on your own hardware.

1. You choose a file. The browser reads the image from your disk into the tab's memory. Nothing is read from anywhere else and nothing is written back to disk.
2. It is drawn onto a canvas. The image is resized in memory so the models have less to do. It is a copy inside the tab, not a file on your device.
3. Face detection runs. A neural network, loaded as WebAssembly, locates any faces and the eyes, nose, and mouth corners.
4. The face is aligned. The detected face is rotated and cropped into a standard 112 by 112 pixel square, so every face is measured the same way.
5. An embedding is computed. A second network converts that square into 128 numbers describing facial structure and texture. It is the only representation of your face that exists, and it lives in the tab's memory.
6. Comparison happens locally. Those 128 numbers are compared with the 128 numbers for each celebrity in the library, which ships with the site.
7. Everything is discarded. Close the tab or reload the page and the image, the canvas copy, the landmarks, the embedding, and the results are gone. There is no copy elsewhere to delete, because none was ever made.

To state it without ambiguity: no image data is ever sent over the network. There is no upload endpoint, no image API, no storage bucket, no queue. The only network requests are for the page's own static files, identical for every visitor.

How you can prove it

You do not have to believe any of the above. It is testable in half a minute.

1. Open the home page in your browser.
2. Open developer tools (F12, or right-click and choose Inspect).
3. Switch to the Network tab and clear the list.
4. Run a match.
5. Watch the requests: the page, its scripts, and the model weights. You will not see your photo, a base64 blob, or a form post carrying image data.

For a stronger check, load the page, turn off your network connection, and run a match again. It still works.

What is stored on your device

Two things, both ordinary browser behaviour.

• The model files, in your browser's HTTP cache. The detection and embedding models are a few megabytes. Your browser downloads them once and caches them like any other asset, so return visits start faster.
• An optional cached copy for instant loading. Where the browser supports it, a cached copy of the model file may be kept on your device so the tool loads instantly next time. It holds no personal data and is identical for every user.

Both are clearable any time from your browser's settings, under cached files or site data. Clearing them costs one slower page load. We do not use local storage, session storage, IndexedDB, or cookies to keep anything about you.

What exists, where, and for how long

What	Where it lives	Leaves your device?	How long it lasts
Your photo file	Memory of the browser tab	No	Until you close or reload the tab
Resized canvas copy	Memory of the browser tab	No	Until you close or reload the tab
Face landmarks and aligned crop	Memory of the browser tab	No	Until you close or reload the tab
128-number face embedding	Memory of the browser tab	No	Until you close or reload the tab
Match results	Memory of the browser tab	No	Until you close or reload the tab
Model files	Your browser's cache, on your device	No (downloaded once, then reused)	Until your browser clears its cache
Page view and interaction counts	Aggregate analytics reports	Sent, with no identifier	Aggregate totals only
Challenge link	The URL, wherever you paste it	Only if you share it, name and score only	As long as you keep the link

The one exception, stated plainly

There is exactly one path through this site where something you typed leaves your device, and it is not the photo. If you use the image URL option instead of uploading a file, your browser has to fetch that address, and most sites refuse direct cross-origin requests. The tool therefore requests the image through an image proxy (wsrv.nl), which fetches the address on your behalf and hands the bytes back.

In that single case the address you pasted is visible to that proxy, in the same way it would be visible to any web server you ask for a file. The image is then processed locally like any other. Uploading a file from your device avoids this entirely, which is one reason it is the default. The photo itself is never sent to the proxy: only the address of an image you asked us to fetch.

What we measure

We use Cloudflare Web Analytics for aggregate page views. It is cookieless, does not profile you, does not follow you to other sites, and does not fingerprint you. What we see is a count: this page was viewed this many times today, from this country, with this referrer.

We also record a few anonymous interaction counts, such as "an upload was started". These are counters, not events tied to a person, and they tell us whether the tool works. They never include your photo, your result, the celebrity names you matched, or anything derived from your face.

There is no cookie banner because there are no cookies to consent to, no advertising identifiers, no pixels, and no session recording.

What is never collected

• Your photo, in any form, at any resolution, at any point.
• Face data, facial landmarks, or face embeddings.
• Biometric identifiers of any kind.
• Your name, email address, phone number, or account details (there are no accounts).
• Profiles linked to your IP address, and no attempt to build one.
• Advertising identifiers or cross-site tracking data.
• The celebrity names you matched with, or your match scores.

Sharing a challenge link

Sharing is opt-in, and it is the only way anything about your result can leave your device. A challenge link is a short code after the # in a URL, and it encodes exactly two things: the celebrity you matched with, and your score.

It does not contain your photo, any thumbnail, your name, your device, your location, or any identifier that could be traced back to you. Everything after the # is handled by the browser and never sent to the server, so the link is not transmitted to us when someone opens it. If you never generate one, nothing about your result leaves your device. If you do, you decide who sees it.

Third parties that are actually involved

Two, plus your own browser.

• A content delivery network (Cloudflare). It serves the static files that make up this site. Like any web server, it processes the request needed to send you a file, which includes your IP address and user agent. That is standard for every website, and it is not linked to a photo or a result, because the CDN receives neither. The same provider supplies the cookieless analytics.
• Wikimedia Commons. The celebrity photographs come from Commons under free licences. We credit each one and link to its file page on the credits page. Because the images are bundled with the site rather than loaded from Wikimedia at runtime, viewing a result sends no request to Wikimedia.

No ad networks. No social media pixels. No analytics resold to anyone. No data brokers, because there is no data to broker.

Children

The tool is intended for a general audience and is not directed at children under 13. Because we collect no personal information from anyone, we do not knowingly collect it from children either. If a parent or guardian has a concern, please email us.

Changes to this policy

If the site changes in a way that affects any statement above, this page will be updated and the date below will change. We have no plans to add uploads, accounts, or advertising, since any of them would break the promise this page is built around. If that ever changed, it would be stated here plainly.

How to contact us

Questions, corrections, or a credit that needs fixing: email hello@starbyface.net. For what the tool is and is not designed to do, see the terms page. For the engineering behind the library, see the about page.

Last reviewed: 12 September 2026.