Privacy Policy

Effective 24 August 2026. Last updated 30 September 2026.

This is the full version. It says exactly what happens to every piece of information the app touches.

1. Who we are

TensaSkin is an iPhone app operated by [YOUR LEGAL NAME], an independent developer based in [COUNTRY] ("TensaSkin", "we", "us"). For data protection purposes we are the controller of the personal information described in this policy.

You can reach us at support@tensaskin.com about anything in this policy, including a request to access or delete your data.

2. What this policy covers

This policy covers the TensaSkin iPhone app and the website at tensaskin.com. It does not cover the App Store itself, or any other service you reach by leaving our app.

3. TensaSkin is for adults only

TensaSkin is intended for people aged 18 and over. The app asks for your date of birth during onboarding and does not support anyone under 18. It is not directed to children, it is not designed for them, and we do not want their data.

We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you are a parent or guardian and you believe a minor has given us information, email support@tensaskin.com and we will remove it promptly.

4. Your progress photos

Your photos may still be included in your own iCloud or iTunes device backup if you have backups switched on, because iOS backs up an app's container. That backup is yours and is governed by Apple's privacy policy, not this one.

Deleting the app removes the photos with it. Settings also has a button that erases everything without deleting the app. Both are permanent, and neither is recoverable by us.

If this ever changes — for example if we add an optional cloud analysis feature — we will update this policy first, tell you in the app, and ask for your explicit consent before a single photo is uploaded. Silence will never be treated as consent for that.

5. Everything else that stays on your device

TensaSkin is built local-first. The following is written to your iPhone's app storage and is never transmitted to us:

• Your quiz answers: date of birth, current height and weight, the body areas you chose to work on, your activity level, how you sleep, your usual wake time, and the goal you picked.
• Your check-in history: every progress photo, its date, and the weight you recorded with it if you chose to record one.
• Your daily logs: the ritual steps, training sessions, meals, water and sleep you record each day.
• Your progress: streaks, weekly scores, completed sessions, and which parts of the app you have already been shown.
• Your settings: units, reminder preferences, and similar.

This information is under your control. Because it never reaches us, we cannot recover it for you if it is lost, and it is not included in any backup we hold.

6. Your account, if you create one

An account is optional and is only required to use meal scanning and the AI coach. You create one with Sign in with Apple. When you do, we receive:

• A user identifier that identifies your account to our servers.
• An email address. If you chose "Hide My Email" when signing in, this is an Apple private relay address rather than your real one, and we never see your real address.

We do not ask for your name, your phone number, your address, or any other contact detail. We never receive your Apple ID password.

7. The AI features

Meal scanning

When you photograph a meal, that photo is sent to our server, which forwards it to Google's Gemini API to identify what is on the plate and estimate its nutrition. The result is returned to your phone, where you can edit every figure before saving it.

We do not store the meal photo. It exists only for the length of the request, is not written to any database, file store or log of ours, and is discarded once the response is sent. Google's handling of the image while it processes the request is governed by Google's own terms for its AI APIs.

This is the meal photo only. It has nothing to do with your progress photos, which are covered in section 4 and are never sent anywhere.

The AI coach

When you send the coach a message, we send that message to OpenAI along with a numeric summary of your progress so the reply can reference your actual figures. The summary is assembled on your device and contains only numbers and fixed values: for example your age, height, weight, weekly score, streak lengths and the percentage of your daily targets you have hit. It contains no free text, no name, no contact details and no image.

Your message is first checked by OpenAI's moderation service. If it is flagged, the app replies with a fixed safety message and no coaching call is made. This runs before anything else, because the app tracks how you feel about your own body and that is a subject where a wrong answer can do harm.

We do not store your messages or the coach's replies. Your conversation is held on your device. Our servers pass it through and keep no copy.

What we never do with either

We do not use your photos, your messages or your logs to train AI models, ours or anyone else's, and our agreements with our AI providers are on their non-training API terms.

8. Subscriptions and payments

TensaSkin sells an auto-renewing subscription. All payment is handled by Apple through your App Store account. We never see your card, bank details or billing address.

