Privacy Notice

The short version. History of Makeup is a reading site with optional reader accounts. If you only read, we keep almost nothing about you: there are no advertising cookies and no profile, and Google Analytics, which counts visits and shows us how the site is used, runs only if you accept it — never before, and never with your name, email address or account. If you open an account, we keep what you give us to run it, and a beauty profile only if you choose to fill one in. We do not ask about your health, height or weight. Nothing is sold, and you can download or delete everything yourself, from Settings, at any time.

Who is responsible

The controller of your personal data — the one who decides what is done with it and answers for it — is the operator of History of Makeup:

Operator

History of Makeup

Privacy contact

privacy@historyofmakeup.com

We have not appointed a data protection officer. Anything about this notice or your data goes to privacy@historyofmakeup.com, which reaches the person responsible. The full details of the operator are in the legal notice.

If you only read the site

Pages and server logs

The site runs on Amazon Web Services, with its database in Ireland (AWS region eu-west-1), and pages reach you through Amazon's delivery network, CloudFront. Like any web server, ours keeps a record of requests: the address asked for, the time and the response, and at the edge of the network your IP address and your browser's description of itself. These records are used to keep the site running and secure — to find faults and turn away attacks — and for nothing else. They are kept for 30 days, then deleted.

Pages load no scripts, typefaces or images from anyone else: the fonts, the pictures and the narration are served from our own address, so no third party learns what you read here — unless you accept Google Analytics, whose script then comes from Google and reports the pages you view, as described below.

Searching

What you type into search is sent to our server to find the results. A search of three characters or more is also sent to OpenAI, which turns the words into numbers that let us find articles by meaning as well as by exact words. OpenAI receives the words only — never your IP address, an account or any other identifier. Under its terms for this service it does not train on what it receives, and it says it keeps it for up to 30 days to detect abuse unless the law requires longer. We keep the numbers it returns, filed under a one-way code made from the words rather than the words themselves, so that the same search need not be sent twice.

Your last six searches are remembered in your own browser, for the search panel. That list is never sent to us.

If you have accepted Google Analytics, a search made on the search page, whose words appear in its address, is reported to it as well, words included, unless they look like an email address or a telephone number. What you type into the ingredient dictionary's or a section's own search box is not. See Google Analytics.

Product links

Product links pass through our own address (/go/…), which adds 1 to a count for that link, the page it was on, and the day. No identifier, IP address, cookie or profile is stored against the click. It is a number per link per page per day, and it cannot tell us who you are. If you have accepted Google Analytics, the click is also reported to it — which product, brand and shop, and the page it was on — as described below.

The shop you arrive at — Amazon.com, a brand's own shop, or an affiliate network passing you on to one — learns that you came from History of Makeup, through the affiliate tag in the link and the address your browser reports. From that moment its own privacy notice and cookies apply, not this one. See the affiliate disclosure for how the links work.

Writing to us

The contact form on the About page keeps what you write in it: your name, your email address, the reason you chose, your message and the date. Nothing else is recorded with it — not your IP address, not your browser. To keep robots out, the form counts how many letters arrive from one connection in an hour; that count is not kept with your letter and is discarded within a day.

Letters sent through the form are deleted 12 months after they arrive, or sooner whenever you ask.

Email you send to one of our addresses reaches us through our domain's mail forwarding (Namecheap) and is kept in the editors' mailbox, which is held by Google (Gmail). Letters and emails are read by the editors and used to answer you and, where one points out an error, to correct the article. Emails are deleted once the matter is closed and no longer needed as the record of a correction, and at the latest 24 months after our last reply — or sooner, whenever you ask.

The newsletter

There is no newsletter sign-up at present, and no address is collected for one. If a newsletter starts, this notice will describe it first.

Google Analytics, only if you accept

To learn which pages are read and how the site is used, we use Google Analytics 4 — only if you accept it. On your first visit a notice at the foot of the page asks, with "Reject" and "Accept analytics" side by side and nothing chosen for you. Until you accept, nothing at all is sent to Google: its script is not loaded and no analytics cookie is set. Rejecting changes nothing else about the site. We ask about analytics and nothing more: advertising, ad personalisation and Google signals stay off whatever you answer, so what is measured here is not linked to a Google account or used for advertising.

