Privacy Policy

What maxxlook does

maxxlook measures facial and skin characteristics from photographs and lets you track changes over time. These measurements are not a medical or dermatological assessment, do not diagnose any condition, and are not used to rank users against one another.

Information we collect

• Account data, including your name when provided by an identity provider, email address, authentication identifiers, verification status, and account role.
• Demographic and profile information you provide, including age, ethnicity, gender, lifestyle factors, and your selected goals.
• Photographs you explicitly capture for an analysis, plus technical details such as image type, dimensions, capture angle, and quality results.
• Facial landmarks, measurements, analysis results, reports, protocol activity, and skin-check measurements derived from your photographs.
• Support messages you send, notification preferences, subscription status, and service activity needed to operate and secure your account.

maxxlook does not use advertising SDKs, does not access the advertising identifier, and does not track you across other companies' apps or websites.

Biometric data and your consent

Photographs of your face, facial landmarks, and measurements derived from them may be biometric data. maxxlook asks for explicit permission before any photograph is processed. You may decline and still manage or delete your account. You may also withdraw permission at any time in the app; doing so immediately locks every camera-backed feature until you choose to grant permission again.

We use face data only to perform the analysis or skin check you request, derive facial landmarks and measurements, create your reports and protocol, support progress tracking, and keep the service secure. We do not use face data to identify you, match you against another person, train advertising or generative models, sell it, or share it with advertisers.

Face-data sharing and equal protection

maxxlook does not share face data with advertisers, data brokers, research partners, or other third parties. No SDK receives your photographs, facial landmarks, or biometric measurements. Our contracted infrastructure providers may process face data only as necessary to host, encrypt, transmit, or secure maxxlook and only under our instructions; they may not use it for their own purposes. These providers are required by contract to provide the same or equal protection for face data as this Privacy Policy.

The providers currently used for these limited operational purposes are Amazon Web Services for private encrypted infrastructure and storage, and Clerk for authentication. Clerk does not receive face data. Stripe processes website payment information only and does not receive face data. If a future service provider would receive face data, we will require the same or equal protections before sharing it and will update this policy.

Camera and photo handling

The camera opens only after consent and a photo is captured only when you tap the shutter. Analysis photos are encrypted in transit and at rest and are retained while your account needs them to provide the service. Incomplete analysis photo sets expire after 72 hours. Skin-check photographs are measured server-side and discarded without being stored; only the resulting measurements are kept.

How we use information

• Authenticate your account and prevent unauthorized access.
• Provide requested analyses, reports, protocols, skin checks, and support.
• Maintain your history and compare measurements over time.
• Process account, consent, export, and deletion requests.
• Operate, troubleshoot, audit, and protect maxxlook.
• Comply with legal obligations and enforce our terms.

Service providers and disclosure

We use contracted service providers only where needed to operate maxxlook. These include Clerk for authentication, Amazon Web Services for infrastructure, encrypted storage, and transactional email, and Stripe for purchases made on the website. The iOS app does not collect payment-card information or offer an external purchase link. Providers may process information only to perform services for us and under their contractual and legal obligations.

We may also disclose information when required by law, to protect users or the service, or as part of a business transaction where the recipient assumes this policy's obligations. We do not sell personal or biometric information.

Retention and deletion

Analysis photographs and face data derived from them are retained only for the duration your active account needs them to provide the requested service and for up to 30 days after you request account deletion while the permanent purge completes. Incomplete analysis photo sets expire after 72 hours. Skin-check photographs are processed for the requested check and discarded without being stored; only the resulting measurements are retained. Consent records and security audit records may be retained for up to 365 days where needed to document compliance, resolve disputes, and protect the service. Data that has been irreversibly anonymized and aggregated no longer identifies you.

You can revoke consent for face-data collection or processing at any time in Settings → Privacy and consent. Revocation immediately disables every camera-backed feature and prevents new face-data processing; it does not by itself delete previously retained data. You can delete your face data and all associated account content directly in the app under Settings → Delete account, or contact us at privacy@maxlook.app. Access is disabled immediately and the permanent purge removes stored photographs, facial landmarks, biometric measurements, reports, protocols, and related account content within 30 days, subject only to the limited compliance and security records described above.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your information; withdraw biometric consent; object to or restrict processing; and complain to a data-protection authority. The app provides biometric-consent withdrawal, a downloadable data export, and account deletion in Settings. You may also contact us for help exercising a right.

Security

maxxlook uses transport encryption, encryption at rest, access controls, expiring sessions, and audit logging designed to protect sensitive information. No system is perfectly secure, so we also monitor operational failures and maintain procedures for responding to security incidents.

Age requirement

maxxlook is for adults aged 18 and older. We do not knowingly collect personal or biometric information from anyone under 18.

Contact

Questions, privacy requests, and appeals can be sent to privacy@maxlook.app. For product help, visit the support page.