Privacy

It is never transmitted. There is no upload endpoint on this site. Whether you use your camera or choose a file, the image is decoded into a canvas element in your own browser, measured there, and never sent anywhere. You can verify this yourself: open your browser’s network tab while running the analysis and you will see no request carrying the image.

The face-detection model runs locally too. We host the model file and its WebAssembly runtime on our own domain rather than loading them from Google, specifically so that running the analysis does not tell any third party that you are doing it.

One thing we do keep, on your device: a small cropped cut-out of your face, stored in your browser’s session storage. This exists so your report can still show your face after you come back from the payment page. It is erased the moment you close the tab, and it is never transmitted either. The original full photo is discarded as soon as it has been measured.

If you would rather nothing at all were kept, skip the photo step, the questionnaire alone still produces a result.

If you use our ChatGPT plugin. When you take or choose your selfie inside the plugin’s card, it is measured on your device, and neither we nor ChatGPT see it. If you attach a photo to the chat itself instead, ChatGPT receives it, and OpenAI’s privacy policy covers that copy. When you choose “Upload more photos on yourcolorpalette.com”, your browser locks the photo with a new key before it leaves your device. Our server holds only the locked copy, which it cannot open, because the key stays in your link and is never sent to us. The locked copy is deleted the first time your link opens it, or after 15 minutes.

Your quiz answers are stored in your own browser’s local storage so that a refresh does not lose your progress. They stay on your device. Clearing your browser data removes them. The one exception is your guess at your own season, which joins the anonymous tally described below.

Your browser also keeps a note that it has had its free reading, so a new analysis in the same browser offers more photos as a paid option instead. The note holds no photo and no result, stays on your device, and is removed when you clear your browser data.

Payment is handled by Stripe, our merchant of record, in a secure Stripe checkout form that opens on this site. Your card details never touch this site. Stripe asks for your email to send you a receipt; it stays with Stripe and this site does not store it. We receive a confirmation that a payment succeeded, the name of your season and the option you chose. No name, no address and no card data are stored by us. Stripe’s own privacy policy covers what they hold.

We use two counters for analytics, and both are cookieless. Cloudflare Web Analytics records that a page was viewed, roughly where in the world from, and how fast it loaded. PostHog, a product-analytics tool, records the anonymous steps of the free analysis, that a visitor started it, reached the photo step, finished, or opened the report, and, across the site, which pages get opened and for how long, so we can see where people give up and what they read. PostHog also captures anonymous recordings of on-page interaction, where people click and how far they scroll. Every image, canvas and video is blanked in your browser before anything is sent, so a recording never contains your photo, your face cut-out or the draping view. The text of the page is recorded, and all of it is ours: you tap answers and add a photo, and the one place you can type is the optional note described below, which your browser hides before a recording leaves it. That means a recording can show which season a report displayed, tied to an anonymous tab id and nothing else. Neither counter sets a cookie, and neither can follow you to any other website.

To be precise rather than claim more than is true: PostHog is a real second company, and we would rather name it than pretend the page-view counter is the whole story. We run it in its most private setting. It stores no cookie; the anonymous id it uses to join your own steps together lives in your browser tab and is erased the moment you close it, the same rule that governs your face cut-out above. It builds no profile of you, and every request it makes is routed through this site’s own domain, so your browser never contacts a PostHog server directly. That first-party routing is the same reasoning that makes us host the face-detection model ourselves instead of loading it from Google.

Your photo and your measurements are never in any of this. No analytics or advertising event carries your answers, your season, your axis readings or your photo as data. The one place a result is counted is the anonymous tally below, which is kept apart from these counters and carries no id that could join it to them. What either counter learns is anonymous and impersonal, that a step happened, which page was open and for how long. There is one exception, and it is yours to make: if you close the upgrade pop-up and choose to write a line in the optional box instead of tapping one of the ready answers, that line is sent with that one event, up to 140 characters, and nothing else you ever type on this site is sent anywhere. A recording is the one place a season name can appear, as the text of the page a visitor was looking at, with every image removed and no way to connect it to a person. We can see how many people completed the analysis. We cannot see who any of them are.

We advertise in ChatGPT, and we may advertise on other sites such as Facebook and Instagram. To see which ads lead to a purchase, we use the measurement pixel of each ad platform. A pixel is a small script from the platform. It sets cookies on this site and tells the platform when you view a page, when you open checkout and, if you buy, which report and the amount you paid. It never gets your photo, your answers or your season.

OpenAI (ads in ChatGPT). The OpenAI pixel sets two cookies: __oppref, which holds the ad click id for 30 days, and __obref, a random browser id kept for a year. Today it loads only if you reach this site by clicking our ad in ChatGPT, on that visit and for 30 days after it. A note in your browser storage (ycp-ad-visit.v1) remembers the ad click for those 30 days. OpenAI’s own privacy policy covers what they do with this data.

When we start to use the pixel of another platform, we add it to this list first. You can remove these cookies at any time by clearing your browser data for this site.

If you give us your email address, for example to get your report or our emails, we keep it and use it to send you what you asked for. If you agree to our emails, we send you news and tips about color analysis. Every email has an unsubscribe link. We never sell your email address. To see or delete what we hold about you, email [email protected].

When your first photo has been read, your browser sends us one short line, so we can publish honest numbers about which seasons people get and how often they guess their own. It holds exactly these things and nothing else: the day (never the time), your country as our hosting provider Cloudflare reports it, the season the photo was read as, the runner-up, how clear the result was (clear, good or borderline), which reference we used to correct the light (the whites of your eyes, a bright highlight, or none), and your own season guess if you made one.

It holds nothing that points back to you. No photo, no measurement, no colour, no IP address, no device details, no account and no id of any kind, so a line cannot be connected to a person, to a visit or to any other line. When we publish figures from it, we leave out any country with too few results to stay anonymous.

Our Chrome extension and our Android app, both called Your Color Palette, check a color against the season you pick. Both work entirely on your device. A photo you take or choose, a screenshot you paste and a color you pick on a web page are measured on the device and never sent anywhere. We have no server for them to send to.

In the free version, the only thing either one stores is the season you picked, on your own device, so you do not have to pick it again. Neither one has an account, analytics, ads or trackers. The free extension asks for no access to the websites you visit: the color picker reads only the one spot you click. When you follow a link from either one to this website, the link says which one sent you (for example utm_source=android-app) and nothing else.

Chrome extension Pro. If you bought the full report with the Chrome extension, your report shows a key. When you paste it into the extension, the extension sends that key to this website, and nothing else, to check the purchase: once when you paste it, then about once a day. It then keeps the key, the season on your report and your wishlist in your browser. A wishlist item is the color, how close it is to your palette, the page title, the page link and the date. It never holds a picture. The first time you press Save, Chrome asks whether the extension may read your tabs, so it can save the title and link of the page you are on. It reads only that one tab, at the moment you press Save. If you say no, the item is saved without the link. "Remove Pro key" in the extension deletes the key from your browser.