PRIVACY POLICY

1. Overview

Face Witness is a web service for building facial composites from individual facial features. This Policy explains what information the service receives, why it is needed, and the choices available to users.

The editor processes selected facial features in your browser. Composites are not uploaded to the Face Witness server: when you save, the image is generated and downloaded directly to your device.

2. Information we process

• Credential account: a username or email used as a login, display name, and a protected password hash. We do not store the original password.
• Google sign-in: your Google identifier, email address, and profile name after you approve access.
• Payments: order and payment identifiers, amount, currency, and transaction status. Face Witness does not receive or store full bank-card details.
• Sessions and preferences: a secure session cookie lasting up to 30 days and a language preference cookie.
• Technical information: IP address, browser type, request time, and requested address may be temporarily recorded in standard server logs for security and diagnostics.

3. How information is used

We use information to create accounts, authenticate users, maintain sessions, select language, prevent abuse, diagnose errors, and comply with lawful obligations. We do not sell personal information or use it for targeted advertising.

4. Google user data

Face Witness requests only the basic profile information needed to sign you in: identifier, name, and email address. It is used solely to create or locate your account and authenticate you. We do not access Gmail, Google Drive, contacts, or other Google data.

Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing

Information may be processed by infrastructure providers needed to operate the site, by Google when you choose Google sign-in, and by OCTO or YooKassa when you make a payment. Card details are entered on the selected payment provider’s secure page. Information may also be disclosed when required by applicable law or to protect the service and its users. We do not share information with data brokers.

6. Retention and security

Account information is retained while the account is in use or until a valid deletion request is received. The session cookie lasts up to 30 days and can be removed by signing out or through browser settings. Passwords are protected using individual salts and cryptographic hashing. No storage method can guarantee absolute security.

7. Your rights

Depending on applicable law, you may request access, correction, portability, or deletion, restrict processing, or withdraw consent. Use the support address displayed on the Google OAuth consent screen to submit a request. We may need to verify your identity first.

8. Children

The service is not intended for independent use by children under 13, and we do not knowingly collect their information. A higher age of digital consent applies where local law requires it.

9. Changes and contact

We may update this Policy when the service or legal requirements change. The revised version will be posted here with a new effective date. For privacy questions, use the support address published on the Google OAuth consent screen for Face Witness.