This policy explains what the LOOKSMAXBRO iOS app (the "App") collects, what it does with it, and what choices you have. The App is operated by LOOKSMAXBRO ("we", "us"). By using the App you agree to this policy.

1How the App is built — and why that is the policy

Most face-scoring apps work by sending your selfie to a server, scoring it there, and sending a number back. LOOKSMAXBRO does not. The scoring model is compiled into the app and runs on your iPhone's own Neural Engine, through Apple's Vision and Core ML frameworks. Your face is measured and scored entirely on the device, and the photos and measurements never go anywhere else. You can put the phone in airplane mode and a scan still works — that is the simplest way to check that the scoring really is local.

The App does talk to a LOOKSMAXBRO server of ours (at api.looksmaxbro.com) for a deliberately narrow set of things: creating your anonymous account, syncing your course progress, daily-plan history and points, downloading course content, and — if you choose it — linking your account through Sign in with Apple. That is the whole job of the server. It is built so that it cannot receive your photos or your facial measurements: the app has no code path that would send them, and the scoring never leaves your phone. So the App is split in two by design — your face stays fully on-device, while a thin account carries only your progress. The rest of this policy spells out exactly where that line falls.

2What we collect

Photos of your face

The App takes two photos per scan — front and side. Normally that is your front camera; if you would rather not give camera access, you can pick the two photos from your gallery instead, and the scan works exactly the same. Either way the App never gets access to your photo library: iOS's own picker hands over only the images you selected, which is why the App never has to ask for library permission.

Your photos are saved on your device only, inside the App's private sandbox storage, with Apple's full file protection (encrypted, and unreadable while the phone is locked). They are:

• never uploaded to us or to anyone else;
• never written to your camera roll;
• excluded from your iCloud and iTunes device backup, so they do not travel to a new phone either;
• never used to train our model, and never sold;
• kept until you erase them in Settings, or delete the App (see section 7).

The App keeps your scan photos so it can show you your Progress gallery and your before / after comparison. They are not "processed and discarded" — they are stored, on your phone, for you.

Your face scan

To score a face the App measures it. On device, and only on device, it computes: a face bounding box, a 76-point landmark map (eyes, brows, nose, lips, jaw contour), your head pose, an image-quality score, and — on Face ID-capable iPhones — a coarse depth sample. (The depth sample is there to tell a real face from a photograph of one. In the current build it is measured but not yet enforced, so it does not reject anything.)

None of that is stored. The landmarks, the pose, the depth samples and the model's raw output exist in memory for the second it takes to compute your score, and are then gone. Nothing resembling a faceprint is saved, and none of it is ever transmitted.

Face data, plainly stated

Because some laws treat measurements of a face as a special category, we will be precise rather than reassuring. The App does measure the geometry of your face — that is literally what a face-scoring app does, and any app in this category that tells you otherwise is not being straight with you. What matters is what happens next:

• we do not perform facial recognition — we never attempt to identify you, match you against anyone, or link your face to a name;
• we do not create or store a faceprint, biometric template, or any durable representation of your face;
• the measurements are not stored, not transmitted, and not shared with any third party;
• they are used for exactly one thing: producing your score, on your device.

Your scores and your answers

Stored locally on your device only: your Overall and Potential scores, the eight metric scores, scan dates, your daily check-ins, your streak (the count itself is local; it rebuilds from the synced completions described below, so it survives a reinstall too), and most of the answers you gave in the onboarding quiz (your goal, your self-rating, and your age if you chose to enter it). Your scores are never sent to our server — they are computed from your face, and your face stays on the phone.

One honest detail: unlike your photos, this local database is included in your own iPhone backup, so if you back up your phone to iCloud, your scores and check-ins go into that backup. That backup is Apple's, is encrypted, and belongs to you — we have no access to it and never see it.

