YOUR PRIVACY / PLAIN LANGUAGE
Less data. Clearer choices.
How this private development preview actually works. Updated 25 September 2026.
What stays in this browser tab
If you agree at the end of the quiz, your fixed selections (interests, style, home market, travel timing, stay length, budget band, service level and concierge extras) are saved in sessionStorage. There is no account or server submission. The brief expires after 24 hours and is cleared on the next access or active-page expiry check. You can delete it from the report page sooner. Browser session restoration can restore a tab, so use the delete button on a shared device.
Optional quiz photo preview
A photo is optional. Only adults may preview their own JPG, PNG or WebP under 5 MB after separate consent. The file is shown with a temporary local object URL, not uploaded, analysed or saved in storage. The preview URL is revoked when removed or when the quiz component closes. The photo is not used in the report.
Private AI face observation
The separate face-observation tool accepts an adult’s own or permission-cleared JPEG, PNG or WebP up to 12 MB after explicit consent. It re-encodes the image locally, strips the original filename and EXIF metadata, and runs a self-hosted MediaPipe model in the browser. The SDK version is pinned without remote diagnostic logging; network connections are restricted to this site. Photo pixels, landmarks and notes are not uploaded or put in localStorage/sessionStorage. Delete/reset, leaving the component or page hide releases app references; this is not a guarantee of forensic memory erasure. Explicit question downloads exclude the photo and landmarks and remain on your device. Original photos remain unchanged. Browser extensions and device access are outside this app’s control.
What a friend link contains
A board link contains one version number, three fixed style identifiers and three anonymous vote counts in the URL fragment. No name, face, medical interest, budget, home market or itinerary is included. This prototype is a relay, not a live shared room: each participant must pass on the latest link. Anyone can forward or alter it, and there is no identity check, individual revocation, invitation email or notification.
External requests and contact
This site uses Google Tag Manager and Google Analytics 4 to measure aggregate visits (pages viewed, approximate region, device and referring site) through cookies. It does not install Meta Pixel, session replay or an AI API, and your brief, answers or photos are never sent to these tools. The main interface fonts, generated portraits and face-model assets are self-hosted. Some legacy editorial stock images may load externally and share ordinary web-request information. The generated portraits are fictional adult illustrations, not real patients, staff or uploaded user photographs. Opening a third-party link or your email app is your choice. The prepared email includes only the selected service question and preferred language, not your report.
Before a public launch
A production service needs a verified operator contact, jurisdiction-appropriate privacy terms, security controls, storage and deletion policies, and separate legal bases for any clinic disclosure, cross-border processing, marketing or model training. This preview is not a completed production privacy policy.