Privacy Policy

1. Introduction

{umax} ("{umax}", "we", "us", or "our") is an iOS self-improvement app for adults. It offers:

• Face analysis: an AI-generated analysis of your own selfies, with per-feature scores, a "potential" estimate and a plain-language guide.
• Coach: a personalized daily plan and routines.
• Discover: Glow-Up Preview and Color Analysis.
• Try-On: AI-generated images of new hairstyles, facial hair, hair colors, outfits and scenes, made from a photo of yourself.

This Privacy Policy explains:

• what information we collect when you use {umax};
• how we use and share it, and how long we keep it;
• the choices and rights you have, including how to delete your photos and account.

It applies to everyone who uses the app, including users who sign in anonymously as a guest.

If you have questions about this policy or your data, contact us at betultosunios@gmail.com.

2. Information We Collect

a. Photos and Face Data

This is the most important category of data {umax} handles. It includes:

• Face scan: three selfies taken with the in-app front camera: one facing the camera, one turned to show your side profile, and one smiling. Photos cannot be imported from your photo library for the face scan.
• Discover: one selfie taken with the in-app front camera for Glow-Up Preview or Color Analysis. These features are also camera-only.
• Try-On: one photo of yourself, taken with the camera or chosen from your photo library.
• Results: the AI outputs created from these photos: scores and guide, Glow-Up Preview images and suggestions, your color palette, and Try-On images.

We refer to these collectively as your photos and face data.

b. Account Information

By default, {umax} signs you in anonymously, so you can use the app as a guest without giving any personal details.

If you choose to sign in with Apple, Google or email and password, we collect the identifiers needed for that sign-in, including your email address if one is provided. Your email is used for:

• account access and password reset;
• a user attribute in our analytics tool (Mixpanel) and subscription tool (Adapty);
• Google's on-device conversion measurement (see section 5).

c. Purchase Information

Subscriptions and credit packs are purchased through Apple's In-App Purchase system. We never see or store your card number or other payment card details; Apple handles payment processing.

We and our subscription management provider, Adapty, receive the purchase details needed to unlock features: which product you bought, its transaction ID and status, and its price and currency.

We keep a credit ledger of your purchases, weekly subscription credits, credits spent on Try-On, and refunds.

d. Coach and Preferences

We store:

• on our servers: your Coach plan, the routines you add, and which tasks you complete;
• on your device: your onboarding answers and notification settings.

e. Usage, Device and Diagnostic Data

In App Store and TestFlight builds only, we record product analytics events. These events are tied to an internal user ID, never contain photos, and include:

• onboarding answers (your goals, fitness habits and level, and how important self-care is to you);
• sign-in method, session count and Premium status;
• paywall views and purchase events, including product, price and currency;
• scan events (started, completed with your overall result number, or failed);
• Coach and routine activity;
• Discover and Try-On usage, including the thumbs-up or thumbs-down feedback you give on a Try-On image;
• your choices on the consent screen;
• errors.

Our server also records whether each AI generation succeeded, how long it took, and what kind of generation it was.

Crash reports (device model, iOS version, app version and technical crash details) are collected through Firebase Crashlytics. Our servers keep technical logs for troubleshooting and security.

f. Content You Submit

If you contact us with feedback or support requests, we collect what you send us.

3. Face Data and AI Processing

Because your photos are sensitive, we want to be specific about why we collect them, how long we keep them, and who they are shared with.

Why we collect your face photos

We collect your photos solely to produce the results you request:

• your feature scores, "potential" estimates and guide;
• your Coach plan;
• your Glow-Up Preview and Color Analysis;
• your Try-On images.

Results describe only you. {umax} does not compare you with other people, and scores cannot be shared from the app.

How we process your photos

First, the app checks on your device, using Apple's Vision framework, that a face is present. The photo is then resized, compressed and sent over an encrypted connection to our backend, which runs on Google Cloud and Firebase. Our backend sends it to these AI service providers, which act as our processors:

• OpenAI (GPT-4o via the OpenAI API) analyzes:
  • your three face-scan selfies, to produce your feature scores and guide;
  • your Glow-Up Preview selfie, to choose grooming suggestions;
  • your Color Analysis selfie.
  Your Coach plan is also generated by OpenAI, from your scores only; no photo is sent for it.
• Eachlabs generates Glow-Up Preview and Try-On images. For this, Eachlabs runs an image-editing model developed by Google ("Nano Banana"), so Google also processes your photo as Eachlabs' sub-processor.

Try-On photo check. Before a Try-On photo is processed, and before any credit is spent, it is checked automatically using OpenAI's moderation service and an OpenAI image model. The check confirms the photo shows exactly one person who appears to be an adult, and contains no sexual, violent or otherwise prohibited content. Photos that fail are rejected and not processed further. The check does not identify anyone, does not create a faceprint, and cannot confirm that the person in the photo is you; using only photos of yourself remains your responsibility under our Terms of Use.

Try-On styles are chosen from a fixed list in the app. You cannot write your own instructions to the image model.