Your account and synced progress

So that your progress survives a reinstall or a new phone, some of it is synced to your LOOKSMAXBRO account (section 1). Together with the install-attribution label described in section 3a (the name of the ad campaign that brought you, if any — never an advertising identifier), this is the only data of yours that reaches our server, and it is deliberately small:

• an anonymous account identifier — a random ID generated on your phone at first launch, with a device key kept in your iPhone's Keychain. It is not your name, email, phone number or Apple ID, and it is tied to no real-world identity;
• your course and lesson progress and your points (the small self-improvement increments the App awards for finishing a task, a habit or a lesson), sent as a plain list of "this was completed, on this day" — never a photo, a landmark, a metric value, or a score.
• your program profile — the settings that build your daily plan: the habits you switched on or off, your per-habit settings (frequency, goals, reminder times), and, for profiles created before September 2026, the answers of the short lifestyle questionnaire the App used to ask (topics, wake-up and bedtime range, how long you sit, skin / hair / teeth / posture / training answers, the yes/no cards, age band, intensity). Newer profiles were never asked it. Alongside this, the App records which onboarding and subscription-screen variant you were shown — an A/B label, nothing about you. This is what lets a reinstall or a new phone rebuild the same daily plan. Your height and weight stay on your phone only — they are never sent; and none of this is a measurement of your face.
• The gender you pick on the second onboarding screen stays on your phone (it tailors your daily plan) and is sent only to our push service, if you enable notifications, so reminders match your plan — see section 4.

If you use Sign in with Apple (optional), Apple gives us a stable identifier for your Apple ID that we use only to attach this same anonymous account to you, so your progress follows you across your devices. We ask Apple for no name and no email. You can wipe all of this from our server at any time — see section 7.

Health data (steps & sleep)

If you use the Steps or Sleep habit, the App can read two things from Apple Health, and only with your explicit permission: your step count and last night's sleep. We ask the first time you open one of those two habits — never at launch, and never for anything else. If you say no, the habits simply stay a manual tap.

This data is used for one purpose: to fill in those two habits automatically instead of making you type numbers. It is processed entirely on your device and never leaves it — it is never uploaded, never sent to analytics, and never attached to your account. Where a reminder needs context, only a coarse flag or percentage is ever used (for example "today's workout is still open", or how full your water goal is) — never a raw step count or a number of hours slept. You can revoke this access at any time in the iOS Health app under Sharing, and it never feeds the face score.

Product analytics

One of the two things that leave your device automatically (the other is install attribution — section 3a). We use Amplitude to understand whether the App actually works — where people get stuck, whether anyone comes back for a second scan. Events are labeled with your anonymous account id (the random identifier from section 1) so that analytics, purchases and push notifications describe the same account — but that id carries no name, email, or phone number, because we never ask for any. Events may also carry the name of the ad campaign that brought you (section 3a) — a label about the ad, not about you.

Here is every event the App sends, and everything it carries:

No photo, no landmark, no facial measurement, and no image data of any kind is ever attached to an analytics event. The App does not have the code to do so.

Amplitude does attach a random device identifier (derived from Apple's "identifier for vendor", which is scoped to us, is not the advertising ID, and resets when you delete the App), plus the App version, your device model, OS version and language. We have switched off Amplitude's IP-address and location lookup, so no location — not even a city — is collected.

Purchases

Subscriptions are sold and processed by Apple through the App Store. We never see your Apple ID, your card, or your billing address. Whether your subscription is active — across your devices and after a reinstall — is decided by Apple's own purchase records, tied to your Apple Account. Separately, the App reports your purchase status to Adapty, which we use for subscription analytics and attribution: it receives your anonymous account id and the plan status Apple reports (which plan, active or expired), and it does not decide what you can access. It receives no photo, no facial measurement, no score, and no health data.

3What we never collect

• No photos of your face on our server, and no facial measurements — those never leave your device.
• No name, email address, phone number, or password. Your account is anonymous (section 2), and Sign in with Apple, if you use it, gives us no name and no email.
• No location — not precise, not approximate, not by IP.
• No contacts, no microphone, and no photo library access beyond the photos you explicitly pick for a scan.
• No health data on our server. Steps and sleep, if you allow them, are read from Apple Health on your device and stay there (section 2) — they are never uploaded, never sent to analytics, and never used for marketing.
• No sale of personal data, to anyone, ever.

