Privacy

Photos in the free tool

The staging tool analyses your photo entirely in your browser, using models served from this site's own domain. The photo is never uploaded, transmitted, or stored — when you leave the page or start again, it's gone. Only the measurement numbers (never the photo) are kept, in your own browser's storage, so a later visit can show you what changed.

The paid report includes two optional AI images of you (hairline restored, and taken short). Generating them requires sending the photo you choose to Google's Gemini API via our server — this happens only after you tick an explicit consent box on the report page, and it is the only circumstance in which a photo leaves your device. The photo and the generated images are passed straight through: we store neither, and the images exist only in your browser until you save them. Google processes the photo to generate the images under its own API terms; we send no other information about you with it. Skip the checkbox and the rest of the report works normally.

Payment for the report is processed by Stripe — your card details go to Stripe, not to us. To build your report we attach your stage verdict and (if you used a photo) the measured hairline numbers in centimetres to the Stripe checkout session; that session record, held by Stripe, is the only place any of it is stored — we run no database. After purchase we send one email with your report link, via Cloudflare's email service, to the address you gave Stripe. No marketing emails, no list.

No accounts, no advertising pixels, and no third-party embeds. We keep our own anonymous event counters — for example “a verdict was shown” or “a purchase happened”, with the page path and a timestamp — so we can see whether the site works. These counters contain no identifier of any kind: no cookie, no user id, no IP address, nothing that links events to each other or to you. We also use Google Analytics to measure the same events against traffic — which page you arrived on, roughly where from, phone or desktop. It sets its own first-party cookies to recognise a return visit, records a truncated IP address, and is never given your photo, your email address, your measurements or the link to your report. Block it with any content blocker and nothing on this site stops working. Our hosting provider (Vercel) keeps standard server logs — IP address, requested page, timestamp — to serve and secure the site. Quiz answers and calculator inputs are processed in your browser and never sent anywhere.

Pages link to external services (for example telehealth providers). Those sites have their own privacy policies, and following a link is governed by theirs, not ours. If any outbound link on this site ever carries an affiliate relationship, the page carrying it will say so.

contact@norwoodreport.com