Nothing personal if you're reading. Your email and your posts if you join.

Last updated 7 October 2026

If you are just reading

We collect nothing that identifies you. Browsing the catalog, using the routine checker or the color questionnaire, and reading the community sets no cookies, runs no third-party analytics and stores nothing in your browser. We do not know who you are and have not built any means of finding out.

We do count visits, on our own server, so we know which pages are read. Each page view records the page, the site that sent you there, your country, whether you are on a phone, tablet or computer, your browser, and which links to other sites you follow. Your country is looked up from your IP address, which is then discarded, never stored. Visitors are told apart by a code made from your IP address and browser with a secret that is replaced every day and never kept, so we can count one visitor per day but cannot recognize you the next day or trace a code back to you. If your browser sends Do Not Track or Global Privacy Control, we do not count you at all.

The routine conflict checker and the color questionnaire send your selections to our own server to calculate a result, which comes straight back to you. Those selections are not stored, not logged against you, and not tied to any identifier. Reload the page and everything you entered is gone.

The one exception is the AI photo analysis, which stores your photo. It is described in full below.

If you open an account

An account means we hold the following, and nothing beyond it:

• Your email address. Used to sign you in and to contact you about the account. It is never shown publicly, and we do not run a mailing list.
• Your username, display name, bio and avatar. All public, because they appear on your posts.
• Your password, hashed with Argon2id. We cannot read it. Nobody who obtained our database could read it either; they would have to crack each one.
• What you post. Posts, comments, uploaded images, which posts you liked, and any reports you send — with the date each was created.
• The date you joined. Shown on your profile.

We do not ask for your real name, your age, your location or your phone number, and there is nowhere to enter them.

Your posts are public

Anything you post to the community is visible to anyone on the internet and can be indexed by search engines, under your username. That includes your bio and avatar. Deleting a post stops it being shown here, but search engines and archives may keep a copy we cannot reach. This is worth thinking about before posting a photo of your own face or anything you would not want a future employer to read.

Photographs you upload

Every uploaded image is decoded, resized and re-encoded on our server before it is stored. That process discards all embedded metadata, including the GPS coordinates most phones record. What we store is pixels — the original file, with whatever was attached to it, is never kept.

Photos in the AI personal color analysis

We consider your privacy important, and a photo of your face most of all. We never share your photo with any third party, and it is never shown publicly unless you choose to show it.

If you turn on “Include my photo” when sharing your result, a cropped copy of your face is published with that link, and anyone who has the link can see it. Links without it show your season and palette only. To take a shared photo down, contact us.

When you use the photo analysis, we keep the photo and its result for up to 365 days to provide and improve the analysis. It is then deleted automatically. The photo analysis is for people aged 14 and over; if you would rather not share a photo, the color questionnaire works without one.

Cookies

One cookie, set only when you sign in. It is named metic_session, contains a signed token identifying your account, lasts fourteen days, and is marked HttpOnly so that no script on the page can read it. Signing out deletes it.

We set no analytics or advertising cookies — visit counting uses none — and an essential sign-in cookie does not require consent under the EU ePrivacy rules. The one place a third party can set cookies is the Get The Look page, described below.

Who else sees anything

Fonts are served from Google Fonts, which receives your IP address when a font file is requested.

Instagram posts are embedded on the Get The Look page, using Instagram's own embed. Opening that page loads the posts from Instagram (Meta), which receives your IP address and browser details and may set or read its own cookies, especially if you are signed in to Instagram. Its handling is covered by Instagram's privacy policy. Nothing else on this site is embedded from elsewhere: no comment widgets, no video players, no share buttons that phone home, and no other third-party scripts.

Our hosting provider necessarily processes the data in order to run the servers, and keeps ordinary access logs — IP address, page requested, timestamp — as essentially every web server does.

We have never sold or shared personal information, and we are not going to. There is no advertising network here to sell it to.

Affiliate links

Following an affiliate link hands you off to a retailer or affiliate network, which will typically set a cookie to attribute the sale. That happens on their side, under their privacy policy, and only if you click. Our affiliate disclosure says which links those are.

Why we are allowed to hold it

Under the GDPR and UK GDPR we rely on two grounds. Holding your email, password and profile is necessary to perform the contract of giving you the account you asked for. Keeping reports, moderation decisions and the record of who wrote what rests on our legitimate interest in keeping the community usable and defending against abuse. Counting visits rests on the same legitimate interest in knowing which pages are useful, and is designed so that nothing it keeps can identify you. The AI photo analysis rests on your consent, given when you choose to take or upload a photo.

How long we keep it

• Your account: until you ask us to delete it.
• Deleted posts and comments: hidden immediately and replaced with a note, then removed from the database within 30 days. They stay briefly because a thread with a hole in it is unreadable, and because a moderation decision should be reversible for a short window.
• Reports: kept while the account exists, so a pattern of behavior is visible rather than resetting each time.
• Color analysis photos: 365 days.
• Photos you add to a share link: kept with the link until you ask us to remove them.
• Visit counts: 400 days, so a month can be compared with the same month a year earlier.

Countries are looked up with IP Geolocation by DB-IP, a database kept on our own server; your address is not sent to them.

Your rights

You can see and change your display name, bio and avatar under Settings, and delete any post or comment yourself at any time.

For a copy of everything we hold, a correction, or deletion of the whole account, email admin@meticbeauty.com from the address on the account and we will action it within 30 days. Deleting the account removes your email, password and profile; posts you have made are removed too, unless a thread depends on one, in which case it is detached from you and left as an anonymous tombstone.

If you are in the EU or UK you also have the right to complain to your data protection authority. If you are in California, we have never sold or shared personal information and you will not be treated differently for exercising any of these rights.

Children

Accounts are for people aged 16 and over. This site is not directed at children, and if we learn that an account belongs to someone younger we will delete it and its content. The AI photo analysis is for people aged 14 and over, and we delete any photo we learn came from someone younger.

Security

Passwords are hashed with Argon2id. Session cookies are HttpOnly and SameSite=Lax. Uploads are re-encoded rather than stored as received. None of that makes a breach impossible, and we would rather say so than claim otherwise — if one happens we will tell affected members and the relevant authority within 72 hours.

Changes

If we start collecting something new, we will update this page and the date at the top before turning it on, not afterwards.

Contact

Questions about this policy go to admin@meticbeauty.com, which is the only channel we operate for it.