Privacy
Browsing this site takes no account and sets no cookie. Signing in — which is only needed for live camera try-on — stores your name and email address, and nothing else.
What we store, and why
When you sign in with Google or Facebook we receive and keep four things: the provider you used, the account identifier that provider gives us, your display name, and your email address. That record exists so we can recognise you on your next visit and so the fingertip-tracking model is served to accounts rather than to the open internet.
We do not copy your profile picture, and we do not keep the provider's access token after the sign-in exchange has finished. There is no profile, no order history and no saved designs, because there is nothing on this site that needs them.
Your camera
Live try-on runs entirely in your browser. The video never leaves your device — no frame is uploaded, stored or sent to us or to anyone else. What is downloaded is the tracking model itself, about 9 MB, which is fetched once and then cached by your browser.
Cookies
One cookie, set only after you sign in: a signed session token, marked HttpOnly and Secure, scoped to api.dreamingnails.com, valid for 30 days and renewed
while you keep using the site. A second, short-lived cookie exists for ten minutes during the
sign-in handshake itself.
Both are strictly necessary to provide a service you asked for, which is why there is no consent banner. We set no analytics or advertising cookies of any kind.
Who else sees it
Google or Facebook, whichever you sign in with — they know you signed in here, and their own privacy policies govern that. Cloudflare, who host the site and the sign-in service and process requests on our behalf. Nobody else. We do not sell or share personal data.
How long we keep it
Your account record stays until you delete it. Sessions expire 30 days after their last use. Sign-in and model-fetch volume is recorded in aggregate for abuse detection, keyed by account identifier rather than by name or email.
Deleting your account
Your account page has a delete button, and it really deletes: the record is removed and every session you have open anywhere is invalidated. Two honest caveats about how that is stored — deletion propagates within about a minute rather than instantly, and afterwards there is nothing left for us to show you as evidence, because the record is simply gone.
Your rights
Under the GDPR you can ask for a copy of your data, ask us to correct it, or ask us to erase it. The first two are answered by the account page, the third by the delete button, and you can also ask us directly. You have the right to complain to your national data protection authority.