Privacy and biometric notice

We only collect what we need to recommend haircuts and render the previews you ask for. The measuring of your face happens on your device; the rest happens on our servers and our processors’ servers.

Some US states treat face geometry, and photos used to derive it, as biometric identifiers or biometric information. We treat all of it that way, wherever you live.

• What: the face proportions derived from your photo, and the photo itself while it is being analysed and used for previews.
• Why: only to recommend haircuts and to render the previews you request. Nothing else.
• Consent first: before the camera opens, we ask you to confirm you are 18 or older, to give written consent to this processing, and to confirm the photo is of you or that you have the person’s consent.
• How long: as set out in the retention schedule below. Everything is permanently destroyed on that schedule, or sooner if you delete it, and never later than 30 days after your last analysis. The photo itself is never kept longer than 24 hours.
• No sale: we never sell, lease, trade or otherwise profit from your biometric data.
• Disclosure: only to the processors listed below, only to perform the service, or where the law requires it.
• Security: encrypted in transit and at rest. A photo held for rendering is encrypted with AES-256-GCM.
• Withdrawing consent: delete your data with the button below, or email us. Withdrawing stops all further processing of your photos and measurements. It doesn’t cancel a membership: billing continues until you cancel it (one click, from your account).

A deletion job runs every day and removes anything past its date.

We use these companies under their commercial API terms, and send each one only what its step needs.

• Store face templates or face embeddings on our servers.
• Sell your data, or share it for advertising.
• Train models on your photos, unless you give separate, opt-in consent.
• Record your screen on the capture or results pages. No session replay there, ever.
• Put images, landmarks or raw measurements in logs or analytics.
• Rate your face or looks.

You don’t need to wait 30 days. This removes everything tied to this browser immediately, including the files in storage.

Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it and to opt out of certain uses. We honour these requests for everyone.

• Delete: use the button above, or email support@fitcut.xyz for data from another device.
• Access or copy: email us and we’ll send what we hold within 30 days. We may ask you to confirm the email address you used.
• Marketing: every marketing email has a one-click unsubscribe.
• Barber cards: a partner shop only sees a card you explicitly chose to share with it.

• fc_anon: a first-party cookie holding a random ID, kept up to 400 days. It links your analysis to your browser, keeps a partner shop’s referral, and enforces free-tier limits.
• fc_sid, fc_fsrc, fc_var (30 minutes): a visit ID, where the visit came from (a partner shop, a campaign or invite code, or the kind of referring site), and which version of a page you saw in a test. We use them for our own first-party funnel counts (for example “viewed results”, “started checkout”). Those events store a hashed browser ID and device type, never your photo, measurements, email, IP address or browser fingerprint, and are deleted after 400 days.
• Page-use analytics (first-party, ours alone): how long each page stays open, how far you scroll, which parts of a page you spend time on, which buttons and links you tap (where on the page, and the button’s label), which form fields you use (never what you type in them), page errors and how fast the page loaded. It uses the same visit ID and hashed browser ID as the funnel counts, so we can see where a page loses people and fix it. On the capture and results pages, and on the face-shape detector, it records only time, which step you’re on, how far you scroll, which of our buttons, links and form fields you use (by our own names for them), page errors and load speed: never where you tap and never anything shown on screen. It never records your photo, measurements, results, email or anything you type, and it’s deleted after 90 days. It’s off when your browser sends Do Not Track or Global Privacy Control, and you can turn it off here (that sets fc_noba, 1 year):Turn off page-use analytics
• fc_spin (24 hours): only if you spin our prize wheel: which prize you won and when it ends, signed so it can’t be changed, and tied to this browser. Your browser also remembers when it last offered the wheel (fc_spin_seen, local storage) and the order of the pages in your visit (fc_ba_seq, session storage).
• fc_src (90 days): the first campaign or invite code you arrived with (from a link such as a Reddit reply or our TikTok profile), so a later analysis or purchase counts for that link. A later code doesn’t replace it.
• fc_ad (30 days): the ad source and the campaign, ad group and ad IDs from the link you arrived on, for our own counts of which ads lead to analyses and memberships.
• fc_scan_skip (30 days): which of your analyses you chose to see the free results for instead of the $3.99 full facial analysis, so we don’t ask again in this browser. It holds only those analysis IDs.
• Analytics: if enabled, PostHog stores its own identifier to count visits and funnel steps. It honours Do Not Track, and on the capture and results pages it sends only named events, never clicks, heatmaps or recordings.
• Checkout: Stripe sets its own cookies to process payments and prevent fraud.
• Product links: when you click a “Get the look” link, we count the click in the same first-party funnel (which cut and product type, with the hashed browser ID above), then send you to an Amazon search. We don’t pass Amazon anything about you, only that the visit came from Fitcut. Once you’re on Amazon, its own cookies and privacy notice apply.
• No advertising or cross-site tracking cookies on Fitcut.

Fitcut is for people 18 and over. We don’t knowingly collect data from anyone younger; if we learn we have, we delete it.

Westward, operated by Orion Jones runs Fitcut and decides how your data is used here. This notice is version 2026-09-30+usage. If we change it in a way that affects how your data is handled, we’ll say so on this page and ask for consent again before any new processing. Questions: support@fitcut.xyz, or by post: 700 W Smuggler St, Aspen, CO 81611. See also our terms.

Version 2026-09-30+usage (October 3, 2026) adds first-party page-use analytics on top of version 2026-09-30: see cookies and analytics, where you can also turn it off.