What it records, if you accept

• The pages you view: their address and title, the page you came from, and when. The address goes without anything after its "?", except the words of a search on the search page and a campaign's utm_ tags.
• What you do on them: whether you scroll to the end of a page; clicks on links to other sites and on product links; files you download; that a form was started or sent, never what you typed into it; playing the narration or the film (and which version of the film, upright or wide), and how far you got; hearts, what goes into or out of a list (never the list itself), shares, filters, looks opened and the sound switch; and pages that were not found. Each is recorded by the identifier of the page or product concerned, never by anything you wrote.
• Searches: the words of a search made on the search page, which appear in its address, and how many results it found.
• If you have an account: that someone joined or signed in, and whether with Google or a password, and that someone finished the questionnaire — never who, and never an answer. The questionnaire itself is never measured: a join or a finish there is recorded on the next page you open that is.
• Your device: its type, browser, operating system, screen size and language.
• Roughly where you are: Google works out your country, region and city from your IP address, then discards the address; Google Analytics does not log or store IP addresses.
• A random number for your browser, kept in the _ga cookie, so that several visits from the same browser count as one visitor. It is not linked to your name or your account.

What it never receives

Your name, email address, date of birth, password, account number, profile answers, the names of your lists, or anything you write to us. No account identifier is ever sent. The pages of your account, the questionnaire, the password-reset page and the site's administration are never measured at all: Google's script is not present on them. Every event the site itself sends is checked in your browser against a fixed list of what may be sent, and a value in it that looks like an email address, a telephone number or a sentence is dropped before anything leaves. Page addresses are cleaned the same way: without their query string (except as above), and with anything in them that looks like an email address taken out.

Cookies, and how long it is all kept

Google Analytics sets two cookies on this site, _ga and _ga_FDQKVFYGPX, which last up to 13 months after your last visit. In Google Analytics the records of visits are kept for 14 months and then deleted; the totals in its reports ("120 readers on Tuesday") describe nobody and stay. Your answer is kept in your own browser, under hm:consent:v1, with the date and the version of this notice you answered (now version 1), and is never sent to us. After 13 months, or if this section changes in substance, you are asked again.

Who handles it, and where

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, runs Google Analytics for us as our processor, under Google's data processing terms for Google Analytics. Google may process the data in the United States: Google LLC is certified under the EU–US Data Privacy Framework, and Google's terms also include the European Commission's Standard Contractual Clauses.

Why we may, and how to change your mind

The legal basis is your consent: Art. 6(1)(a) of the GDPR and, for storing and reading cookies on your device, Art. 5(3) of the ePrivacy Directive as Romanian law applies it (Law 506/2004, art. 4(5)).

You can change your answer at any time with Cookie settings, in the footer of the site's pages. Saying no after yes stops the measuring at once and deletes the Google Analytics cookies from this site. It does not undo what was sent before, which stays in Google Analytics until its 14 months are up, filed only under the random number the cookie held. We cannot connect that number to you, but if you send it to us (it is in the _ga cookie, so copy it before you say no), we will have Google delete what is filed under it.

Cookie settings

Global Privacy Control. If your browser sends it and you have not answered here, we take it as a no: the notice is not shown and nothing is measured, unless you accept analytics yourself from Cookie settings. An answer you have already given here stands until you change it there. The older Do Not Track setting is not read; without your yes nothing is measured anyway. If your browser will not store your answer, as some private windows will not, it holds until the tab is closed or reloaded, and you are asked again next time.

If you open an account

Your account

To open an account we need your email address, your name, your date of birth and a password — or your Google account instead of a password. Your date of birth is asked to confirm that you are 16 or over. Your password is never stored, only a one-way scrypt hash of it, which cannot be turned back into the password.

While you confirm your email address, the details you typed wait for the code for up to 15 minutes and are deleted within a day of it expiring. A cookie ties the sign-up to the browser you started it in, so that nobody else can finish it with a password of their own. One-time codes and reset links are kept only as one-way hashes and are deleted after 7 days.

If you sign in with Google, Google tells us your name, your email address, whether Google has verified it, your Google account's identifier and, for a work or school account, its domain. We receive nothing else — not your password, contacts, mail or files. Google knows you signed in to History of Makeup and handles that under its own privacy policy, as a separate controller. You can remove our access at any time from your Google Account, under Security, in "Your connections to third-party apps and services".

Staying signed in, and keeping the account safe

Each browser you sign in on has a session record: when it started and was last used, the kind of browser and system ("Safari on iPhone") and a shortened form of your network address (the first three parts of it). You see these in Settings, under Security, and can sign any of them out. A session lasts 24 hours, or 30 days from its last use if you ask to be remembered, and never more than 180 days; its record is deleted 30 days after it ends.

