This policy explains what the LOOKSMAXBRO iOS app (the "App") collects, what it does with it, and what choices you have. The App is operated by LOOKSMAXBRO ("we", "us"). By using the App you agree to this policy.

1How the App is built — and why that is the policy

Most face-scoring apps work by sending your selfie to a server, scoring it there, and sending a number back. LOOKSMAXBRO does not. The scoring model is compiled into the app and runs on your iPhone's own Neural Engine, through Apple's Vision and Core ML frameworks. Your face is measured and scored entirely on the device, and the photos and measurements never go anywhere else. You can put the phone in airplane mode and a scan still works — that is the simplest way to check that the scoring really is local.

The App does talk to a LOOKSMAXBRO server of ours (at api.looksmaxbro.com) for a deliberately narrow set of things: creating your anonymous account, syncing your course progress, daily-plan history and points, downloading course content, and — if you choose it — linking your account through Sign in with Apple. That is the whole job of the server. It is built so that it cannot receive your photos or your facial measurements: the app has no code path that would send them, and the scoring never leaves your phone. So the App is split in two by design — your face stays fully on-device, while a thin account carries only your progress. The rest of this policy spells out exactly where that line falls.

2What we collect

Photos of your face

The App takes two photos per scan — front and side. Normally that is your front camera; if you would rather not give camera access, you can pick the two photos from your gallery instead, and the scan works exactly the same. Either way the App never gets access to your photo library: iOS's own picker hands over only the images you selected, which is why the App never has to ask for library permission.

Your photos are saved on your device only, inside the App's private sandbox storage, with Apple's full file protection (encrypted, and unreadable while the phone is locked). They are:

• never uploaded to us or to anyone else;
• never written to your camera roll;
• excluded from your iCloud and iTunes device backup, so they do not travel to a new phone either;
• never used to train our model, and never sold;
• kept until you erase them in Settings, or delete the App (see section 7).

The App keeps your scan photos so it can show you your Progress gallery and your before / after comparison. They are not "processed and discarded" — they are stored, on your phone, for you.

Your face scan

To score a face the App measures it. On device, and only on device, it computes: a face bounding box, a 76-point landmark map (eyes, brows, nose, lips, jaw contour), your head pose, an image-quality score, and — on Face ID-capable iPhones — a coarse depth sample. (The depth sample is there to tell a real face from a photograph of one. In the current build it is measured but not yet enforced, so it does not reject anything.)

None of that is stored. The landmarks, the pose, the depth samples and the model's raw output exist in memory for the second it takes to compute your score, and are then gone. Nothing resembling a faceprint is saved, and none of it is ever transmitted.

Face data, plainly stated

Because some laws treat measurements of a face as a special category, we will be precise rather than reassuring. The App does measure the geometry of your face — that is literally what a face-scoring app does, and any app in this category that tells you otherwise is not being straight with you. What matters is what happens next:

• we do not perform facial recognition — we never attempt to identify you, match you against anyone, or link your face to a name;
• we do not create or store a faceprint, biometric template, or any durable representation of your face;
• the measurements are not stored, not transmitted, and not shared with any third party;
• they are used for exactly one thing: producing your score, on your device.

Your scores and your answers

Stored locally on your device only: your Overall and Potential scores, the eight metric scores, scan dates, your daily check-ins, your streak, and most of the answers you gave in the onboarding quiz (your goal, your self-rating, and your age if you chose to enter it). Your scores are never sent to our server — they are computed from your face, and your face stays on the phone.

One honest detail: unlike your photos, this local database is included in your own iPhone backup, so if you back up your phone to iCloud, your scores and check-ins go into that backup. That backup is Apple's, is encrypted, and belongs to you — we have no access to it and never see it.

Your account and synced progress

So that your progress survives a reinstall or a new phone, some of it is synced to your LOOKSMAXBRO account (section 1). This is the only data of yours that reaches our server, and it is deliberately small:

• an anonymous account identifier — a random ID generated on your phone at first launch, with a device key kept in your iPhone's Keychain. It is not your name, email, phone number or Apple ID, and it is tied to no real-world identity;
• your course and lesson progress and your points (the small self-improvement increments the App awards for finishing a task, a habit or a lesson), sent as a plain list of "this was completed, on this day" — never a photo, a landmark, a metric value, or a score.
• The gender you pick on the second onboarding screen stays on your phone (it tailors your daily plan) and is sent only to our push service, if you enable notifications, so reminders match your plan — see section 4.

