The short version. Your photos never leave your phone. They are analysed on the device and saved in the app's own private storage. We never upload them, never see them, and never share them.
What the app does with your photos
When you take a scan, the photo is captured by the camera, analysed on your device, and saved to the app's private storage on that device. The analysis is a set of image measurements — brightness, sharpness, local contrast, colour variance and the proportion of bright, desaturated pixels. No photo, and no data derived from a photo, is sent to us or to anyone else.
The app uses your operating system's face detector (Apple's Vision framework on iOS, ML Kit on Android) to locate the face in the frame so the measurements run on your face rather than the background. That detector runs on the device. It returns a rectangle. It does not build, store or transmit a faceprint, and the app does not attempt to identify who you are from a photo.
Photos stay until you delete the scan or uninstall the app. Delete a single scan from its result screen, or all of them at once from Profile — both remove the photo from the phone, not just the score. If you tap Share on a result, your operating system's share sheet opens and you choose where the image goes — that is your action, to a destination you pick, and we are not involved in it.
Your photos are also left out of your phone's cloud backup. iCloud Backup and Android Auto Backup would otherwise copy them to your Apple or Google account along with everything else on the phone. We exclude them, because "stays on your device" should mean that. The trade is real and worth knowing: your scores and history do back up and will restore on a new phone, but the photos will not — those cards will say the photo is unavailable.
What we do collect
| Data | Why | When |
|---|---|---|
| Push notification token, platform, time zone, your chosen reminder time and frequency | To send the scan reminder at the hour and cadence you chose, in your local time | Only if you turn notifications on |
| Your email address, your name if your provider supplies it, and the stable account identifier issued by Apple or Google | To keep you signed in across devices | Only if you sign in with Apple or Google |
| Android only: a one-way hash of your device's app-scoped Android ID | To remember when your free three days started, so reinstalling the app doesn't start them again | At launch |
That last one deserves a plain explanation. Android has no way for an app to ask the Play Store when you first installed it, so the only way to make a free trial mean anything is to remember the device. We take the identifier Android gives us — which is specific to this app and resets if you factory-reset your phone — run it through SHA-256 on the phone, and send only the result. We never receive or store the original, the hash tells us nothing about who or where you are, and the only question it can answer is "has this device started its free days yet". iPhones don't need this: the App Store already tells the app when you first downloaded it.
That is the complete list. The app contains no analytics SDK, no advertising SDK, no crash reporting service and no third-party trackers.
If you use Sign in with Apple and choose to hide your email, we receive only Apple's private relay address. We never receive your real one.
Where that data is held
On Cloudflare's network, in a database we control, reachable only by the app and by us. It is not sold, rented, or shared with advertisers or data brokers. We share it only where we are legally required to, or with the infrastructure providers named below who process it on our behalf.
Who else is involved
- Apple and Google — sign-in, push delivery, and all purchases. Subscriptions are handled entirely by the App Store and Google Play; we never see your card or payment details.
- Cloudflare — hosts the reminder service and its database.
- Firebase Cloud Messaging (Google) — delivers push notifications on Android.
Your choices
- Notifications. Turn them off in Profile, or in your system settings. When you turn the master toggle off, we delete your device record.
- Your account. Sign out in Profile at any time. Email [email protected] to have your account and everything attached to it deleted; we will action it within 30 days. Full deletion instructions, and what is kept.
- Your photos and scans. They are on your device. Delete a scan in the app, or uninstall to remove all of them.
Children
This app is not directed at children and is not intended for anyone under 13. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
Changes
If this policy changes in a way that affects what we collect or how we use it, we will update the date at the top and describe the change in the app's release notes.