Scope
This notice describes Facehunch at facehunch.com. The main workspace has a consented FaceCheck search flow, separate from the fictional example and restricted API test. The main workspace uses live Stripe checkout for prepaid search packs. The legacy sample checkout remains separate and test-only.
Images and API results
Selecting an image creates a preview in your browser. If you pick a photo on a public page, or start checkout before searching, a resized copy is kept in this browser tab's session storage so the workspace can open it; it is deleted as soon as the workspace reads it, and expires after an hour. Starting a consented search sends that image through Facehunch’s server to FaceCheck. Facehunch does not persist the uploaded image file in its application database. The main search saves returned source metadata, thumbnails and report details against your account. If you use report chat, its messages and generated responses are also saved with the report. The server uses a protected provider key; that key is not sent to your browser.
The main flow uses your authenticated account to access its saved search. The separate example API uses a signed, expiring job token to poll and request cleanup. The application asks FaceCheck to remove the search input after completion or cancellation. Network or provider failures can prevent confirmed cleanup. Closing the browser does not guarantee the cleanup request completes.
Third-party processing
FaceCheck processes the submitted image under its own policies. Review the provider’s current terms and privacy information on FaceCheck before uploading. Test mode changes search coverage and billing behaviour; it does not mean the image stays on your device.
Cloudflare serves the application and processes requests. Operational request information may be handled by the hosting platform for delivery, security and diagnostics. This notice does not promise that all infrastructure logs are disabled or instantly deleted.
Website analytics
Google Tag Manager loads Google Analytics 4 and our Matomo instance at tracking2.lindoai.com to measure page visits and navigation. These services may use analytics cookies and process device, browser and network information. Pageview URLs exclude query strings and fragments. We do not send uploaded photos, search results, email addresses or signed job tokens as analytics event data.
Results and external links
Source links lead to third-party websites with their own policies. Removing your search input does not remove source images or change a provider’s index. Fictional sample items demonstrate the interface; main-flow reports retain returned sources for later review.
Your choices
Use the fictional example if you do not want to submit an image. Upload only images you are entitled to share, and avoid unrelated sensitive information. Read photo removal for the different removal routes. Contact hello@sopranos.dev to request removal of your account and associated report records.
Accounts and payments
We store your verified account email, account creation time, and report references in a dedicated Cloudflare D1 database. Email sign-in uses a single-use four-digit code sent through Cloudflare Email Service. Codes expire after five minutes and allow five attempts. We store a keyed hash of each code, not the code itself. An HttpOnly session cookie keeps you signed in for up to seven days. Signing out revokes that session. No password is needed. Google sign-in, when available, shares your verified email and Google account identifier; we do not request access to Gmail or contacts.
Purchasing a search pack uses live Stripe checkout. Stripe processes the payment details you enter. Facehunch stores payment references and a credit ledger to grant and track searches; we do not send Stripe your selected photo. Selecting an image does not submit it to FaceCheck: that occurs when you start a consented search. Account and report records remain available until removed through the applicable account or support process. The separate legacy sample checkout uses Stripe test mode and does not buy real searches.
The separate API example workspace can send a photo to FaceCheck only when you explicitly start its consented API test. This is independent of the sample report checkout.
Connected AI apps and MCP
After you approve an OAuth connection, the selected client can read your account profile and, with report-read permission, existing report status and source links already available to your account. Locked reports do not reveal their source links. Results are shared with the client to answer your request; its own privacy and retention settings apply. The connector cannot submit a new image, run a search, unlock a report, identify a person or spend credits.
Cloudflare hosts the connector and stores OAuth registrations, grants and token records. Access tokens last one hour; refresh tokens last up to 30 days. Pending consent expires after 10 minutes. Revoke access through connected apps. Revocation stops future access but does not remove saved reports or copies already delivered to the client. Account and report deletion requests use the contact route described above. Dedicated reviewer sessions expire after one hour and expose only labelled synthetic reports.