Just Style Me

Privacy policy

Effective 2026-11-04. This policy describes the public site at https://juststyleme.com. Contact hello@juststyleme.com.

The short version

If you check the consent box and ask for a guide, we store the downscaled selfie, the measured numbers, the season, and the written guide. The paid sections of that guide are stored with it and are not sent to the browser until the report is paid. We also store the IP address, the country and city Cloudflare attaches to the request, the browser’s user agent, and the referrer. Ordinary page views are logged the same way, without the photo. A report link is an unguessable id. It does not contain the photo.

Photos

The landmark model runs in your browser and samples skin, hair, eyes, and lips on a canvas scaled to a long edge of at most 840 pixels. That model file is MediaPipe’s Face Landmarker, served from our site, so the measurement step does not send the picture to a third-party vision API. When you consent and submit, that same downscaled image is uploaded and stored in Cloudflare R2. It is not placed on a public URL. The owner can view it only after signing in. A request without the consent flag is refused.

What an analysis record contains

The server recomputes undertone, value, contrast, chroma, face shape, and season. It does not trust a label the browser guessed. We do not sell these records.

Where the numbers go

The site is hosted on Cloudflare. Records live in Cloudflare D1. Photos live in Cloudflare R2. The writing step calls Cloudflare Workers AI with the measurements and the palette we already chose. A separate vision model may also see the downscaled photo for a short note on hair, brows, or glasses. That note is skipped if the model is slow. We do not ask it for race, ethnicity, or a score. The text model configured for production is Llama 3.3 70B, served by Cloudflare as @cf/meta/llama-3.3-70b-instruct-fp8-fast. Cloudflare currently describes that model as zero data retention. That is their policy for the model, it can change, and the prompt contains color numbers and palette names. If the model does not respond, we do not substitute a library guide. That attempt fails and the photo is not kept. Local development can still use library copy when a mock flag is on, and the report says so.

Turnstile, Cloudflare’s bot check, runs on the analyze action. The widget loads from Cloudflare. Our server checks the token with Cloudflare’s siteverify endpoint and requires a successful result. On production it also checks the action name and the hostname. Testing keys are refused unless a local development flag is on.

Share links

New reports open at a private link such as /report?id=…. The id is unguessable. Anyone with the link can see the free sections. Paid sections are loaded from the server only after that report is marked paid, and then anyone with the link can see them too. Older links may still carry a compressed guide in the URL fragment. Fragments are not sent in the HTTP request. Do not post a link in a place you would not post the written description of your coloring.

The free reading and payments

One free analysis is allowed per signed device cookie, per IP address, and per email address when you give one. The cookie is named jsm_device. It is HttpOnly, SameSite=Lax, and lasts about a year. On HTTPS it is also Secure. It is signed so it cannot be edited into a new free allowance. It is not an advertising identifier.

The full report is a one-time $19.99 payment through Stripe Checkout. Stripe receives the card details, the email you enter there, the amount, and the report id in the checkout metadata. We store the Stripe session id, amount, currency, email, report id, device id, and time. We do not store card numbers. A signed webhook from Stripe, or a confirmation that checks the session with Stripe, marks the report paid. Paying also allows new analyses for 30 days on that device and email. The pass is not shared with everyone on the same IP address. A purchase record can be viewed by the owner in the admin tool.

Cookies and local storage

Before you choose Accept or Reject, we do not set a preference cookie. The choice itself is stored in a first-party cookie named jsm_consent, for about six months, with SameSite=Lax. On HTTPS it is also marked Secure. That cookie remembers the choice. It is not an advertising identifier. The device cookie described above is set when you ask for a reading or start checkout, because the free allowance has to survive a refresh.

Advertising is off in the default configuration. The layout has slots, and they render nothing until a publisher ID is added and the ads flag is turned on. If that happens, Google AdSense scripts and cookies load only after Accept. Reject means those scripts are not injected. Google’s own policy describes what AdSense cookies do; we do not control Google’s subsequent processing. An ads.txt file will list Google as a seller only when a real publisher ID exists. We will not publish a fake ID.

Page views, messages, and the newsletter

A page view of an HTML document is stored with the path, time, IP address, country, city, user agent, and referrer. Static files such as scripts and images are not each written as a page view. The contact form stores the name, email, message, and the same connection details. The newsletter form, in the footer and on the results page, stores the email address, where you signed up, and the same connection details. A digest subscription stays pending until you open the confirmation link. It stores frequency, topics, language, and the time of each send, open, and click. The unsubscribe link stops the digest. An optional account stores your email, display name, selected topics, a style summary from saved readings, and the reports tied to that email. Sign-in codes are stored as a hash and expire. Comments, community posts, and flags store the text, the account, and the time. A community photo goes in the same private bucket as analyzer photos. Google sign-in, when enabled, gives us the verified email and not a Google password. Admin sign-in attempts, successful and failed, are stored with time, IP address, user agent, country, and city. Passwords are not stored. The owner signs in with a hash kept as a Worker secret.

We keep these records so we can operate the analyzer, answer mail, send the notes you asked for, see which pages are used, and notice abusive sign-in attempts. Cloudflare also processes requests to deliver and secure the site.

Children

The site is not directed at children under 13, and we do not knowingly collect personal information from them. The analyzer should be used by the person in the photo, or with their permission.

Retention

Selfies, analysis records, contact messages, newsletter addresses, page views, and admin sign-in logs are kept until you ask us to delete them or an owner deletes them in the admin tool. There is no automatic expiry in this version. Cloudflare’s own operational logs may also include request metadata under Cloudflare’s retention. We do not store the Turnstile token or the admin password.

Your requests

To ask for deletion or a copy, use the contact form or write to hello@juststyleme.com. Name the email address you used, the approximate time, and whether you want the selfie, the reading, a newsletter address, a message, or page-view rows removed. We will delete the matching database rows and the R2 photo. You can also clear the preference cookie and the result link from your own browser. The result link is not how we store the photo.

Changes

If we change what is stored, this page will change and the date at the top will move.