Privacy Policy

Last updated: November 4, 2026.

Who we are

PSL Rating (pslrating.info) estimates a PSL rating from the proportions of a face in one photo and explains how the scale works. The score is free. You can also buy credits for a written deep report. This policy says what we collect, why, and what choices you have.

Your photo

The free tool measures your photo in your browser, on your device. That photo is not uploaded. We do not receive the image, the measurements, or your exact score from the free tool. The free tool loads its code and model from this site. When analytics is on, the browser sends the limited events described below, without your photo, measurements, or exact score. After a men's score, the free tool keeps a smaller copy of the photo in your browser's storage on your device for 30 minutes, only so a deep report can use it after you sign in or buy credits. That copy is not uploaded and is not stored on our servers. It is deleted after 30 minutes, once you order a report, or when you switch the result to women's. You do not need an account, an email address, or a payment to use the free tool.

A deep report is different. You sign in with Google, buy credits, and upload one front-facing photo of yourself. Before the upload, you confirm that you are 18 or older and that the photo is of you. We send the photo, and the proportions the free tool measured, to fal, a third-party AI service. fal sends them through OpenRouter to Anthropic's Claude model, which writes the report. We set fal not to store the input or the output. fal, OpenRouter, and Anthropic process that data under their own privacy policies. We do not store the photo. We delete it as soon as the report is done. We keep the report text. We do not generate a face image, and we do not edit one.

The report is written by AI. It looks only at geometric proportions. It is not a judgment of a person, and it is not medical or psychological advice.

What we do collect

Server and security logs

Our hosting provider, Cloudflare, processes the technical data that every request to a website carries: your IP address, browser and device type, the page you asked for, the page that sent you here and the time. We use it to deliver pages, keep the site running and block abuse. The site itself writes error logs for the same purposes. None of these logs holds your photo.

Where you came from

If you arrive through a link tagged with utm_source, for example from a post or a newsletter, the site stores that tag in a first-party cookie named utm_source for 30 days. The cookie holds only the tag, such as the name of the site that linked here, so we can see which channels bring visitors.

If you arrive through a link with a ref code, your browser sends that code to the site. When the code belongs to a registered account with a confirmed email address, the site keeps it in a first-party cookie named sa_referral for 30 days. Otherwise nothing is kept.

Analytics

We use Google Analytics 4.

Visitors in the European Union, the European Economic Area, the United Kingdom, and Switzerland see an Accept / Reject bar at the bottom of the page. We count those visits only after the visitor chooses Accept. Visitors elsewhere are counted by default.

The "Cookie settings" link in the footer lets you change that choice. If you switch to Reject, we stop counting, delete the Google Analytics cookies, and tell our server to stop sending events for this browser. The Google Analytics Opt-out Browser Add-on also blocks the Google Analytics script in the browser.

When analytics is on, your browser sends psl_score_shown when a score appears, unlock_click when you click an unlock button, and sign_in_view when you view the sign-in page, including when you arrive from a result page. The score event contains only sex (male or female) and an integer score band; the unlock event contains only the clicked lock position and the credit pack (100 or 300 credits). The sign-in event only marks visits from the result page. These events do not include your photo, measurements, or exact score.

A page view records the page address without query parameters, the page title, and the referring site. It does not record the full referring address. Our server sends these conversion events with the Measurement Protocol: sign_up, begin_checkout, purchase, generate_start, generate_success, and generate_failed. We do not send your email, name, photo, or report text. We do not use this for ads. Google signals are off, and we set the advertising consent choices to denied.

Accounts

The free tool never asks you to sign in. A deep report does: you sign in with Google. If you sign in, we store the email address and name the sign-in gives us, the IP address and language at sign-up, the utm_source tag and referral code described above, and, for each sign-in, the session's IP address and browser. We also store your credit balance, your purchases, and the text of a deep report after the photo has been deleted. Signing in sets sign-in cookies in your browser. The sign-in pages load Cloudflare Turnstile to check that a visitor is a person. We use this information to run the account, provide the report, and keep it secure.

If you email us

If you write to us, we keep your message and your email address so we can reply and keep a record of the conversation.

Cookies

The free tool and the explanation pages work without cookies. You may also get the utm_source and sa_referral cookies from the links described above, and sign-in cookies if you sign in.

When analytics is on, Google Analytics sets _ga and _ga_<ID>, which last up to about 2 years. We set analytics_consent for 1 year to remember your choice. We set analytics_context for 30 minutes, and only while analytics is on. analytics_withdrawal_pending is present only after you switch to Reject, and only until our server confirms that change.

We also use self-hosted analytics with first-party cookies solely to count visits and identify invalid traffic, never for ads; you can refuse this in Cookie settings.

You can block or delete cookies in your browser settings, and the site stays usable without them. The "Cookie settings" link in the footer turns analytics off.

Who receives data

Cloudflare hosts and protects the site and stores its database. Cloudflare processes data under its own privacy policy and may do so outside your country.

If you buy credits, Waffo collects the payment, issues the invoice, and handles chargebacks. Waffo also processes refunds back to the original payment method.

If you order a deep report, we send your photo, and the proportions the free tool measured, to fal. fal sends them through OpenRouter to Anthropic's Claude model, which writes the report. We set fal not to store the input or the output. fal, OpenRouter, and Anthropic process that data under their own privacy policies. We delete the photo as soon as the report is done.

Google, through Google Analytics 4, receives page views (the page address without query parameters, the page title, and the referring site), the browser events described above (psl_score_shown, unlock_click, and sign_in_view), and the conversion events our server sends with the Measurement Protocol (sign_up, begin_checkout, purchase, generate_start, generate_success, and generate_failed); we do not send your email, name, photo, measurements, exact score, or report text, and Google processes that data under its own privacy policy.

We do not sell personal information.

Children

The site is not directed at children under 13. The photo tool, and buying credits, are for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us personal information, write to us and we will delete it.

Your rights

Depending on where you live, you may have the right to ask what personal information we hold about you, to have it corrected or deleted, and to object to how it is used. Most of what we hold about visitors is the technical data in Cloudflare's logs, which we cannot tie to a person. For account data or anything else, write to support@pslrating.info. We aim to answer within 30 days.

When an account is deleted, its data is removed or anonymized within 30 days, except where the law requires us to keep it.

Changes to this policy

We will change this page when our practices change, for example if we add a service that receives data or change how a deep report handles a photo, and we will update the date at the top.

Contact

Questions about this policy: support@pslrating.info.