Privacy policy
StealTheLook, by Goals and Gambles LLC. Last updated 2026-10-02. Applies to the website (stealthelook.app), the installable web app, the Android app (package com.goalsandgambles.stealthelook) and the iOS app (bundle com.goalsandgambles.stealthelook, including its share extension com.goalsandgambles.stealthelook.share).
What the app does
You give StealTheLook a reel, short, or screenshot and, optionally, a photo of yourself. It describes what is in the clip and links it to stores. Optionally it renders clothing onto your photo. Makeup Atlas shows each country's trending look, and can render that makeup onto a selfie if you give it one.
The app has four modes, and the mode decides what the detector is asked to describe: Steal the Look (clothing, shoes, bags, jewellery), Big Back Activities (food and drink), Cool Tech (gadgets, tools, appliances) and Who is dis?, which reads social media handles that are already written on the screen.
We do not identify people
We do not perform face recognition, face matching, or any other biometric identification, in any mode. No face template is created, stored, compared or sent anywhere. The detector is instructed in every mode to describe objects and on-screen text only, and never to describe, assess or identify a person.
"Who is dis?" finds an account by reading text that the video is already displaying - the creator handle overlaid on the video, an @mention in the caption, an @mention in a visible comment, or a watermark - and offers to open that account on TikTok, Instagram, YouTube or X. If no handle is written on the screen, it returns nothing. It cannot and does not identify anyone from their face or appearance.
Data we process
- Your photo / selfie. Kept in your browser's local storage on your device. It is sent to our server only when you ask for a render, forwarded to our rendering provider (Perfect Corp YouCam) for that render, and not stored by us afterwards.
- The reel, short, or screenshot. Sent to our server and to our detection provider (Google Gemini) to describe what is in it, according to the mode you chose. Detection describes objects and on-screen text only; it never identifies or analyses the people in the clip. Not stored by us.
- Age range (Makeup Atlas). A range such as 18-24, never a date of birth, kept only in your browser. Users under 13 are blocked.
- Clicks on shopping links. We record that a link was clicked, the destination store, the search phrase, the product mode (clothes, food, tech), a two-letter country code, and the time. No account is needed. Each click carries a random click id that the store's affiliate network reports back to us if a purchase follows, so we can count sales; it identifies the click, not you. When install analytics are enabled (above), the install identifier is attached as well.
- Anonymous scan trends. When a scan runs we record which mode asked, which surface (web or app), a two-letter country code, how many items were found, and the item descriptions themselves (for example "blue satin slip dress") - never the image, and never anything about a person. These rows carry no account and no device identifier.
- Install analytics (when enabled). To count active installs and see whether people come back, the app may generate a random install identifier on your device and send it with scans, searches and link clicks, together with your app version, operating system version, a coarse region code (such as a state or province, from the network edge - never your IP address or precise location), how the frames arrived (photo picker, share sheet, Watch mode, camera), and the text of searches you type. The identifier is not linked to an account, a name, an email address or an advertising ID, and you can reset it at any time from the You tab (iPhone) or Settings (Android), which starts a new one. It is used for product analytics and to attribute affiliate sales to the app; it is not shared with advertisers. This collection is switched on server-side only after the store listings declare it. On the website it is also subject to your privacy choice below.
- Cookies, local storage and ad measurement (website). The site sets one cookie, and only after you sign in: the session cookie, which is strictly necessary. Your mode, the age check and (if you add one) your selfie live in your browser's local storage and never leave your device on their own. Two things are optional and covered by the choice below: the install identifier described above, and ad measurement pixels (below). In the EU, EEA, UK and Switzerland neither runs until you tap Accept. Elsewhere they run unless you opt out here or your browser sends the Global Privacy Control signal, which we honour as an opt-out. We do not build advertising profiles.
- Account and credits (optional). If you create an account: email address, a password hash, and a credit ledger. Payments are handled by Stripe; we never see card numbers.
- Uploads are checked, cleaned and never stored. Every photo or video you drop in is checked for its real file type and size, re-encoded into a clean image with camera metadata (including GPS) removed, and only that copy is sent to our detection and rendering providers. Before a try-on or makeup render, an automated content check refuses explicit or violent images and photos that appear to show a minor. Refusals are counted, the images are not kept.
- Server logs. IP address and request metadata for rate limiting and abuse prevention, retained briefly.
