Legal

Privacy Policy

Last updated: July 16, 2026

Who we are

Maxed ("Maxed," "we," "us") is a cosmetic photo-rating service available on the web and as an iPhone app. This policy explains exactly what happens to your information.

Your photo: no Maxed server copy

When you run a scan (or generate a "potential" glow-up preview in the iPhone app), Maxed sends one photo to our Cloudflare server over an encrypted connection. Our server immediately forwards that photo to Google LLC's Gemini API to generate your scores or preview, returns the result, and does not save a server copy. The image exists only in request memory while processing; it is not written to our database, files, object storage, or backups.

On the web, your browser may keep a temporary preview in the current tab so your face can appear on the paywall and paid scorecard after returning from checkout. It is never added to your Maxed account or sent to Stripe. We temporarily keep only the web numeric report on our server for up to one hour so you can complete checkout.

After a successful scan, the iPhone app stores the submitted photo, scores, on-device facial measurements, scan date, and any generated preview in the app's private container until you delete them in Settings or delete the app. Full iPhone-specific details, including Google retention, are in the iOS Privacy Policy.

Web accounts, saved scores, and routine progress

You may create an optional web-only account using an email address and password. We store your normalized email address, a salted one-way password hash (never the password itself), expiring session records, onboarding profile choices, numeric scan scores, scan dates, routine task completions, streak days, and the Stripe identifiers needed to restore web subscription access. We do not save the selfie with your history. Web accounts do not currently sync with the iPhone app.

To request deletion of a web account and its saved history, email [email protected] from the account email address.

Device identifier

A random identifier is generated in the app or browser and used to enforce usage limits and recognize subscription access before or without login. It is not your name, Apple ID, email, or Apple's advertising identifier. Creating a web account lets Maxed associate eligible web subscription access with that account so you can log in again.

Website and app usage analytics

To understand which features people use, improve Maxed, test different page wording, and measure our advertising, Maxed sends usage events, such as page viewed, scan completed, paywall shown, plan selected, and subscription purchased, with a random installation or browser identifier, app version, device locale, experiment assignment, and campaign labels supplied by the link you opened. The iPhone app may also include onboarding answers such as age range, goal, and whether you selected man or woman. These events go to our own server; iPhone-app events also go to Singular as described below. They never include your photo or face scores. To request deletion of your usage data, email [email protected].

Purchases and subscriptions

On the web, Maxed offers an optional auto-renewing Maxed Pro subscription handled by Stripe. Stripe receives the payment and contact information you enter on its hosted checkout page and processes your card details; Maxed does not receive or store your full card number. We receive subscription and payment status, the amount, Stripe customer and subscription identifiers, and limited checkout information needed to provide access, support, and fraud prevention. See Stripe's Privacy Policy.

The iPhone app offers an optional subscription ("Maxed Pro"). Those purchases are handled by Apple through the App Store; Apple processes your payment and we never see your card details. Apple's handling of your information is governed by Apple's Privacy Policy.

To manage your subscription status across devices, Maxed uses RevenueCat, a subscription-management service. When you make or restore a purchase, RevenueCat receives your App Store purchase receipt and a random, anonymous installation identifier, used solely to confirm whether your purchase is active. See RevenueCat's Privacy Policy. The fact that you subscribed is also shared with Singular so we can measure which ad led to the purchase.

Measuring our ads (SKAdNetwork & Singular)

On the web, landing-page parameters supplied by an ad platform, such as a TikTok click identifier and UTM campaign labels, may be attached to the Stripe Checkout session so we can understand which campaign led to a purchase. We do not attach your photo or scores to those parameters.

Maxed advertises on platforms such as TikTok, and we measure whether those ads lead to installs and subscriptions. We do this in two ways, both designed to avoid tracking you across other companies' apps or websites:

• Apple SKAdNetwork: Apple's built-in, privacy-preserving attribution framework, which reports ad conversions to us in aggregate without identifying you.
• Singular, a mobile measurement partner whose SDK is included in the app. Singular receives a device identifier (Apple's Vendor Identifier, IDFV), the app usage and purchase events described above, and technical information such as your IP address and device model, in order to attribute installs and subscriptions to the ad that drove them. See Singular's Privacy Policy.

We do not use Apple's advertising identifier (IDFA), we do not combine your data with third parties to build advertising profiles, and we do not track you across other companies' apps or websites, so Maxed does not show the App Tracking Transparency prompt.

Product links and Amazon Associates

The optional web Product Shelf may link to products on Amazon. When an approved Amazon Associates tracking tag is active, those links are marked as paid links and Maxed may earn a commission from qualifying purchases. Amazon may receive information associated with your click under its own privacy practices. Product recommendations are kept separate from face scoring and do not affect your scores or their presentation.

What we do not do

• We do not require an account to complete the initial web scan or Stripe checkout. An optional web account is required to restore saved history and routine progress later.
• We do not use Apple's advertising identifier (IDFA), and we do not track you across other apps or websites for advertising.
• We do not sell or rent your personal information. We share limited data only with the service providers named in this policy (Stripe, Apple, RevenueCat, Singular, Google, and our infrastructure provider Cloudflare) to operate and measure Maxed.
• We do not store your photos on our servers. The iPhone app stores completed scans privately on your device as described in the iOS Privacy Policy.

Diagnostics you choose to share

If your device is set to share crash and usage diagnostics with developers, Apple may provide us anonymized crash reports through App Store Connect. These contain no photo content and no personal identifiers. Turn this off in iOS Settings under Privacy & Security, then Analytics & Improvements.

Entertainment, not medical advice

Maxed's ratings and routine suggestions are cosmetic and for entertainment purposes only. They are not medical, dermatological, or health advice, and the app does not diagnose or assess any medical or health condition.

Children

Maxed is rated 17+ and is not directed at children. We do not knowingly collect personal information from anyone under 13.

Changes to this policy

If we update this policy, we will revise the "Last updated" date above and post the new version on this page. Continued use of the app after a change means you accept the updated policy.

Contact

Questions about privacy? Email [email protected] and we'll get back to you.