Privacy

The short version

You pay, you upload photos, we analyze them, you get a written reading by email. Your original uploaded photos are automatically deleted within 3 days after your reading is successfully delivered. Your finished reading intentionally keeps a small, optimized copy of your photo inside it — that copy is part of what you purchased, and it belongs to your report, not to a photo library.

Your photos

Uploaded photos are used for exactly one purpose: producing the reading you purchased. They are stored in a private bucket, are never made public, never used to train AI models by us, and never reused for any other customer or purpose.

Deletion schedule, enforced automatically:

• Delivered readings — every original uploaded photo is deleted within 3 days after your report is successfully delivered.
• Unfinished orders — if you pay but never finish uploading, anything you did upload is deleted within 30 days.
• Backups — encrypted off-site copies of our database and delivered readings are kept for up to 60 days, then deleted. Your original uploaded photos are never included in backups.

Deletion covers the original uploaded photo files. What remains afterwards: the reduced, display-optimized copy embedded in your delivered reading (with camera metadata such as location stripped), and the non-image records described below. Nothing else contains or can reconstruct your original images.

What we keep, and why

• Your reading (the delivered report, including its embedded optimized photo copy) — kept so you can re-access it and we can re-send a lost link. Download links expire after 30 days; a fresh link can be issued on request.
• The written analysis behind your reading (non-image data: categorical observations, scores, and the reasoning trail) — kept so your reading stays consistent if it is ever re-generated, and for quality assurance. It contains no images.
• Transaction records (what was purchased, when, payment status) — processed by Stripe and kept as required for accounting and law. We never see or store your card number.
• Contact details you provide (email, name, and date of birth for numerology readings) — kept to deliver the service and handle support.
• Quality/audit metadata (which processing steps ran, when, and technical quality indicators) — kept to keep the product honest and debuggable. No images, no image URLs.

Who processes your data for us

We use a small set of service providers, each only for what their name suggests:

• Stripe — payment processing.
• Supabase — database and private file storage.
• Anthropic — the AI that analyzes your photos and writes your reading. Photos are sent for analysis only.
• Resend — sending our emails to you.
• Netlify — hosting this website.
• Sentry — tells us when something breaks. Error reports are stripped of personal details before they are sent.
• Cloudflare — encrypted off-site backups.

We do not sell or rent personal information to anyone.

The Mirror Read (free exercise)

The Mirror Read at /mirror-read is a free self-observation exercise. It does not request, capture, upload or process any photograph, camera stream or biometric template — you look at your own mirror or your own phone, and tell us what you see.

What we keep when you enter your email: the email address, the five answers you chose (including "I can't tell"), which page you arrived from and any campaign labels in that link, the wording and version of the consents you saw, and the time you sealed your answers. A cryptographic fingerprint of your sealed answers is recorded in our append-only audit log so the seal can be shown to predate any purchase; that fingerprint contains no personal information.

Your Mirror Read answers are never given to the Decode Engine. A reading you later purchase is produced from your photos alone; our generation system cannot read the Mirror Read records at all. Your answers and the reading are only ever placed side by side on your private comparison page, and only when you bought that reading through a link that carries your own Mirror Read — we never join a Mirror Read to a purchase by matching email addresses.

Deletion: email hello@youdecoded.ca and we erase the Mirror Read record — the email address and your answers are removed and the email series stops. The audit log keeps only the fingerprint and internal ids.

The First Impression Preview pilot (/first-impression)

Our First Impression Decode pilot offers a Free First Impression Preview to a small, capped number of people. When you enter your email there, we keep the address, which page you arrived from and any campaign labels in that link, and the times you reached each step. We send you a verification email first; nothing else happens until you click it.

If you continue, we keep the first-minute impression choices you select (and any short note you add), and your two guided photos are processed exactly like a purchased reading: analyzed by our AI provider to produce your reading, with the same automated photo-quality checks. Your complete reading and its first-impression layer are generated once, before any payment; the free preview shows you a bounded excerpt, and the rest stays on our servers unless you unlock it.

Photo deletion for the pilot: if you unlock your Decode, original uploads are deleted after delivery, exactly like any purchased reading. If you never unlock it, original uploads are deleted within 14 days of your preview being ready (or of a failed generation). If you start but never finish uploading, anything uploaded is deleted within 30 days.

The pilot is individual-only: your preview, your reading and your answers are private to you, never shared with an employer or anyone else, and never used for employment screening. There is no mailing list: the pilot's emails are the verification link, the note that your preview is ready, and — if you unlock — your delivery email.

Deletion: email hello@youdecoded.ca and we erase the pilot record — the email address, your choices and the generated content are removed. The audit log keeps only internal ids.

The complimentary company Decode (/sales)

We offer one complimentary, complete First Impression Decode per company to one person who wants to try it before bringing it to their team. To claim it you give your name, your work email, your company name and, optionally, your role. If you use a personal email address (for example Gmail or Outlook), you also give your company website, and a person at You, Decoded checks that the company is real before anything else happens. We keep the company's web domain so that each company receives only one complimentary Decode. We also record which page you arrived from and any campaign labels in that link, and the times you reached each step.

