What we collect
- Account data: email address, username, display name, bio, and city if you add them.
- Photos you upload and the facial data derived from them: facial landmark coordinates, geometry and presentation measurements, pose, quality checks, and your Aura Score range.
- Content you create: posts, comments, messages, reactions, votes, and reports.
- Purchases: what you bought and its status. Card details go to Stripe; we never see or store full card numbers.
- Safety and abuse signals: a salted hash of your IP address, a random device ID stored in your browser, and rate-limit counters.
- AI usage records: which feature ran, token counts, and cost, so we can enforce limits.
We don't collect your date of birth after the age check, your precise location, or contacts.
Photos and facial data are sensitive
We use your photo only to produce your scan. Scoring runs on servers we operate. It is not facial recognition: we don't identify who you are or compare you to other people's faces.
- Unless you turn on "help improve the model", the original photo is deleted right after scoring.
- If you opt in, we keep it for up to 90 days, then delete it.
- A photo you publish stays until you unpublish it or delete the scan.
- Derived measurements stay with your scan until you delete the scan or your account.
Where the law treats facial geometry as biometric data, we process it only with your consent, use it only to show you your result, and never sell it.
How we use data
- Run the service: scoring, roasts, reports, leaderboards, battles, and messages you choose to use.
- Keep people safe: age checks, screening uploads for nudity and minors, moderating text, and stopping fraud and abuse.
- Billing, receipts, and customer support.
- Improving the scoring model, only with photos from people who opted in.
We don't sell personal data, and we don't use it for third-party advertising.
Who processes data for us
- Supabase (database, sign-in, photo storage)
- Vercel (website hosting)
- Anthropic (Claude writes roasts and reports from your scan's numbers, and screens text for safety; it doesn't receive your photo)
- Stripe (payments)
- Resend (transactional email)
- Cloudflare (secure connection to our scoring servers)
Each processes data only on our instructions and under its own security commitments.
How long we keep it
- Original photos: as described above (immediately, up to 90 days with opt-in, or until unpublished).
- Account and scan data: until you delete it.
- Deleted accounts: locked at once, then permanently erased after a 1-day grace period, and within 30 days at most.
- Moderation evidence: 1 year, so repeat abuse can be handled, even after account deletion.
- Payment and tax records: as long as tax and accounting law requires.
Your choices and rights
From Settings you can export your data, change optional consents, unpublish anything, and delete your account. Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, or state biometric laws), you may also have the right to access, correct, or delete data, and to object to or restrict processing. Email privacy@chadmaxx.co and we'll respond within the time the law requires.
Children
ChadMaxx is for adults 18 and over. We delete accounts and photos of anyone we believe is under 18.
Contact
privacy@chadmaxx.co, or [OPERATOR LEGAL NAME], [MAILING ADDRESS].