If you use Sign in with Apple (optional), Apple gives us a stable identifier for your Apple ID that we use only to attach this same anonymous account to you, so your progress follows you across your devices. We ask Apple for no name and no email. You can wipe all of this from our server at any time — see section 7.

Health data (steps & sleep)

If you use the Steps or Sleep habit, the App can read two things from Apple Health, and only with your explicit permission: your step count and last night's sleep. We ask the first time you open one of those two habits — never at launch, and never for anything else. If you say no, the habits simply stay a manual tap.

This data is used for one purpose: to fill in those two habits automatically instead of making you type numbers. It is processed entirely on your device and never leaves it — it is never uploaded, never sent to analytics, and never attached to your account. Where a reminder needs context, only a coarse flag or percentage is ever used (for example "today's workout is still open", or how full your water goal is) — never a raw step count or a number of hours slept. You can revoke this access at any time in the iOS Health app under Sharing, and it never feeds the face score.

Product analytics

One of the two things that leave your device automatically (the other is install attribution — section 3a). We use Amplitude to understand whether the App actually works — where people get stuck, whether anyone comes back for a second scan. It is anonymous: there is no account, so there is no name, email, or phone number to attach to it.

Here is every event the App sends, and everything it carries:

No photo, no landmark, no facial measurement, and no image data of any kind is ever attached to an analytics event. The App does not have the code to do so.

Amplitude does attach a random device identifier (derived from Apple's "identifier for vendor", which is scoped to us, is not the advertising ID, and resets when you delete the App), plus the App version, your device model, OS version and language. We have switched off Amplitude's IP-address and location lookup, so no location — not even a city — is collected.

Purchases

Subscriptions are sold and processed by Apple through the App Store. We never see your Apple ID, your card, or your billing address. To keep track of whether a subscription is active — across your devices and after a reinstall — the App uses Adapty, a subscription-management service: it receives your anonymous account id and the purchase status Apple reports (which plan, active or expired). It receives no photo, no facial measurement, no score, and no health data.

3What we never collect

• No photos of your face on our server, and no facial measurements — those never leave your device.
• No name, email address, phone number, or password. Your account is anonymous (section 2), and Sign in with Apple, if you use it, gives us no name and no email.
• No location — not precise, not approximate, not by IP.
• No contacts, no microphone, and no photo library access beyond the photos you explicitly pick for a scan.
• No health data on our server. Steps and sleep, if you allow them, are read from Apple Health on your device and stay there (section 2) — they are never uploaded, never sent to analytics, and never used for marketing.
• No sale of personal data, to anyone, ever.

3aInstall attribution (the one tracking ask)

The App uses AppsFlyer to understand which promo brought you here — that is, to attribute the install, once. iOS shows you the standard "Allow tracking?" prompt right after the first screen: if you allow, AppsFlyer receives the advertising identifier (IDFA) for that one purpose; if you decline, it does not, and the App works exactly the same. Either way AppsFlyer never receives your photos, your face data, or your scores — it sees launch and attribution signals only, and we send no in-app behaviour events to it. The App still shows no ads and contains no ad network.

4Who else is involved

A short list, and none of them ever receives your face:

• Apple — distributes the App, processes subscriptions, and provides the on-device Vision and Core ML frameworks the scan runs on (these run locally; nothing is sent to Apple to score your face).
• Amplitude — product analytics, as itemised in section 2. Amplitude never receives photos, landmarks, facial measurements, or anything that identifies you.
• AppsFlyer — install attribution, as described in section 3a, and only with the identifier iOS lets it have after you answer the tracking prompt.
• Our own LOOKSMAXBRO server — runs the anonymous account and progress sync of section 2. We operate it ourselves; it is hosted in the European Union (on UpCloud infrastructure), holds only the account and progress data listed above, and — by design — never your photos, facial measurements or scores. We keep short-term encrypted backups of that account database, also in the European Union, so it can be restored after a failure; backups are automatically purged within about four weeks and contain the same narrow data — never your face.
• OneSignal — delivers our push notifications (streak savers, scan-day nudges). When notifications are enabled, OneSignal processes your push token and a handful of aggregate progress tags (things like "program day 12", "water 75%", "streak 6" — percentages, flags and counters, linked to your anonymous account id). It never receives your photos, facial measurements, scores, or raw health values, and it is not an advertising or tracking SDK. Alongside those counters it receives the goal-related answers that decide which reminders make sense for you — your selected gender, your preferred reminder hour and whether your subscription is active. Decline or disable notifications in iOS Settings and nothing is sent to it at all.
• Adapty — subscription management, as described in section 2. It receives your anonymous account id and your purchase status from Apple, so the App knows what you have access to on every device. It never receives photos, facial measurements, scores or health data.

