Privacy Policy

Last updated: October 16, 2026

This Privacy Policy explains what information rate-my-photo.com collects when you use our website and its free AI photo rating tool (the "Website"), why we collect it, how long we keep it and what rights you have. The Website is operated by rate-my-photo.com ("Rate My Photo", "we", "us" or "our").

If you do not agree with this Privacy Policy, please do not use the Website.

The short version

Your photo: Your photo is processed in memory on our servers only to calculate your rating. It is not saved afterwards, not shared with third parties, and not used to train or improve our software.
No account needed: You can use the Website without creating an account and without giving us your name, email address or payment details.
Your score: We keep the numerical score (not the photo) together with a pseudonymised identifier derived from your IP address, for usage statistics and abuse prevention.
Analytics: We use Google Analytics to understand how visitors use the Website.
No selling: We do not sell your personal information.
Age requirement: You must be at least 13 years old to use the Website, or at least 16 years old in regions where that higher minimum age is legally required.

1. Who is responsible for your data

rate-my-photo.com is responsible (the "controller") for the personal data processed through the Website. For any privacy question or request, please reach us through our contact page.

2. Your photos

Your photo is processed in memory on our servers only to calculate your rating. It is not saved afterwards, not shared with third parties, and not used to train or improve our software.

In more detail:

How your photo is processed: Before uploading, your browser reduces the photo to a smaller size. The resized photo is sent over an encrypted (HTTPS) connection to our web server, which passes it to our own image-analysis server. The analysis calculates an aesthetic quality score and returns it, together with the photo, so that your result page can show both.
No storage: Your photo is held in memory only while it is being analysed. It is not written to disk, saved in a database or included in backups. Because we do not keep your photo, we cannot show it to you again or retrieve it later.
No training: We do not use your photos to train, test or improve our AI models or any other software.
No sharing: We do not publish, sell or share your photos with third parties. While your photo is being processed, it passes only through the infrastructure that runs the Website (our hosting provider and our network and security provider, see section 5). These providers act on our instructions and may not use your photo for their own purposes.
No identification: We do not use your photo to identify you, and we do not create biometric templates or face profiles from it.
On your own device: Your result page displays your photo, so a copy may remain in your browser's cache or history until you clear them.

3. Other information we collect

a. Score records. When your result is ready, we save a record containing your score, the date and time, and a pseudonymised identifier calculated from your IP address with a secret key (a keyed hash). The record does not contain your IP address itself, your photo, or anything about what your photo shows. We use these records to keep usage statistics and to detect misuse, such as automated mass uploads.

b. Technical and log data. When you visit the Website, your browser automatically sends technical information such as your IP address, browser type and version, operating system, the referring page, the pages you request and the date and time of your visit. Our servers and our network and security provider record this information in log files to deliver the Website, keep it secure and fix errors. When you upload a photo, your IP address is passed to our image-analysis server along with it, for security and abuse prevention.

c. Analytics. We use Google Analytics 4, provided by Google, to understand how visitors use the Website, for example which pages are visited and which links are clicked. Google Analytics uses cookies and collects information such as the pages you view, your approximate location, your device and browser, and how you interact with the Website. According to Google, Google Analytics 4 does not log or store IP addresses. Your photos and your scores are never sent to Google Analytics. You can learn more in Google's Privacy Policy and in How Google uses information from sites or apps that use its services. You can opt out by blocking cookies in your browser or by installing the Google Analytics Opt-out Browser Add-on.

d. When you contact us. If you contact us by email, we receive your email address, your name if you include it, the content of your message and any attachments. We use this information only to answer you.

What we do not collect: The Website has no user accounts and no newsletter. We do not ask for your name, email address, phone number or payment details to use the photo rating tool.

4. Cookies

The Website itself does not need cookies to work. Cookies may be set by:

Google Analytics (for example _ga and _ga_<ID>): used to distinguish visitors and sessions. These cookies expire after up to 2 years.
Our network and security provider, Cloudflare (for example __cf_bm): strictly necessary security cookies used to tell people from bots. These cookies expire after a short time, typically 30 minutes.

You can block or delete cookies in your browser settings. The photo rating tool keeps working if you do.

