Privacy
Last updated: October 18, 2026
Who we are
facemash (facemash.page) is an independent site. It is not affiliated with, endorsed by, or connected to any college or university. Contact: support@facemash.page.
What we collect
- Your school email address. We use its domain to work out which school you’re at, and the address to send login codes, to run the site, to answer you, and, if you are banned, to make a hash that blocks re-signup. It is never shown to other users.
- Your school (worked out from your email domain), your display name, which list you’re ranked in (men or women), the selfie you upload, and the date you agreed to these terms.
- Votes you cast, your rating and match count. Other users never see who voted for whom.
- Reports you file, including any details you type.
- Technical data: your IP address, browser and device type, and the times you visit. Our hosting, database, and bot-protection providers process this to run and secure the site, and it is kept in their logs.
We don’t ask for your location, contacts, birthday or phone number. We strip all hidden data from photos, including GPS location, before storing them.
Face checks and verification (biometric data)
- Every photo you upload is checked automatically by Amazon Web Services (Amazon Rekognition), our service provider, to make sure it shows one face and no nudity. This creates temporary face measurements. We only do this after you tick the consent box.
- If verification is offered at your school and you choose to get verified, we compare a live selfie with your profile photo using the same service. We only do this after you tick the consent box.
- facemash never stores the live selfie or any face measurements. They exist only in memory during the check and are discarded when it ends. We have told AWS not to keep or use them to improve its services. We never sell, share or use face data for anything else. Any face data held for us is destroyed when the check ends, and never later than one year after.
- Your verified status (yes/no) is the only result we keep.
Who can see your photo
Only people who log in with your school’s email address (checked by its email domain), and the site’s admins when reviewing reports. People at other schools can’t see your photo, your ranking or your reports. Your display name appears with your photo. Photos are stored privately and shown through links that expire after 10 minutes.
Service providers
Vercel (hosting and anonymous page-view analytics), Supabase (database, login and photo storage), Amazon Web Services (photo and face checks), Resend (sending login codes and emails), Cloudflare (domain, bot protection with Turnstile, and email forwarding), and Google (our support inbox). They process data only to provide their service to us. Vercel Web Analytics uses no cookies. It records the page, referrer, country/region/city, browser, OS and device type, and identifies visits by a hash that is discarded after 24 hours. We do not sell your data or use it for advertising.
School requests (“My school isn’t here”)
If you ask for facemash at a school that isn’t listed, we store only the school name and the email domain you type (like example.edu), with the time, so we know where people want it next. We don’t ask for your email address or name, and we don’t link the request to you or to an account. Requests are deleted within 12 months.
Emails
We send login codes when you ask for them. We may occasionally send announcements; every one has an unsubscribe link, and we honor unsubscribes within 3 days. You can also reply “unsubscribe” or write to support@facemash.page.
How long we keep data
- Profile, photo, votes, reports: until you delete your account, or we remove them for breaking the rules.
- Sign-ups that never entered their emailed code: deleted automatically after 30 days.
- Logins that never finished setting up a profile: until you delete the login from the setup page, or ask us to delete it.
- Live verification selfie and face measurements: not stored.
- School requests from the “My school isn’t here” form: deleted within 12 months.
- Banned accounts: a SHA-256 hash of the email address, kept to block re-signup. Someone who already knows the address could match it to the hash, so we keep it in the locked database only.
- Provider logs (IP addresses, delivery logs): kept by our providers for their standard periods, generally from 1 to 30 days; email delivery logs may be kept longer by our email provider.
- Backups: deleted data may remain in our providers’ backups for a limited time before it is overwritten.
Deleting your data
Delete your account from your profile page at any time. Your photo, profile, ranking, the votes you cast and the reports you filed are deleted at once (ratings other people already gained or lost from your past votes are not recalculated). If you never finished setting up a profile, delete your login from the setup page you see after logging in. If you can’t log in, email support@facemash.page from your school email address and we will delete everything within 10 days.
Reports and bans
Any user can report a photo. After three reports from different people the photo is hidden until an admin reviews it. Admins can restore it, remove it, or ban the account. A ban deletes the account and photos and keeps only the email hash above. To report a photo of you that someone else uploaded, use the report button or email us; we act on these first.
Age
facemash is only for people 18 and older. If we learn a user is under 18, we delete the account.
Security
We use encrypted connections, private storage, and strict database access rules. If a breach affects your personal information, we will notify you as required by applicable law, including Texas law.
Changes
If we change this policy in a way that matters, we will update the date above and tell logged-in users on the site.