Privacy & security
Their photo stays theirs.
A try-on needs a photo of you. This page explains exactly what happens to it, what the extension reads on the pages you visit, and what the stores you shop on can and cannot see.
Your photos
The life of a photo.
Photos are saved to your account so you do not have to upload again, and used only for your own try-ons. Looks are saved too, until you delete them.
In the browser
Before upload, the photo is redrawn through a canvas: resized to at most 1024px and re-encoded. The copy that leaves the device carries no EXIF data — no GPS location, no camera or device details.
On the server
Peek The Look re-encodes it again (≤ 1536px, WebP) and stores it under your own account in a private Cloudflare R2 bucket. There is no public URL.
When it is shown
Photos and looks are read through signed links that expire within an hour. A link copied out of the panel stops working.
When it is deleted
You can delete a photo, a look, or your whole account from the profile menu. Deleting a photo also deletes the looks made from it; deleting the account deletes everything.
The extension
What Peek The Look does on the pages you visit.
It reads the page to find the garment
On the page you are viewing, Peek The Look looks at the product details the store publishes (its name, photo and the structured data meant for search engines) and the product photos in listings. That is how it knows what to put the “Try on” button next to.
It only wakes up for clothes
The widget is loaded from Peek The Look’s server only on pages where the extension finds something to try on. Other pages never contact Peek The Look at all.
It sends only what you try on
When you press “Try on”, the garment’s image address and name go to Peek The Look so it can make the try-on. Loading the widget on a product page is an ordinary web request to Peek The Look’s server; nothing else from the page is sent.
It changes a store’s security only when you ask
The toolbar switch that lets the panel load on stores with a strict security policy is off everywhere until you click it — then only for that exact site, until you click again.
What stores see
The store can tell a try-on happened. Nothing more.
Your photos stay in Peek The Look’s panel
The panel is a separate, cross-origin frame. The store’s page and its scripts cannot see inside it, so they never see your photos or your looks.
The store learns very little
The panel runs on the store’s page, so the store could notice that Peek The Look is there and that a try-on happened for one of its products. Nothing more crosses over: no photo, no name, no email.
You agree to Peek The Look, not the store
Creating an account or logging in means agreeing to Peek The Look’s Terms of Service and Privacy Policy, which open inside the panel. The version you agreed to is recorded with the time.
Isolation
On the store’s page, but walled off from it.
Peek The Look puts a small launcher on the page and opens the fitting room in a separate frame. Each part is constrained so neither Peek The Look nor the store can interfere with the other.
Its own corner of the page
The launcher is drawn inside a <lara-widget> element with its own shadow root and fully reset styles. The store’s styles cannot distort it, and Peek The Look’s cannot leak into the store.
A strict message channel
The page part and the panel talk over postMessage with a fixed target origin — never "*" — and check both the origin and the sender of every message. Anything unexpected is dropped.
No interference with the store
Peek The Look writes one global (window.Lara), nothing to the store’s cookies or storage, and never blocks the store’s own clicks, scrolling or keyboard handling.
Platform
Behind the panel.
Sessions
Passwords are hashed with scrypt and session tokens are stored hashed. Sessions last 30 days and are sent as an HttpOnly cookie, or — where the browser blocks third-party cookies — as a bearer token kept on Peek The Look’s origin.
CSRF and CORS
Cookie-authenticated requests must carry Peek The Look’s own key header, and the API never answers cross-origin requests with a wildcard.
Garment images treated as untrusted
Nothing from a store’s page — the product included — is treated as identity or authorisation. Garment images are fetched as untrusted input: http(s) only, with private network addresses blocked, a size cap and a timeout.
Payments through Polar
Credits are bought on Polar’s hosted checkout, in its own tab. Card details are never entered in the panel and never reach our servers or the store; we receive only a signed confirmation of the order, checked before any credits are added.
Rate limits
Try-ons are rate-limited per visitor, so no one can use up the service for everyone else.
Questions about your data?
Write to privacy@laratian.com. The full Terms of Service and Privacy Policy are shown inside the panel before you create an account.
Every store, your own fitting room.
Add Peek The Look to Chrome once, and see clothes on yourself before they go in the bag — on whichever store you happen to be shopping.