Privacy policy

What Cosmae handles, and what it does not.

Cosmae is a Shopify app run by Zeeshan Shahid. This policy covers the app's try-on and skincare finder and this website. Questions: hello@cosmae.io.

Shoppers

Try-on

• Photos and camera pictures are processed in the shopper's browser only. They are not sent to Cosmae and not stored.
• The face tracker is Google's open-source MediaPipe, served from Cosmae's own server and run on the shopper's device. No outside service is called.
• Cosmae stores counts: that a try-on was opened, a shade was drawn, an item was added to the cart, and what was paid for a tried-on item. Each is tied only to a random try-on id.

Skincare finder

• The answers (how the skin feels, sensitive or not, chosen concerns, ingredients to avoid) are sent once to Cosmae to pick the products, and are not stored.
• Cosmae stores which products were shown, added to the cart and bought, tied to a random finder id, and the device type.
• The shopper may choose to add a selfie first. It is measured in the shopper's browser on their device, the same way as the try-on's photos, and is never uploaded or stored. It only suggests concerns, which the shopper confirms or changes; only the answers they confirm are sent.

For both

• Cosmae stores no shopper name, email, address, customer id or cookie, and keeps no shopper IP address in its database.
• Cosmae does not read the store's orders. A small script on the order confirmation page reports only the lines that came from Cosmae (the random id, the product variant and the price paid). It runs only where the shopper allows analytics.

Merchants

• Cosmae stores the store's domain, its products' ids, titles, shade names and colours, its skincare products' kinds, concerns and ingredient words, and its plans and usage per feature.
• Access requested from Shopify: read products, the app proxy and a web pixel. No access to customers or orders.
• Billing is handled by Shopify. Cosmae does not see payment details.
• When the app is uninstalled, Shopify sends a deletion notice 48 hours later and Cosmae then deletes the store's data.

This website

This website uses no cookies, no analytics and no tracking, and loads nothing from other sites. The server that hosts it may keep standard access logs for security.

Changes

If this policy changes, the new version is posted on this page.