We send you a verification email first; nothing is generated until you click it (and, for personal addresses, until we approve the claim). After that it works exactly like the First Impression Decode: your first-minute impression choices, two guided photos with the same automated photo-quality checks, one reading generated by our AI provider, and delivery to you. Original uploads are deleted after delivery, exactly like any purchased reading.

The Decode belongs to you, not your company. It is private to you: no manager or employer can see it, it is never shared with your company, and it is never used for hiring, screening, or performance decisions. If your company later buys Decodes for a team, we note that the purchase followed your complimentary Decode, but that link carries no part of your reading. There is no mailing list: the emails are the verification link, an approval or decline note where a review was needed, the note that your Decode is ready, and your delivery email.

Deletion: email hello@youdecoded.ca and we erase your record: your name, email address, role, choices and the generated content are removed. We keep the company's web domain and the audit log's internal ids so the one-per-company limit still holds.

Requesting the sales example (/sales-teams)

Our Sales Presence Pack page lets a manager ask to see an anonymized example of what a participant receives. That form collects exactly three things: the name you type, your work email, and a team-size range. We also record which page you arrived from and any campaign labels in that link.

The submission is one-time fulfilment: we send the requested example and the founding-pilot details in a single email, and we notify our founder of your request so a reply can be personal. It does not add you to a mailing list.

The form also carries an unticked consent line. If you tick it, you are asking for up to two short follow-up emails about the founding pilot (about two and five days later). We store that consent with its wording version and timestamp. Every follow-up carries our identification, our mailing address and a one-click stop link that works immediately; the follow-ups also stop on their own if you buy a pack, if a message bounces, or if a complaint is recorded. Leaving the box unticked means the example is the only email you receive.

To deter automated submissions, your browser performs a short computation before the form is accepted (a proof-of-work challenge issued by our own server). No third-party service is involved and nothing about you is sent anywhere for it.

Deletion: email hello@youdecoded.ca and we erase the request record.

Sales Presence Pack (team purchases)

When a business buys a Sales Presence Pack, we collect the buyer's email and payment (through Stripe) to run the pack. The buyer chooses the team size and receives one private invitation link per seat and a status page that shows aggregate completion counts only. The buyer never receives, and we never show the buyer, any participant's email, photos, reading, intent answers, decline, or individual status.

Each participant claims a seat with their own email. That email is used only to deliver their own First Impression Decode and the related messages about it; a participant is added to marketing email only if they separately opt in during their own reading. A participant's photos and reading follow the same handling and deletion rules as any other reading described above, and are private to that participant.

The intent answer a participant gives ("what do you want customers to feel") is stored with their seat, is never shown to the buyer, and is never used to produce or change their face reading. During this founding period the Pack is offered in Canada excluding Quebec.

Deletion: a buyer or participant can email hello@youdecoded.ca to erase their record.

Email

Operational email (your report delivery, and a reminder if you paid but haven't finished uploading) is part of the service you purchased.

Promotional email is strictly opt-in: we send it only if you ticked the optional box at upload time, and every promotional email contains a one-click unsubscribe that works immediately and permanently. Unsubscribing never affects delivery of a reading you've purchased.

The Mirror Read series is a finite set of six emails you request by entering your email in that exercise: your saved read, then five short notes over the following week. It is described in exactly those terms where you enter your email, and it is separate from the optional, unticked box for ongoing email beyond the series. Every message in the series carries a one-click stop link that ends the whole series immediately; buying a reading also ends the remaining series emails.

Analytics and advertising

We advertise on Meta (Facebook and Instagram), and this site loads the Meta advertising pixel so we can measure which ads lead to a purchase.

What it records: that a browser visited a page here, that someone started a checkout (and which reading it was for), and — after a completed checkout — that a purchase happened and its value. On The Mirror Read it also records that an email address was entered (a standard "Lead" event) and that all five observations were sealed (an event named "MirrorReadSealed") — both carry no details at all: not the address, not the answers. A request for the sales example on our Sales Presence Pack page records the same parameter-free "Lead" event. We do not send Meta your name, your email, your date of birth, your answers, your reading, or your photos. Advanced Matching is off, and we do not build custom audiences from customer data.

Meta sets its own cookies through that pixel and its use of them is governed by Meta's own policies. Blocking third-party cookies or using a tracker blocker does not affect your reading in any way.

If you arrive from one of our ads, we also keep one small first-party cookie holding the ad-campaign labels from that link (nothing else, and never anything about you), so we can tell which ad led to a purchase. It expires after 30 days and is not set on ordinary visits.

Your choices and rights

Email hello@youdecoded.ca to access, correct, or delete the personal information we hold about you, or to ask anything about this policy. Deletion requests are honored except where a record must be kept by law (for example, transaction records). We respond from Canada under PIPEDA.