A security log records sign-ins, failed attempts, password and email changes, data downloads and similar events, with the IP address and browser they came from. It is kept for 90 days — also after an account is closed, no longer linked to it — so that misuse can be investigated. Sign-in attempts are also counted to slow down password guessing; the counters hold one-way codes, not addresses, and last at most a day.

Your beauty profile

After you join you may fill in a beauty profile: about you, your face, skin, hair and nails, what you use, your style, budget and values, and the history that interests you. Every question is optional, and any answer can be changed or deleted whenever you like. Each question says what its answer is used for. Most shape Vivien's picks (below); some are kept for your profile only and change nothing — your gender, for example, is counted only in anonymous totals.

What we do not collect at present. We do not ask about skin conditions, eye comfort or allergies. We do not ask for your height or weight. We do not record what you read or listen to. There is no newsletter sign-up.

You may also add a photo. We keep a small square copy that we make from it, with the camera, place and time stripped out; the original is never stored. Only you see it, and it goes when you remove it or close your account.

Health, height and weight

We do not ask about skin conditions, eye comfort, allergies, height or weight at present, and the permissions for them are not offered. If they are offered later, this section will describe how they are kept and used before anyone is asked.

Readers aged 16 and 17 may hold an account.

Saves, lists, your Cabinet and your listening

What you heart, the lists you make, the products in your Cabinet (what you use, want to try, or have ruled out) and the picks you set aside are kept in your account until you remove them or close it. Lists are private: there is no way to share one.

We do not record what you read or listen to. The "Reading and listening history" setting is not offered at present, so nothing about your reading is sent to us. While you are signed in, the narration player still tells our server where you stopped, and the server keeps nothing of it.

Before you sign in, hearts and listening positions are kept in your own browser only. When you sign in, your hearts are added to your account and the browser's copy is cleared; the listening positions are discarded.

Vivien's picks: how suggestions are made

Vivien is the voice of our editors. Her picks are chosen by fixed rules the editors wrote, not by an AI model, and nothing about you is sent to an AI service to make them. This is profiling in the legal sense, so here is how it works.

• What goes in: your profile answers, your Cabinet, what you have saved and listed, and the picks you set aside.
• What never goes in: your name (it is used only to greet you), your age and date of birth, your gender, your country and region, and your height and weight.
• What the rules do: leave out what you already own or have ruled out, and anything that contradicts a firm answer — a price band you never buy, a quality you said a product must have, a finish, coverage or skin type that is not yours, a brand you avoid. What remains is scored against your answers, and each pick keeps its reasons, so Vivien can tell you why she chose it and what she left out.
• What it can affect: which articles, looks and products appear on your For you page, and in what order. It has no legal or similarly significant effect on you, and no decision about you is made by it.
• How to stop it: in Settings, under Privacy & data, "Stop suggestions" switches it off. While it is off, nothing is worked out about you; your answers are kept, and it starts again only when you switch it back on. You can also set aside any single pick.

A day's picks are stored as codes — never as your answers — expire at midnight (UTC) and are deleted in the next daily sweep. A note of the picks you set aside, and where they were shown, is kept for 180 days.

Email we send you

We send the email an account needs: sign-in and confirmation codes, security notices when the way you sign in changes, a welcome, a warning before an unused account is closed, and a last message when an account is deleted. An editor may also write to you about your account or a letter you sent. Email is sent through Resend. We log each message — which one, the address, the subject, whether it was delivered — and keep its text, except for messages carrying a code or a reset link, whose text is never stored. The log is kept for 180 days.

If an address bounces or reports a message as spam, we keep the address and the reason on a list of addresses we must not write to, for as long as we send email. Ask, and we will take it off.

What the editors can see

To answer a question or a request about an account, the editors can open its page in the site's administration. They see your name, email address and age (never your date of birth); how you sign in, your devices with their network addresses shortened, and the security log; the email we have sent you; your consents and when you gave or withdrew them; whether you have paused Vivien's picks; and how many records of each kind are held about you. Of your beauty profile, your saves, lists and Cabinet, and Vivien's picks, they see only counts — how much of each chapter is answered and where you are in the questionnaire, how many hearts, lists and products — never your answers, what you saved, the names or notes of your lists or which picks you opened. They never see your photo or your password.

Why we may use it: purposes and legal bases

Where the basis is our legitimate interests, you may object, and we will stop unless we have compelling grounds — keeping the site secure, for instance. Where it is consent, withdrawing it does not make earlier use unlawful, but it ends the use at once.