3aInstall attribution (the one tracking ask)

The App uses AppsFlyer to understand which promo brought you here — that is, to attribute the install, once. iOS shows you the standard "Allow tracking?" prompt right after the first screen: if you allow, AppsFlyer receives the advertising identifier (IDFA) for that one purpose; if you decline, it does not, and the App works exactly the same. Either way AppsFlyer never receives your photos, your face data, or your scores — it sees launch and attribution signals only, and the App itself sends no in-app behavior events to it (our payment processor, Adapty, reports subscription events to AppsFlyer server-to-server so ad campaigns can be measured — see section 3). The App still shows no ads and contains no ad network.

The result of attribution — the name of the campaign, ad set and ad that brought the install, or "organic" — is stored on your anonymous account on our server. It is a label about the advertisement, not about you: no advertising identifier, no location, no device fingerprint travels with it.

This website

On our advertising pages (/lp/), we use Meta Pixel and Amplitude to measure visits, interactions and app downloads. These tools may use cookies and similar browser storage. We also store our own browser identifier to remember landing-page choices and measure visits, including direct redirects to the app. Amplitude Session Replay helps us review how a page is used, with text input fields masked. We also keep a limited record of these interactions on our server. Other website pages do not use these analytics tools.

Download buttons and QR codes use AppsFlyer OneLink to connect a visit and its campaign tags with a later app install or subscription event. No photos or face measurements from our browser tools are sent to these analytics services. You can contact us using the details below about your data or to request deletion.

Across the site, your chosen interface language is remembered in your browser so pages open in the same language next time; that choice stays on your device and is not sent anywhere.

4Who else is involved

A short list, and none of them ever receives your face:

• Apple — distributes the App, processes subscriptions, and provides the on-device Vision and Core ML frameworks the scan runs on (these run locally; nothing is sent to Apple to score your face).
• Amplitude — product analytics, as itemised in section 2. Amplitude never receives photos, landmarks, facial measurements, your name or your email — the events are tied to the anonymous account id only.
• AppsFlyer — install attribution, as described in section 3a. It receives the advertising identifier iOS allows after you answer the tracking prompt, and the same anonymous account id, so that a subscription started in the App can be counted against the ad campaign that brought the install.
• Our own LOOKSMAXBRO server — runs the anonymous account and progress sync of section 2. We operate it ourselves; it is hosted in the European Union (on UpCloud infrastructure), holds the account and progress data listed above, plus encrypted Apple credentials needed for sign-in revocation (section 7), and — by design — never your photos, facial measurements or scores. We keep short-term encrypted backups of that account database, also in the European Union, so it can be restored after a failure; backups are automatically purged within about four weeks and contain the same narrow data — never your face.
• OneSignal — delivers our push notifications (streak savers, scan-day nudges). When notifications are enabled, OneSignal processes your push token and a handful of aggregate progress tags (things like "program day 12", "water 75%", "streak 6" — percentages, flags and counters, linked to your anonymous account id). It never receives your photos, facial measurements, scores, or raw health values, and it is not an advertising or tracking SDK. Alongside those counters it receives the goal-related answers that decide which reminders make sense for you — your selected gender, your preferred reminder hour and whether your subscription is active. Decline or disable notifications in iOS Settings and nothing is sent to it at all.
• Adapty — subscription management, as described in section 2. It receives your anonymous account id and your purchase status from Apple, so the App knows what you have access to on every device. It never receives photos, facial measurements, scores or health data.

That is the complete list. There is no crash reporter, no advertising network, and no third-party AI provider — the scoring model is on your phone.

5When your photo does leave your phone

Only when you send it. There are exactly two ways:

• The Compare card. Your before/after card, which you can share. Your photo is switched off by default — the card shows only your numbers unless you deliberately turn your face on.
• The time-lapse. A video of your scans over time. It is your face by definition, so there is no "off" switch — it simply never leaves the device until you tap Share and choose where to send it.

In both cases iOS hands the file to whichever app you pick. Once you have sent it somewhere, that destination's rules apply, not ours.

6How we use what we collect

• To produce your score and your metric breakdown (on your device).
• To build your 30-day program plan, your daily habit check-ins, your per-habit streaks, and your progress history.
• To auto-fill your Steps and Sleep habits from Apple Health — on your device, and only with your permission (see the Health data note in section 2).
• To unlock what you have paid for.
• To understand, from anonymous aggregate analytics, whether the App works — and to fix it when it doesn't.
• To send you the local reminders you have allowed (see section 9).