Glow-Up Preview changes only skin, hair and grooming. It is instructed not to change your bone structure, facial proportions or eye shape.

We send your photos to these providers only to produce your result. We do not send them for model training or advertising.

• OpenAI does not use data sent through its API to train its models. It may keep API inputs and outputs for up to 30 days to monitor for abuse, and then deletes them unless the law requires it to keep them longer.
• Eachlabs produces the generated image and returns it to us, and we then store it ourselves. Eachlabs and Google may keep inputs and outputs temporarily, under their own policies, to provide the service.

How long we keep them

• The three face-scan selfies are stored on our servers (Google Firebase Storage) and deleted automatically 30 days after the scan. The scores created from them are kept while your account is active, because progress tracking depends on them.
• Your Glow-Up Preview selfie, the image generated from it, and your Color Analysis result are kept while your account is active, so you can revisit your history. The selfie used for Color Analysis is not stored on our servers.
• For Try-On, the photo you upload is not stored on our servers; only the generated image is kept. It stays until you delete it in the app or delete your account.

Everything is deleted when you delete your account. See Data Retention for details.

Who we share them with

Your photos and face data are shared only with our cloud infrastructure and the AI processors listed above. We never sell your photos or face data, and we do not share them for advertising.

Only you can share a Try-On image. You can save it to your Photos or share it through the iOS share sheet. When you do, you choose the recipient, and what they do with it is outside our control. Face-scan results and Discover results cannot be shared from the app.

4. How We Use Your Information & Legal Bases

We use the information described above to:

• Generate your face analysis: feature scores, "potential" estimates and guide
• Track your progress over time with your scan history
• Create your Coach plan and routines, and send the optional reminder notifications you turn on. These are scheduled on your device: a scan check-in reminder, a routine reminder, and occasional tips about Try-On and Discover.
• Produce Glow-Up Preview, Color Analysis and Try-On results, and keep your history of them
• Operate accounts and sign-in
• Process subscription and credit-pack purchases, and manage your credit balance
• Maintain, secure and improve the app, including diagnosing crashes and errors
• Communicate with you about your account or in response to your requests

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract: to provide the features you request, such as analysis, coaching, Try-On and purchases.
• Consent: for processing your photos with AI (asked for explicitly before your first photo), for reminder notifications, and where local law requires it for analytics.
• Legitimate interests: to secure the app, prevent abuse and fraud, and improve our features through analytics and crash reports.

5. How We Share Information

We do not sell your personal information, and we do not share your photos or face data for advertising. We share information only with service providers who help us operate {umax}:

We may also share information:

• if required by law;
• to protect our rights or the safety of our users;
• in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

No ads are shown in {umax}. We do not use cross-app tracking, we do not ask for tracking permission, and we do not use the IDFA.

6. Data Retention

When you delete your account, we delete from our active systems:

• every file stored under your account (scan selfies, Glow-Up Preview photos and images, Try-On images);
• your scans and scores, Coach plan and routines;
• your Discover and Try-On history;
• your credits;
• your sign-in record.

If you signed in with Apple, we also revoke your Sign in with Apple token. We keep only the photo-free record described above. Some copies may briefly remain in backups before they are fully erased.

7. Security

We protect your information with encryption in transit and access controls on our servers. Stored photos are tied to your account and delivered to the app through time-limited links.

However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

{umax} is intended only for users who are 18 years of age or older, and the consent screen asks you to confirm this before your first photo. The app is not directed to children, and we do not knowingly collect information from anyone under 18. If we discover that we have collected data from an underage user, we will delete it.

9. International Data Transfers

Our backend runs on Google Cloud in the United States. Our other providers (OpenAI, Eachlabs, Adapty and Mixpanel) may process data in the United States and other countries.

Where we transfer personal information internationally, we rely on appropriate safeguards, such as standard contractual clauses, to protect your information.

10. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account, photos and associated data
• Receive a copy of your information in a portable format
• Object to certain processing
• Withdraw consent where processing is based on consent, such as AI photo processing and notifications

You can turn reminder notifications off in Profile → Settings → Notifications or in iOS Settings.

We will respond to your request within 30–45 days.

11. United States State Privacy Rights

If you live in a U.S. state with a comprehensive privacy law (such as California's CCPA/CPRA), you may have additional rights regarding your personal information. We collect the categories of information described in Information We Collect:

• photos and face data;
• identifiers (internal user ID and email);
• purchase information;
• usage and diagnostic data.

Your rights include:

• We do not sell your personal information.
• You have the right to limit the use of sensitive personal information, including photos and face data, to the purposes described in this policy.
• You have the right to know, delete, correct and access your personal information, as described in Your Rights and Choices.
• We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at betultosunios@gmail.com.

12. Do Not Track

Some browsers support a "Do Not Track" signal. {umax} is a mobile app rather than a browser-based service, and it does not show ads or use cross-app tracking, so we do not currently respond to Do Not Track signals.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you in the app. If you continue to use {umax} after changes take effect, you accept the updated policy.

14. Contact Us

If you have questions, concerns or requests about this Privacy Policy or your data, contact us at betultosunios@gmail.com.