Halomax
Plans Log in Upload a selfie

Privacy Policy

Plain English, no fine print.

Last updated 1 November 2026. Contact: hello@halomax.top

This policy explains what Halomax does with your selfie and your details, in plain words. Questions or requests: hello@halomax.top.

The short version

  • Your selfie is sent once to make your Halo Card. Halomax never stores it; our AI provider deletes it within 24 hours.
  • A result you don’t pay for is deleted automatically after 24 hours.
  • A card you pay for (one card, or with a plan) stays in your account until you delete it.
  • Only if you turn on Progress (a plan feature) and tick its separate box, we keep the check-in selfies you take for it, until you delete them.
  • “Delete my account” deletes everything we hold about you.
  • We never see your card number. We don’t sell your data, show ads, or score faces.
  • Halomax is for people 18 and older.

Your selfie

Before your photo leaves your device, your browser makes it smaller and removes its hidden details (location, camera and time). It is then sent over an encrypted connection and used once, to make your Halo Card. Our server never writes your selfie to storage or to logs.

To make the card, your selfie is uploaded to our AI provider, Kie.ai, which runs the AI models that read the photo and make the after-image. Kie.ai deletes uploaded photos after 24 hours. It keeps the after-image it makes for 14 days and a technical log of each request (with the text instructions we send) for 2 months, then deletes them. We copy the after-image to our own storage and treat it as described below.

Most before-and-after close-ups on your result are made on your own device, from the copy of your selfie still in your browser; it isn’t sent again. The first after close-up is cropped on our server from the after-image.

Your Halo Card

Not paid
The result (the blurred preview, your steps and routines, and the email you gave) is kept for 24 hours so you can unlock it, then deleted automatically.
Paid (a single card or a plan)
The card (its after-image, steps and routines) is kept in your account until you delete it. Each card has a Delete button that removes it for good. Your selfie is not part of a saved card.

Progress check-ins (only if you turn them on)

Progress is part of a plan and is off until you turn it on and tick a separate box: “Save my check-in selfies so I can see my progress. I can delete them anytime.” Halo Card selfies are never kept, with or without Progress.

What we keep
Each check-in selfie you take for Progress (made smaller on your phone, without location or camera details), its date, the goals and check-in rhythm you chose, and the short AI notes comparing it with the check-in before. We also keep which steps of “Today’s plan” you ticked each day, to show your streak.
Why
Only to show you your own progress: your timeline, the Then / Now comparison and your streak.
Who sees them
Only you, when you are signed in. The photos are stored privately on Cloudflare, have no public link and are never shown to anyone else.
AI
To compare two check-ins, both photos are sent to our AI provider, Kie.ai, for that one comparison. Kie.ai deletes uploaded photos after 24 hours and keeps a technical log of the request (with the text instructions) for 2 months. No new image is made from your check-ins.
How long
Until you delete them. Each check-in has a Delete button. “Turn off Progress” deletes every check-in, photo and tick at once. If a check-in can’t be compared (for example, it looks like a different person), its photo is deleted straight away. Deleting your account deletes all of it.
Reminders
When your check-in is due, we email you a reminder to the address you sign in with, at most once every 5 days. Every reminder has a link to stop them, and you can switch them off or on in your account. Turning Progress off stops them too.

Your account

There are no passwords. You sign in with a 6-digit code we email to you.

Email address
To sign you in, keep your cards in one place and link your purchases to you.
Sign-in codes
Stored only in scrambled form (a hash), valid for 10 minutes and 5 tries.
Session
One cookie that keeps you signed in for 30 days. It is necessary for the account to work, so there is no cookie banner. We store only a scrambled form of it.
Purchases and plan
What you bought, when, your plan’s renewal date, how many cards you used this period, and, for buyers in the EU, EEA and UK, your country and the time you agreed to start access right away.
Your answers
Your style choice, skin and hair type, and what you’d like to work on, used to write your card.

Stopping abuse

Everyone gets one free preview. To keep it that way we remember, in scrambled form only (a hash we can’t turn back into the original), the email, a random device id and the internet address that made each free preview. We keep these for up to a year. Address fingerprints used for hourly limits expire after an hour.

On your device

  • The session cookie described above.
  • A random device id (local storage), for the one-free-preview limit.
  • For the length of your visit, the tag of the video that brought you here (for example ?src=acc3).
  • During a checkout, a one-time token that signs you in when the payment page sends you back.

No advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which is cookieless and collects no personal data.

We also count visits ourselves, anonymously: the country, the page and where the visit came from. No personal data, and no cookies for this.

Payments

Payments are handled by lava.top. You enter your card details on their payment page, never on ours, and we never see or store your card number. lava.top tells us your email, what you bought, the amount, whether the payment worked (and if not, its short reason), a contract number, and later any renewal, cancellation, refund or chargeback. lava.top’s own privacy policy covers what they do with your payment details.

Emails

Sign-in codes, and check-in reminders if you use Progress, are sent from hello@halomax.top through our email provider, Resend, using its servers in the EU. Resend receives your email address and the message, nothing else, and keeps a record that the email was sent so delivery problems can be found. We don’t send newsletters or marketing emails.

Our team chat (Telegram)

Short notes about how Halomax is used go to a private Telegram chat that only the Halomax team can read:

What you’d like to work on
Your picks and note, your style choice, the video tag and phone or desktop. Never your email.
“Coming next” votes
Which idea you voted for, your note if you wrote one, whether you were signed in, the video tag and phone or desktop. Never your email. To count one vote per person we keep only a scrambled fingerprint of your account or device.
A card made, unlocked, or a plan started, renewed or cancelled
Your email, the plan, your answers (style, skin and hair type, picks), the video tag, phone or desktop, and a cancellation reason if you gave one.
A payment that didn’t go through, a refund or a chargeback
Your email, the plan, the amount and lava.top’s short reason, so we can help or fix it.

These messages help us see what people want and what to build. Ask us and we will delete the messages about you.

Where it runs

Halomax runs on Cloudflare, which hosts the app and stores the account data described here.

What we don’t do

  • No face scores, ratings or rankings.
  • We don’t sell or rent your data and don’t share it with advertisers.
  • We don’t use your photos to train AI models.

Deleting your account

“Delete my account” in your account deletes your saved cards and their images, your Progress check-ins and their photos, your plan and purchase records we hold, your sessions and your sign-in, for good. An active subscription is cancelled first. Messages already in our team chat are deleted when you ask us. lava.top keeps its own payment records for as long as the law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it for a purpose. If you are in the EU, EEA or UK, you can also complain to your data protection authority. Write to hello@halomax.top from the email you use with Halomax.

Age

Halomax is for people 18 and older. We don’t knowingly collect data from anyone younger.

Changes

When this policy changes, we update the date at the top. For important changes we tell signed-in users before they apply.