Privacy

Last updated: 6 September 2026

Your photo

When you add a photo it is never sent anywhere. There is no server to send it to: this site is a set of static files with no backend.

• The face detection runs in your browser, using a model file downloaded from this site along with the page. The photo is not analysed by any outside service.
• The photo is kept in your browser's localStorage so the doll is still there when you come back. It is downscaled to 1200 px first if it's bigger. localStorage is readable only by this site, in that one browser, on that one device.
• Nobody else can see it. Not other visitors, not me, not anyone.

What is stored on your device

One localStorage entry, under the key mdf.v2:

• the photo, and the eye and mouth coordinates that were detected in it
• any manual adjustments you made in the fix the face panel
• the skin and hair colours
• the pose, haircut, held item and gear
• the name you typed and the click counter
• whether sound is on

None of it is transmitted. To delete all of it, press 🗑️ clear on the page, or clear this site's data in your browser settings. Uninstalling nothing, no email required.

Cookies

There are none. The site sets no cookies, and there is no third-party script that could set one either.

Analytics and ads

There are none of those either. No Google Analytics, no pixels, no ad network, no fingerprinting. The hits counter at the bottom of the page is a joke — it is a fixed number, it counts nothing.

Third parties

The page makes no requests to any other domain. Everything it loads — the code, the styles, the sounds, the face-detection model — comes from this site's own address. There is deliberately no CDN, so no outside company learns that you opened the page.

The links at the bottom of the page do go elsewhere: GitHub, X, and Ko-fi (the buy me a coffee button). Those are separate companies with their own privacy policies, and this policy stops where their sites begin. Nothing about you is passed to them beyond the fact that you clicked a link, which is how links work. Nothing on this site is loaded from them either — the Ko-fi button is a plain link, not their embedded widget, so Ko-fi doesn't see you unless you actually click it.

What the web host sees

This is the one thing that is not in my hands, and it applies to every website you have ever visited. The site is served by GitHub Pages. To send you the page at all, their servers receive your IP address and your browser's user-agent string, and may keep them in server logs. I have no access to those logs and get no report from them. That processing is covered by GitHub's Privacy Statement and, for the Pages service specifically, their Terms of Service.

Who this site is for

It's a joke site with adult humour, meant for adults. It isn't directed at children. Since no data is collected from anyone, no data is collected from children either.

The photo you upload is somebody else's face

Not a legal point, a decent-person point: the photo stays on your device, but the person in it still didn't ask to be a doll in lingerie. Use pictures of friends who will laugh, and don't post the result anywhere they wouldn't want it. That part is on you, not on the software.

Changes

If any of this ever stops being true — if ads or analytics get added — this page gets rewritten and the date at the top changes. The full history of every version is public in the repository, so you can check whether I actually did.

Contact

Open an issue on GitHub or say something on X.

← back to smacking