We do not use your photos or your scores to train our model. The model is trained on public research datasets before the App ships, and it does not learn from you — your face never becomes training data for anything.

7Keeping and deleting your data

Your photos, scores and history stay on your phone for as long as you keep them. We hold no copy of any of that — nothing we could hand over if someone demanded it. The only data we hold is the account and progress of section 2, the limited subscription history described below, plus the encrypted Apple credential used for revocation described below. You can erase your account on demand.

You have three controls:

• In the App: Settings → Erase all data. This permanently deletes every photo, scan, score, check-in and streak from your device. It cannot be undone.
• In the App: Settings → Delete account. This tells our server to delete your sign-in account, synced course progress and points, and invalidate our sign-in tokens immediately. We retain a limited support record of the account ID, creation and deletion dates, and store-confirmed subscription facts: product and transaction identifiers, trial dates, subscription periods, and renewal status. If the same store subscription is restored to a new account, these records can explain its earlier trial and account deletion without counting a new purchase. They do not restore your sign-in credentials, photos, questionnaire, progress, advertising identifiers, or behavioral event history. We also request revocation of your Sign in with Apple authorization. If that request cannot be completed, we keep the encrypted Apple token needed to retry, without your account or progress, in our live systems for up to 30 days. We delete that token when Apple confirms revocation or the retry period ends; if Apple remains unavailable, revocation may not complete. Short-term encrypted backups are automatically purged within about four weeks.
• Delete the App: iOS removes the App's entire sandbox with it — photos and local database included. (This does not by itself delete the server-side account; use Delete account first if you want that gone too.)

Neither of these cancels an App Store subscription. Cancel that in your Apple account settings (Settings → your name → Subscriptions).

Analytics events are labeled with the anonymous account id; if you ask us to (see section 8), we can request their deletion from Amplitude by that id. Events older than the retention window, and events sent before this version of the App, carry no account id and cannot be individually deleted; they are retained in aggregate for as long as they are useful for improving the App. Apple keeps purchase records under its own policies and for as long as tax law requires.

8Your rights

Depending on where you live (for example, under the GDPR or the CCPA) you may have rights to access, correct, export, or delete the personal data a company holds about you, and to object to its processing.

In our case the honest answer is that we hold very little to give you: no name, no email, no photos, no facial data, and no scores — only the anonymous account and progress of section 2. Your face data is in your hands, on your device, and section 7 is your delete button — for both the on-device data and the server-side account. If you believe we hold something about you and you want it, or you simply want to ask, write to support@looksmaxbro.com and we will answer.

9Notifications

There are two kinds. Functional timers — wind-down and wake alerts, optional posture nudges — are generated on your phone, by the App, from your own settings; no server is involved in them. Program reminders (streak savers, scan-day nudges) are delivered through OneSignal (see section 4): if you allow notifications, your push token and the aggregate progress tags described there are processed for delivery — never your photos, measurements or scores. Decline the permission or turn notifications off in iOS Settings at any time and remote delivery stops entirely; the on-phone timers you chose keep working.

10Children

LOOKSMAXBRO is rated 16+ and is not directed at children. You must be at least 16 to use the App. Do not scan the face of anyone under 16. If you believe a child has used the App, delete it — that removes everything, because everything is local.

11Security

Your photos are stored with Apple's complete file protection: encrypted at rest and unreadable while your device is locked. The strongest security property of this App, though, is not a control we implemented — it is that we never receive your face in the first place. There is no database of user photos to breach, because there is no database of user photos.

12Changes

If we change this policy we will update the date at the top. If we ever change the App so that it sends more than what section 2 lists — a cloud feature, or anything that carries your face off the device — we will say so clearly in the App before it happens, not quietly in a document you have already read. (The account and progress sync of section 2, and its encrypted EU backups of section 4, are the current extent of what leaves the device; you can review exactly what syncs any time in the App under Settings → “What we sync”.)

13Contact

LOOKSMAXBRO — support@looksmaxbro.com. We answer privacy questions from a human.