5. Service providers

We use the following providers to run the Website. They process personal data on our behalf and only according to our instructions:

Hosting provider: runs the servers for the Website and the image analysis.
Cloudflare: network, content delivery and security services. All traffic to the Website, including photo uploads, passes through Cloudflare.
Database provider: stores the score records described in section 3a.
Google: Google Analytics, as described in section 3c.
Content delivery networks for code libraries (jsDelivr and cdnjs): when your browser loads the scripts, styles and icons used by the Website, these providers receive your IP address and browser information.

We may also disclose information if the law requires it, or if it is necessary to protect our rights, our users or the public, for example to investigate misuse of the Website.

6. Why we process your data (legal bases)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

Rating your photo: to provide the service you request (Art. 6(1)(b) GDPR).
Score records, server logs and security: our legitimate interest in running a secure and reliable service and preventing misuse (Art. 6(1)(f) GDPR).
Google Analytics: our legitimate interest in understanding how the Website is used, or your consent where applicable law requires it (Art. 6(1)(f) or Art. 6(1)(a) GDPR). If you have given consent, you can withdraw it at any time.
Answering your messages: our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR).
Legal obligations: where we must keep or disclose information by law (Art. 6(1)(c) GDPR).

7. How long we keep data

Photos: processed in memory only and not saved after your result is delivered.
Score records: kept for up to 24 months, then deleted.
Server logs: rotated automatically and usually deleted after about 30 days.
Google Analytics data: kept according to the retention setting of our Google Analytics account, for no longer than 14 months.
Messages you send us: kept as long as needed to deal with your request and any follow-up, unless the law requires us to keep them longer.

8. No selling of personal information

We do not sell your personal information.

9. International data transfers

Some of our service providers, such as Google and Cloudflare, may process data in countries other than your own, including the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, these providers rely on recognised safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

10. Data security

We protect your information with technical and organisational measures. All traffic to the Website is encrypted with HTTPS, photos are never stored, IP addresses in our score records are replaced by keyed hashes, and access to our systems is restricted. However, no method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

11. Age requirement and children

The Website is intended for users aged 13 and older, or aged 16 and older in regions where that higher minimum age is legally required. You must meet the minimum age that applies where you live, and you must not upload photos of anyone below the minimum age applicable to use the Website. We do not knowingly collect personal information from anyone below the applicable minimum age. If you believe that someone below the applicable minimum age has provided us with personal information, please contact us and we will delete it.

12. Your data protection rights

Depending on where you live, you may have the following rights regarding your personal data.

a. GDPR (European Economic Area, United Kingdom and Switzerland):

The right of access: you can ask for a copy of the personal data we hold about you.
The right to rectification: you can ask us to correct data that is inaccurate or to complete data that is incomplete.
The right to erasure: you can ask us to delete your personal data, under certain conditions.
The right to restrict processing: you can ask us to restrict the processing of your personal data, under certain conditions.
The right to object: you can object to processing that is based on our legitimate interests, under certain conditions.
The right to data portability: you can ask us to transfer your data to another organisation, or directly to you, under certain conditions.
The right to withdraw consent: where processing is based on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
The right to lodge a complaint: you can complain to a data protection supervisory authority, in particular in the country where you live or work.

b. California and other U.S. states: Under the California Consumer Privacy Act (CCPA) and similar state laws, you may have the right to know which categories and specific pieces of personal information we have collected about you, to request that we correct or delete it, and to opt out of the sale or sharing of your personal information (we do not sell or share it). We will not discriminate against you for exercising any of these rights.

How to make a request: Contact us through our contact page. Requests are free of charge. We will respond within one month, or within the period required by applicable law, and we may ask for information to verify your identity. Please note that we do not store photos, so there are no photos we could provide or delete. Our score records only contain a keyed hash of an IP address, so to find records that relate to you, we would need to know the IP address you used.

13. Links to other websites and apps

The Website links to other websites and apps, including our other photo tools and app store pages. These have their own privacy policies, and this Privacy Policy does not apply to them. Please read their policies before using them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date at the top. If we make significant changes, we will also show a prominent notice on the Website.

15. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, please reach us through our contact page.