Back to the app · Terms

Privacy

Last updated: 13 October 2026

This page says what Back in Color does with your photo and your data, in plain words.

The short version

• Your photo is read on your own device. It is not sent to us, with one exception explained below, where our server holds it for 15 minutes at most.
• We do not build or keep a face template, and we do not identify anyone.
• We never use photos or measurements to train anything.
• If you pay, we keep a record of the purchase so that you can get back to your result.
• No advertising cookies and no ad pixels. Nothing is sold or shared for advertising.

Who we are

Back in Color is run by Nik Novak, Ob dolenjski železnici 124, 1000 Ljubljana, Slovenia.

For anything on this page, write to us at hello@backincolor.com.

Your photo

Before the photo, the app shows what it will do with it and waits for you to agree. You can skip the photo and use your answers only.

If you give a photo, this is what happens on your own phone or computer:

• Your browser first redraws the photo as a new image, which leaves out the location and camera data stored in the original.
• A face-landmark model, served from our own site and run on your device, finds your skin, eyes and lips.
• The page measures their colors and three quality numbers: how bright the photo is, how even the light is across your face, and how much of the frame your face fills.

The photo itself and the landmarks are not sent to us. They exist only in the open page and are gone when you close or reload it.

The one case where a photo passes through our server

If you start on a computer and choose to take the selfie with your phone, you scan a code and the phone sends the photo to our server so that the computer can fetch it.

• The server holds the photo only until your computer collects it. It can be collected once, and it is deleted at that moment.
• If it is not collected, it is deleted when the code runs out, 15 minutes after the code was made, or sooner if you leave the code screen on the computer.
• The server checks that the file is an image and how large it is. It is not analyzed there, not copied and not used for anything else.
• Both screens show the same two-digit code, so you can see that the photo is going to your own screen.

Your computer then reads the photo in the browser, as described above.

What our server receives for the analysis

Your browser sends our server:

• the color measurements for your skin, eyes and lips, and the three quality numbers;
• six of your answers: your hair now, your natural hair color, your eye color, how your skin reacts to the sun, which jewelry metal suits you, and the decade you are in.

The server works out your result from what it is sent and stores none of it. It answers with a preview (your undertone and three colors) and a sealed copy of your result. Your browser keeps the sealed copy. Only our server can open it, and it shows you the full result only once you have paid. The sealed copy stops working after 30 days.

Your first name and your other answers are not sent to us. They stay on your device.

What stays on your device

Two cookies, both strictly necessary. Neither can be read by scripts on the page, and neither is used for advertising or tracking.

• bic_ent shows our server that this browser has paid. It is set when you pay or restore, lasts up to 400 days and is renewed each time you open the site. It holds the random reference of your purchase, an expiry time and a signature. Our server removes it at your next visit if the purchase behind it has been refunded.
• bic_co is set when you go to the card page, so that the payment can be tied to the browser that started it. It lasts 70 minutes and is removed when you come back and the payment is confirmed.

One entry in your browser's local storage, bic-flow-v1, so that you can close the page and pick up where you left off. It holds:

• where you are in the app;
• your first name, if you gave one, and your answers to the questions;
• your preview and the sealed copy of your result.

It is kept for 30 days from your analysis, or from when you started if there is no analysis yet. Coming back does not start the time again. After that the site no longer uses it, and deletes it the next time it is opened in that browser.

"Forget this device" and "Redo my analysis", both in your result, clear your name, your answers and your saved analysis at once. Neither removes the cookie that shows you have paid, so your colors stay unlocked in that browser. If you have not paid there is no button for this yet: the entry goes when its time is up, or at once if you clear this site's data in your browser settings.

Your photo, the measurements and your opened full result are never saved on the device. They exist only in the open page.

When you pay

You pay on a card page run by Stripe. Your card details go to Stripe only. We never see them.

What we record about a purchase:

• when you tap the button to pay: a random reference, the plan, your season and the date;
• when Stripe confirms the payment: the email you gave Stripe, Stripe's ids for the checkout and the customer, and the date;
• later: whether it was refunded, how many retakes you have used and, once a retake has replaced it, the season you first paid for, so that we can put it back if you ask.

If you tap the button and do not finish paying, the first of those records stays. It holds no email and nothing else that says who you are.

The records are kept in a database run by Cloudflare, in the United States, for as long as needed to give you access to your result and to meet our accounting duties.

Getting back in by email

"Already paid?" asks for the email you paid with. If a paid purchase exists for that address, we send a link to it. The link works for 20 minutes. Opening it does nothing by itself: the page asks first, and your browser gets access only when you press the button.

The page answers the same way whether or not the address has bought anything, so nobody can use it to find out who has.

To stop the form being used to send mail over and over, one address gets one link at a time and no more than 3 emails an hour: while a link still works, asking again does not send another. For that count we keep a keyed hash of each address typed into the form. It cannot be turned back into the address without our secret key. It stops counting after one hour, and is deleted by the first request for a link that arrives after that.

The email is sent for us by Cloudflare's email service, or by Brevo when that service is not in use. Whichever sends it sees your address and the link.

Analytics

We use PostHog (PostHog Inc., United States) to see where people leave the app and how many buy. It is set up like this:

• It stores nothing on your device: no cookie and no local storage.
• It records no sessions, no clicks and no typing. It can send only a fixed list of events.
• It is never sent your photo, anything measured from it, your result, your name, your email or what you answered.

What it records: which screens are reached; which of the example photos were looked at; how the photo was given (camera, upload or phone) and, with a phone, whether it connected and sent; whether the photo check passed, or the reason it did not; whether a result rests on a photo or on answers only; whether a payment was started and how it ended; and requests to restore or redo. With each event come general technical details such as browser and operating system, device type, screen size, language and time zone, the address of the page without anything after the question mark, the site you came from, and a campaign tag if the link you followed had one.

Your browser does not talk to PostHog. It talks to our own site, and our server passes the events on without your cookies. It does pass on your IP address and browser type, because PostHog works out a visitor number for the day from them, using a salt it discards daily. A visitor who comes back the next day counts as a new one.

When a payment completes or is refunded, our server also tells PostHog: the plan, the amount, the currency, and a code made from the purchase reference with our secret key. No email and no Stripe id.

If your browser sends Global Privacy Control or Do Not Track, the page sends PostHog nothing at all. The count of payments in the paragraph above comes from our server, not from your browser, and still happens.

No advertising cookies, no ad pixels, and nothing sold or shared for advertising.

Protection against misuse

Our server limits how often one internet address can call it. For that it uses your IP address, in counts that Cloudflare keeps for one minute at a time.

Who else handles your data

• Cloudflare: hosts the site, runs the database and can send the restore email.
• Stripe: takes the payment. For the payment itself Stripe acts on its own account, as an independent controller, under its own privacy policy.
• PostHog: analytics, as described above.
• Brevo: sends the restore email when Cloudflare's email service is not in use.

Cloudflare, Stripe and PostHog process data in the United States. For people in the EU, that transfer rests on the EU-US Data Privacy Framework or on standard contractual clauses, as each provider's terms set out.

Our legal grounds (EU)

• Contract: the purchase and the result.
• Your consent: reading your photo.
• Legitimate interests: product analytics without cookies, and preventing misuse.
• Legal duty: accounting records.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, or object to how we use it. Write to the address under Who we are. We answer within 30 days.

If we delete your purchase record, paid access to that result ends in every browser and it can no longer be restored.

If you live in the EU you can also complain to your data protection authority. In Slovenia that is the Informacijski pooblaščenec.

If you live in California or another US state, you have the rights your state's law gives you. We do not sell or share personal information.

Back to the app · Terms