Android app permissions
- Display over other apps: draws the floating StealTheLook button and results panel. We draw only our own views.
- Screen capture (MediaProjection): when you tap the button, captures a short burst of up to five frames of your screen across about one second, so you can scrub to the moment you meant. Nothing is captured without your tap. Android shows a persistent notification the entire time capture is enabled, and you can stop it in one tap. We never read other apps' data and never inject anything into other apps.
- Detecting that a video is playing: while capture is on, the app compares a very coarse 16x16 brightness grid of the screen about once a second, purely to know whether to light up the button. That grid never leaves your phone and is never stored. An optional setting (off unless you turn it on) uses Android's Usage Access to check whether the app in front is a feed app, so the button stays dark elsewhere.
iOS app permissions
iOS does not allow an app to read or draw over other apps, so there is no floating button and no screen capture on iPhone. A scan starts only when you hand the app a specific piece of media.
- Photos: the app uses Apple's system photo picker, which does not give the app access to your photo library. Only the single photo or video you tap is handed over, and only for that scan.
- Camera: used only when you tap "Use the camera", to take one photo of something you want to shop.
- Share extension: when you choose StealTheLook from another app's share sheet, that app hands us the one image or video you shared. We receive nothing else from it, and we cannot see anything you did not share.
- Saved looks: the frozen frame and the item descriptions are written to the app's own storage on your iPhone. They are never uploaded, and deleting the app deletes them.
Advertising and ad measurement (website)
We advertise StealTheLook on TikTok, Instagram and Facebook (Meta), Google and YouTube, and Pinterest. To learn which ads work, the website can load each of those platforms' measurement tag: the Meta Pixel, the TikTok Pixel, the Google tag (Google Analytics 4 and Google Ads) and the Pinterest Tag. When loaded, a tag tells its platform that a page was viewed, that results were shown, that a shopping link was tapped (with the store name and, if shown, the listed price) or that an App Store or Google Play link was tapped. The platform may combine this with what it already knows about your account on that platform, under its own policy; it receives your IP address and browser details as part of the request. We never send your photos, the clip you scanned, your email address or anything you typed.
- When they load. Only when we run a campaign on that platform, and only if your privacy choice allows it (see above and below). They never load if your browser sends Global Privacy Control or Do Not Track, even after you tap Allow.
- Campaign tags in links. If you arrive from an ad, the link's campaign tags (utm_source, utm_campaign and similar) are kept in your browser's local storage for up to 30 days, and the campaign name (never anything about you) is attached to shopping-link clicks and to App Store / Google Play links so we can see which campaign led to a purchase or an install. The ad click id the platform adds to the link (fbclid, ttclid, gclid, epik) is kept only when ad measurement is allowed.
- Sharing. Under some US state laws, letting an ad platform measure ads this way may count as "sharing" personal information for cross-context behavioural advertising, or as "targeted advertising". You can opt out at any time with the switch below. We do not sell personal information for money.
- The apps. The Android and iPhone apps contain no advertising SDK and no ad measurement pixel today.
Affiliate links
Shopping links are affiliate links (Amazon Associates and, where configured, Sovrn Commerce and other networks). As an Amazon Associate we earn from qualifying purchases; we may earn a commission at no cost to you. This is disclosed next to every link, and our ads say so too (#ad). Results are visually similar items, not necessarily the exact item in the video.
Third parties
Perfect Corp (YouCam) for rendering, Google (Gemini) for detection, Render for hosting, Stripe for payments, Amazon and Sovrn for shopping links, and, for ad measurement on the website only when allowed, Meta, TikTok, Google and Pinterest. Each processes data under its own policy; we send them only what the feature needs.
Your choices (Do Not Sell or Share)
Turn optional collection on or off for this browser. The choice is stored in local storage and applies immediately to the install identifier and the ad measurement pixels; a pixel already loaded on this page stops on the next page load.
Optional collection (install id, ad measurement) is currently … by default for your region.
- Clear your photo and age range any time with "clear my data" in the app, or by clearing site data in your browser.
- Delete your account and credit ledger by emailing the address below.
- Revoke the Android permissions in system settings; the app then runs as a plain web app.
Children
StealTheLook is not directed at children under 13, and Makeup Atlas refuses users who state they are under 13.
Contact
Goals and Gambles LLC, goalsandgambles@gmail.com.