Photographs & privacy

What happens to the pictures

A photograph of somebody's body is sensitive personal data under the GDPR, under the CCPA, and under India's DPDP Act. This system is built so that in normal use it never holds one.

The measurement never needs the photograph

The pose model runs in the browser, on the device that took the picture. What is sent to the server is thirty-three joint positions and a set of horizontal spans describing the body's outline — a few kilobytes of numbers from which no likeness can be reconstructed. The image itself stays where it was taken.

Keeping them is off by default

Every new house is created with photograph retention set to none. A house can change that to thirty days if it has a reason to, and the setting is per house rather than per capture, so it cannot be quietly flipped for one customer.

When photographs are retained they are stored outside the web root, are never served as static files, and are reachable only through an authenticated request that checks which house is asking. A scheduled purge deletes anything past its retention window.

The optional second opinion

A house may switch on a vision cross-check, which sends the two photographs to a model to be assessed for pose and clothing. This is off by default, it has to be started by hand for each set, and the model is never asked for — and is structurally unable to return — a measurement. When retention is none, the images are used for that single request and deleted before it returns.

What is kept

The measurements, the geometry they were derived from, who took them, who confirmed them, and every correction anyone made. That record is the point of the product: a house needs to be able to answer, years later, what it cut from and why.

The public demo

Nothing at all is stored. No account, no session record, no photograph, no measurement. The geometry is posted, the arithmetic is done, the numbers come back, and the request ends.

If you are evaluating this for a house that needs a data-processing agreement, the short version is: we hold measurements, not likenesses, and the default configuration keeps no images.