Privacy

In force from 17 September 2026

This says exactly what FaceForge stores, who else sees it, and how to get rid of it. It is short because the site collects little: there are no accounts and no passwords.

What is stored, and why

What you type

The words you use to describe a face, and the conversation with the designer. Kept so the face can be drawn, and so we can see which descriptions the drawing gets wrong.

Kept 12 months

A photo, if you upload one

Used to draw a face from it.

Deleted after 30 days

Your face design and its picture

Your watch fetches it every few minutes — this is the product.

Kept as long as you have it

A place, if you ask for your own horizon

The town, peak or coordinates you give, and the skyline worked out from them — kept so the same horizon does not have to be worked out twice. It is stored by place, not by person.

Kept as a cache

A coarse visitor id

Your IP address and browser string, hashed together and cut to twelve characters. Used for rate limits, and to count visitors without keeping the address itself.

Kept 12 months

Your watch's device id

Recorded once you claim a face, so a paid face cannot be used on other people's watches.

Kept as long as you have the face

A list of your faces in your own browser

Local storage, so the page can show you what you made. It never leaves your browser.

Until you clear your browser

We never see your card details. There are no advertising cookies and nothing is sold to anyone.

Who else sees it

Drawing a watch face means sending your description — and your photo, if you uploaded one — to the AI services that write and paint it. They process it on our instructions and do not use it to train their models:

Anthropic (Claude) — understands what you asked for and designs the face.
fal.ai (FLUX) — paints the picture, and edits it when you ask for a change.
Stripe and Link — take the payment and issue the receipt. Link is the merchant of record; your card and address go to them, not to us.
The email you pay with — Stripe collects it at the till for your receipt, and since 18 September 2026 we keep a copy of it beside the face you bought. It is the only way to give you your faces back if you lose both your watch and the browser you bought on, and the only way to know a support request really comes from the person who paid. We write to it in two cases only: when you buy a face in a browser that is not connected to your watch, and when you ask My faces to mail you a link. Each of those mails carries a link that works once and connects the browser you open it in; nothing happens unless you tap it. The mail is sent through AgentMail, our mailbox provider. It is not used for anything else: no newsletter, no marketing, and it is never passed on. Ask us and we delete it, which costs you nothing except that route back.
Looking up a place. When you type a town or a peak, or share your location, for a face of your own horizon, that name or those coordinates — never your name, and nothing about who you are — go to the services that know the terrain: Open-Meteo (finding the place, and its elevation), OpenStreetMap (Nominatim for place names, Overpass for the names of the summits), and OpenTopoData (elevation). The elevation tiles themselves are public files, fetched by map square.
A photograph of a peak. When you search for a mountain's photo, its name — and nothing else — goes to Wikipedia and Wikimedia Commons. The previews and the photo you pick are fetched by our server and passed on to you, so neither of them sees your browser or your address.
Telegram — when something on the site fails, a short alert reaches the person who runs it, and that alert can carry the first words of what was being drawn. No name, no email, no address.
Cloudflare — carries the traffic to and from this site.
Microsoft Clarity — records how the page is used, so broken layouts can be found. See below.

Several of these are in the United States, so your description travels outside the EU. They are engaged under the European Commission's standard contractual clauses or an equivalent basis.

Session recording

The site loads Microsoft Clarity, which replays how people move through the page so that broken layouts and dead ends can be found. It does not record what you type into a password field, and today it is skipped entirely if your browser sends a Do Not Track signal.

Faces shown publicly

The public gallery shows a small, hand-picked set of faces as examples of what the forge can do, each with the first words of its description. Nothing about who made a face is shown, and a face drawn from your own photograph is never shown. If one of them is yours and you would rather it were not there, write to [email protected] and it comes down the same day.

Why we are allowed to store it

To give you what you paid for — your design, its picture, the code and the watch binding. We cannot serve the face without them.
Our legitimate interest in a working, un-abused service — the visitor id for rate limits, the kept descriptions for finding out what the drawing gets wrong, the session recording for finding broken layouts.
A legal duty to keep records of sales for as long as Slovenian tax law requires.

Your rights

Write to [email protected] and you can have: a copy of everything stored about you, a correction, deletion, or an objection to any of the uses above. One email is enough — there is no form. We answer within a few days, and within a month at worst.

Deleting a face's design means the face stops updating on your watch, so we will say so before doing it. If you think we have handled your data badly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec).

Children

FaceForge is not aimed at children and we do not knowingly keep data about anyone under sixteen.