Draft, pending legal review. Last updated 27 October 2026.
Privacy Policy
FaceLab ("we") makes the Face Card web experience at this site. This policy explains what happens to your data. In short: your photo and face measurements stay on your device, and we only receive anonymous usage events.
1. Your face photo and face measurements
- When you scan your face, the photo is taken and analyzed inside your browser on your device. Facial landmarks, proportions and scores are calculated there too.
- We do not upload, store or receive your photo, your face landmarks, your face measurements or your scores.
- We do not use your face to identify you, and we do not create a face template that could recognize you.
- The photo and measurements are deleted when you close or reload the page, unless you turn on "Save my card face on this device" (see section 3).
- We only process your face after you confirm you are 18 or older and give explicit consent on the consent screen. You can decline and still play with the default character.
2. The face workout
The optional 1-minute workout uses your camera to count simple movements (smile, brow lift, cheek puff). The video is analyzed in your browser and is never recorded or uploaded.
3. Data saved on your device
To make the game work between visits, your browser keeps some data on your device: your best score, which cards you own, shards, your daily check-in days, your nickname, sound settings and a tutorial flag. None of this includes face data.
If you turn on "Save my card face on this device", a small cropped image of your face and your card text are also saved in your browser so your collection can show your face next time. This stays on your device. Turning the option off deletes it immediately. You can also clear all of this data in your browser settings.
4. Anonymous usage events
To understand how the game is used and whether people share it, we receive anonymous events such as "page opened", "flight finished", "card pack opened", "share tapped" and simple values like distance, number of admirers, card rarity or card design.
- Each event has a random session ID that is created when you open the page and is not stored on your device.
- We record your country (two-letter code) from the network request, not your IP address.
- If you opened a shared link, we record the referral code and creator code in that link.
- Events never include your photo, face measurements or scores. Our server only accepts a fixed list of event names and fields and drops anything else.
5. Battle and card links
When you share or challenge a friend, we store your nickname, your card design and two game values (Vibe and Aura) so your friend can see your card. We do not store your photo or face data for this. These links expire and are deleted after 30 days.
6. Who processes data
The site and its database run on Cloudflare (Cloudflare Pages, Workers and D1). Cloudflare processes network requests, including IP addresses, to deliver the site. Cloudflare may process data in different countries. We do not sell your data and we do not use advertising trackers.
7. How long we keep data
- Face photo and measurements: not kept by us (on your device only, as described above).
- Battle and card links: 30 days.
- Anonymous usage events: up to 24 months, then deleted or aggregated.
8. Your choices and rights
You can play without scanning your face, decline consent, turn off face saving, mute sound and clear your browser data at any time. Depending on where you live (for example under the GDPR, UK GDPR, CCPA or Illinois BIPA), you may have rights to access or delete data about you. Because usage events are anonymous, we usually cannot link them to you; contact us and we will help where we can.
9. Children
The face scan and face workout are for people 18 and older.
10. Changes and contact
We will update this page if our practices change. Contact: [privacy contact email to be added]