Privacy, in plain words

Video never leaves your device. The camera picture goes straight into a pose model running inside your browser. It is not recorded, saved or uploaded, by us or anyone else. Only the 33 body points the model finds are used, for counting, and only while the test runs.

No account. You don't sign up. We don't ask for a name, email or phone number.

What is stored, and where

• On this device only (IndexedDB): each person's nickname, age and sex, and each check's date and results. We can't see it. Clearing the site's data in your browser, or "Delete all checks on this device" on the Family page, removes it.
• Family share links: the results are encrypted on your device (AES-GCM) and both the encrypted results and the key go after the "#" in the link. Browsers don't send that part of a link to any server, so the results never reach us. Anyone who has the full link can read it, so send it only to family.
• Calendar reminder: a file created on your device. No email is sent.
• Doctor summary: printed or saved by your own browser.

The camera and the pose model

• Camera counting uses Google's MediaPipe Pose Landmarker (an open-source library). Per MediaPipe's own privacy notice, processing of the input "takes place on device, and MediaPipe does not send that input data to Google servers".
• Usage metrics go to Google. The same notice says MediaPipe "send[s] metrics about the performance and utilization of the APIs" to Google, which uses them "to measure performance, usage, debug, maintain and improve" MediaPipe, as described in Google's Privacy Policy. These metrics are about how the library runs, not your video. We ask before the model loads, and you can avoid it entirely by counting by hand.
• Model files come from public CDNs. When you turn the camera on, the browser downloads the MediaPipe code and WebAssembly from jsDelivr (cdn.jsdelivr.net, version pinned) and the pose model file from Google (storage.googleapis.com). Those services see an ordinary download request (your IP address and browser type), as with any web download. After the first time, the files are kept in your browser so later checks can run offline.
• Counting by hand uses no camera and downloads no model.

What we do see

• Our web host's standard request logs for the page itself (IP address, browser type, time), as for any website.
• If you buy the Family plan: payment is handled by Stripe. We receive whether the plan is active, not your card details. Nothing about your checks is sent with it.

We never sell personal data. There is no advertising and no tracking across sites.