FrameMaxx Privacy Policy

Our promise, in one paragraph

FrameMaxx asks for some of the most sensitive images a fitness app can hold: shirtless photos of your body. Our design principle is that those photos are yours. They are measured in memory and not kept. FrameMaxx's servers never store or log photos, nothing is sold, nothing is used for advertising, and nothing is used to train AI models. Photos sent to Google for AI diagnosis are covered by the terms described under what leaves your device.

What stays on your device

• Your latest scan result only — the Frame Score, ratio, diagnosis text and muscle ratings — stored as data on your device. The photos themselves are not kept.
• A single front-silhouette outline (not the photo) kept so the rescan ghost overlay can line up your next scan.
• An anonymous app ID — a random UUID stored in your device’s Keychain (iCloud Keychain where available) so purchases keep working without an account.
• Device check: a per-device signing key kept in your Keychain, used only to show that requests come from the same device. Its public half is registered once on our servers against your anonymous ID. It holds no personal information.
• Not your birth year: the age check uses the year you enter and immediately discards it. Only a failed check is recorded, as a block flag that keeps the app blocked. Passing the check stores nothing.
• Your choices, such as your selected goal and whether you allowed Google AI processing. Settings → Delete local data clears the AI permission and your stored result.

What leaves your device, and why

• Scan photos: your front photo is required, and any right, back or left photos you add are sent over HTTPS to our processing service for measurement. They exist only in that request's memory — never written to disk, and never included in logs, error reports, analytics, or crash reports. Operational logs contain only a scan ID, timings, quality gate codes and scores.
• AI diagnosis and preferred ratio: only after you give permission on a screen that names the current provider and what is sent. Declining sends nothing. With permission, downscaled copies of your photos plus provisional measurement numbers, including the estimated shoulder-to-waist circumference ratio and geometry, currently go to Google's Gemini through Vertex AI for the visual diagnosis and ratio assessment. A supported AI ratio is preferred for your displayed ratio, and the server applies a fixed score curve to that selected ratio to calculate Frame Score. The original computer-vision estimate is preserved as context; AI does not replace its geometry or confidence. AI estimates can vary for the same photos. These are photo-based estimates, not validated tape measurements. Your Frame Score, height and anonymous ID are never sent to Google. Google processes this under Google Cloud's data-processing terms and does not use this content to train its models. We have disabled Google's project-level input caching. Google may separately log and retain content for abuse monitoring under its terms; disabling caching does not establish zero retention. We have not confirmed an abuse-monitoring exemption. This is separate from FrameMaxx's own memory-only handling, under which FrameMaxx keeps no photo copy. Before sending your photos to a different AI provider, we will disclose its details and ask for your permission again.
• Purchases, credits and service records: your anonymous app ID and entitlement status are held by RevenueCat and our credit ledger so purchases work across reinstalls without an account. The records our servers keep for your ID are: remaining credits and allowance timestamps; scan-request receipts — a request ID, time and input fingerprint, never the photos — that let a lost response be retried without spending an allowance twice; the public half of your device-check key with its registration time; and rate-limit timestamps that cap abuse over a rolling one-hour window. Older timestamps are removed when the same counter next accepts a request; inactive records remain until a verified deletion request. The one-hour window does not automatically delete stored records. App-attestation-token counters are not linked to your app ID and remain until the same counter is updated or explicitly deleted. None of these contain photos, measurement results or personal details, and records associated with your app ID or device key are covered by the server-record deletion request described in Deletion below.
• Paywalls: subscription and scan-credit offers are shown with Superwall. Superwall receives your anonymous app ID, your subscription status, which offers were shown and what you chose, and basic device and app details such as model, OS version, language and app version, so it can display offers and measure how they perform. Superwall never receives your photos, measurements, scan results or birth year, and its event tracking is limited to Superwall itself. Purchases are still processed by Apple.
• App integrity: device attestation tokens (Firebase App Check) accompany requests so our service can reject anything that isn’t the real app.
• Analytics & crashes: event counts such as “onboarding started” and “scan result delivered” (PostHog), identified only by the anonymous app ID. Analytics also records whether you passed or failed the age gate, never your birth year. Photos never reach analytics. Crash reports (Crashlytics) exclude images by configuration.

Safety backstops

If a scan is flagged as appearing to show someone under 18, or otherwise fails safety review, it is rejected outright: no result is returned, nothing is kept, and nothing is charged. Retakes for photo quality (lighting, pose, distance) are also free — a failed quality check never spends your free scan or a credit.

Deletion — nothing to keep, easy to clear

Because FrameMaxx does not retain photos, we have no photo records to retrieve or purge. Google's separate handling is governed by the terms disclosed above. In the app, Settings → Delete local data immediately removes your stored result, silhouette outline, plan progress and AI-processing permission from the device. It does not reset server credits or purchases. To delete your anonymous server-side records (credit balance, purchase entitlement links, scan-request receipts, the device-key registration and rate-limit history associated with your app ID or device key), email us — because accounts don’t exist, we may need purchase information such as your App Store order ID to locate the records and verify the request. Our Delete Your Data page explains both options step by step. We cannot retrieve or remotely erase data that lives only on your device.

Age requirement

FrameMaxx is for adults 18 and over and carries the highest App Store age rating available. It is not directed to children. Onboarding has a hard age gate with no forward path for underage users, and the birth year you enter is never stored. If you believe someone under 18 has used FrameMaxx, contact us below and we will delete the associated records.

What the score isn’t

The Frame Score and shoulder-to-waist ratio are estimated fitness measurements, not medical assessments, body-fat measurements, or health claims. The app never rates attractiveness and never comments on your worth — only which muscle groups to train.

Contact

Privacy questions, data requests, or deletion requests: jack@hephaestussoft.com.
Hephaestus Soft LLC · 30 N Gould St, Ste N, Sheridan, WY 82801, USA.