That is the complete list. There is no crash reporter, no advertising network, and no third-party AI provider — the scoring model is on your phone.

5When your photo does leave your phone

Only when you send it. There are exactly two ways:

• The Compare card. Your before/after card, which you can share. Your photo is switched off by default — the card shows only your numbers unless you deliberately turn your face on.
• The time-lapse. A video of your scans over time. It is your face by definition, so there is no "off" switch — it simply never leaves the device until you tap Share and choose where to send it.

In both cases iOS hands the file to whichever app you pick. Once you have sent it somewhere, that destination's rules apply, not ours.

6How we use what we collect

• To produce your score and your metric breakdown (on your device).
• To build your 30-day program plan, your daily habit check-ins, your per-habit streaks, and your progress history.
• To auto-fill your Steps and Sleep habits from Apple Health — on your device, and only with your permission (see the Health data note in section 2).
• To unlock what you have paid for.
• To understand, from anonymous aggregate analytics, whether the App works — and to fix it when it doesn't.
• To send you the local reminders you have allowed (see section 9).

We do not use your photos or your scores to train our model. The model is trained on public research datasets before the App ships, and it does not learn from you — your face never becomes training data for anything.

7Keeping and deleting your data

Your photos, scores and history stay on your phone for as long as you keep them. We hold no copy of any of that — nothing we could hand over if someone demanded it. The only data we hold is the anonymous account and progress of section 2, and you can erase it on demand.

You have three controls:

• In the App: Settings → Erase all data. This permanently deletes every photo, scan, score, check-in and streak from your device. It cannot be undone.
• In the App: Settings → Delete account. This tells our server to hard-delete your anonymous account, your synced course progress and your points, and to revoke its sign-in tokens — immediately, from our live systems. The only remaining copy is in the short-term encrypted backups described in section 4, which are automatically purged within about four weeks; after that nothing of yours remains anywhere on our side.
• Delete the App: iOS removes the App's entire sandbox with it — photos and local database included. (This does not by itself delete the server-side account; use Delete account first if you want that gone too.)

Neither of these cancels an App Store subscription. Cancel that in your Apple account settings (Settings → your name → Subscriptions).

Anonymous analytics events already sent cannot be traced back to you and therefore cannot be individually deleted; they are retained in aggregate for as long as they are useful for improving the App. Apple keeps purchase records under its own policies and for as long as tax law requires.

8Your rights

Depending on where you live (for example, under the GDPR or the CCPA) you may have rights to access, correct, export, or delete the personal data a company holds about you, and to object to its processing.

In our case the honest answer is that we hold very little to give you: no name, no email, no photos, no facial data, and no scores — only the anonymous account and progress of section 2. Your face data is in your hands, on your device, and section 7 is your delete button — for both the on-device data and the server-side account. If you believe we hold something about you and you want it, or you simply want to ask, write to support@looksmaxbro.com and we will answer.

9Notifications

There are two kinds. Functional timers — wind-down and wake alerts, the whitening timer, optional posture nudges — are generated on your phone, by the App, from your own settings; no server is involved in them. Program reminders (streak savers, scan-day nudges) are delivered through OneSignal (see section 4): if you allow notifications, your push token and the aggregate progress tags described there are processed for delivery — never your photos, measurements or scores. Decline the permission or turn notifications off in iOS Settings at any time and remote delivery stops entirely; the on-phone timers you chose keep working.

10Children

LOOKSMAXBRO is rated 16+ and is not directed at children. You must be at least 16 to use the App. Do not scan the face of anyone under 16. If you believe a child has used the App, delete it — that removes everything, because everything is local.

11Security

Your photos are stored with Apple's complete file protection: encrypted at rest and unreadable while your device is locked. The strongest security property of this App, though, is not a control we implemented — it is that we never receive your face in the first place. There is no database of user photos to breach, because there is no database of user photos.

12Changes

If we change this policy we will update the date at the top. If we ever change the App so that it sends more than what section 2 lists — a cloud feature, or anything that carries your face off the device — we will say so clearly in the App before it happens, not quietly in a document you have already read. (The account and progress sync of section 2, and its encrypted EU backups of section 4, are the current extent of what leaves the device; you can review exactly what syncs any time in the App under Settings → “What we sync”.)

13Contact

LOOKSMAXBRO — support@looksmaxbro.com. We answer privacy questions from a human.