Who else handles it

We do not sell personal data, and we have no advertising partners. These companies handle some of it for us, under contracts that let them use it only on our instructions, unless marked otherwise:

• Amazon Web Services EMEA SARL (Luxembourg) — hosting, the database and its backups, logs and page delivery. The database is in Ireland (AWS region eu-west-1); CloudFront serves pages from the location nearest to you.
• Resend — sends our email: it receives your address and the message.
• OpenAI — receives the words of a search, and nothing that identifies you.
• Google — holds the editors' mailbox (Gmail), where email you send us is kept. When you sign in with Google, Google acts as a separate controller under its own privacy policy.
• Google Ireland Limited (Google Analytics) — only if you accept analytics: measures how the site is used, for us, as our processor. It receives what is listed under Google Analytics above, never your name, email address or account.
• Namecheap — our domain registrar, which forwards email sent to our addresses.
• Amazon and other shops — receive nothing from us. They learn that you arrived from this site when you follow a product link, and are separate controllers from then on.

We would also disclose personal data to a court or public authority where the law requires it.

Transfers outside the EU

Your account and profile are held in the EU, in Ireland (AWS region eu-west-1), and their backups are kept only in the EU. Some of the services above are United States companies that may process data there (Resend, OpenAI, Google, Namecheap). Our email is sent from Resend's region in Ireland, but Resend is still a US company and may hold message records in the United States. Google Analytics, if you accept it, is provided by Google Ireland, and Google may process its data in the United States. CloudFront delivers pages from the server nearest to you, which may be outside the EU. Each of these transfers is covered by the European Commission's Standard Contractual Clauses, or by the company's certification under the EU–US Data Privacy Framework where it has one. Write to us for a copy of the relevant safeguards.

How long it is kept

Deletion happens in a daily sweep. The database is backed up automatically, and backups expire after at most 35 days, so something you delete can survive in a backup until then. Backups are used only to recover the site after a failure.

Cookies and what your browser keeps

If you are not signed in and have not accepted Google Analytics, this site sets no cookies at all. The two Google Analytics cookies are the only ones that need your consent, and they are set only once you give it (see Google Analytics). Everything else below is needed for something you asked for — staying signed in, finishing a sign-up, your hearts, remembering your answer about analytics — so it needs no consent, and none of it is used to follow you anywhere else.

Clearing this site's data in your browser removes everything kept there; it does not delete your account.

Your rights

You can ask us, free of charge:

• for a copy of your data, in a form you can take elsewhere. With an account, Settings → Privacy & data → "Download my data" gives you all of it at once, as one file.
• to correct it — most of it you can edit yourself, in your profile and in Settings;
• to delete it — "Delete your account" in Settings does it at once, and any single answer can be deleted on its own. See deleting your data;
• to restrict how it is used while something is put right;
• to object to a use based on our legitimate interests, and to switch off Vivien's picks ("Stop suggestions" in Settings);
• to withdraw a consent — in Settings, under Privacy & data, where withdrawing deletes what the consent covered; and for Google Analytics, with Cookie settings in the footer of the site's pages, which also deletes its cookies.

Anything you cannot do yourself, write to privacy@historyofmakeup.com. We answer within one month (two more for a complicated request, and we will tell you if so). We may ask you to write from the address on the account, or confirm a code we send there, so that nobody else can ask for your data.

You may complain to the data-protection authority. In Romania that is the ANSPDCP (Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Bulevardul General Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania, www.dataprotection.ro. Elsewhere in the EU you may complain to the authority where you live or work. We would rather hear from you first, but you need not ask us before you complain.

Age

Accounts are for readers aged 16 and over, and sign-up refuses an earlier date of birth. We do not knowingly keep data about anyone younger. If you believe a child under 16 has an account, write to privacy@historyofmakeup.com and we will delete it.

Security

Every page is served over HTTPS. The database sits in a private network, encrypted at rest; health, height and weight answers, where asked, are encrypted again with a separate key; passwords are stored only as scrypt hashes; and a session can be ended from Settings, or everywhere at once. Only the site's editors can reach the administration pages. If a breach puts your data at risk, we will report it to the ANSPDCP within 72 hours of learning of it, and tell you without delay where the risk to you is high.

If you live outside the EU

The same practices apply wherever you read from. We do not sell personal information or share it for advertising, and we offer no financial incentive for it. If your browser sends Global Privacy Control and you have not answered our analytics notice, Google Analytics stays off unless you turn it on yourself. We collect no health data. The rights above are open to every reader, wherever you live.

Changes to this notice

The date on this page changes whenever the notice does. If a change affects something you have consented to, the consent is asked for again — in Settings, or for Google Analytics in the notice at the foot of the page — and nothing relies on it until you agree.