We use RevenueCat to keep track of whether a subscription is active. Through RevenueCat we receive the product you bought, whether the subscription is active, when the current period ends, and whether it was refunded or cancelled. We store a copy of that status against your account so the app can unlock the paid features.

9. Usage counts, and why we keep them

The AI features cost us money on every call, so we count them. For each account we record, per day and per feature, how many calls were made, the number of tokens used and what those calls cost. This is what enforces the daily and monthly limits and stops a single account from running up an unbounded bill.

These counts are deleted automatically after 90 days by a scheduled job. They record that a call happened, never what was in it.

10. Server logs

Our server writes one line per AI request containing the account identifier, which feature was used, how the request ended (success, rate-limited, timed out, and so on), how long it took, and the token count and cost. This is how we find outages and runaway costs.

Nothing you typed, photographed, or that a model wrote back is ever written to a log. Our hosting provider also keeps standard infrastructure logs, which may include IP addresses, for security and reliability.

11. Device permissions

• Camera. Requested the first time you take a progress photo or scan a meal, and used only while that screen is open. TensaSkin does not browse your photo library and does not record audio or video.
• Notifications. Optional. Every TensaSkin notification is scheduled locally on your iPhone by the app itself. There is no push server, we hold no device token, and no notification data leaves your phone.

You can withdraw either permission at any time in the iOS Settings app. The rest of TensaSkin keeps working without them.

12. What we do not do

• We do not show advertising of any kind.
• We do not embed third-party analytics, attribution or advertising SDKs. TensaSkin contains no such tracker.
• We do not track you across other companies' apps or websites, and we do not ask for the App Tracking Transparency permission.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.
• We do not build advertising or marketing profiles about you.
• We do not use your photos, messages or logs to train AI models.
• We do not make decisions about you by automated means that produce legal or similarly significant effects.

13. Who else processes your data

We keep the list as short as the product allows. Each of these acts on our instructions for the purpose shown, under a written data processing agreement.

None of them ever receives a progress photo, because no part of the app sends one.

We may also disclose information if we are legally required to, or where it is necessary to establish or defend a legal claim, or to protect the safety of a user or the public. If TensaSkin is ever sold or transferred, your information may transfer with it; we would tell you before that happened.

14. Where your data is processed

Our providers operate internationally, and our AI providers are based in the United States. If you are in the United Kingdom, the European Economic Area or Switzerland, this means your information may be transferred outside your country to somewhere with different data protection laws. Where that happens we rely on the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies, as the safeguard for that transfer.

15. Our legal bases (UK and EEA users)

• Performance of a contract. Running your account, delivering the AI features you paid for, and managing your subscription.
• Legitimate interests. Counting AI usage to prevent abuse and control costs, and keeping security and reliability logs. We have balanced this against your rights and kept the data minimal and short-lived.
• Consent. Camera access and notifications, each of which you grant through iOS and can withdraw at any time in the Settings app.
• Legal obligation. Keeping records we are required to keep, such as for tax.

Information about your body — your photos, measurements and the areas you chose to work on — stays on your device and is never sent to us, so we do not process it at all and no legal basis is needed for it. You are its only holder.

16. How long we keep things

17. Your rights and how to use them

Two of them are buttons in the app:

• Export your data. Settings → export. You get a file containing everything the app holds about you, which you can save or send wherever you like.
• Delete everything. Settings → delete. This erases your account and everything attached to it on our servers, then wipes the app's data from your device, progress photos included. It cannot be undone. If you are not signed in, it still erases everything on the device.

Deleting your account does not cancel your App Store subscription, because only Apple can do that. Cancel it in Settings → your name → Subscriptions on your iPhone, otherwise it will keep renewing.

Depending on where you live you also have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive it in a portable format, and to withdraw consent at any time. Email support@tensaskin.com and we will respond within 30 days. We will never charge you or degrade your service for exercising a right.

If you are in the UK or EEA and you are not satisfied with our response, you can complain to your national data protection authority.

18. United States residents

In the past 12 months we have collected the categories of personal information described in sections 6 to 10: identifiers, commercial information about your subscription, internet activity in the form of usage counts, and the content you submit to the AI features. We collect it for the purposes described in this policy and from you directly.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the past 12 months. We do not do either of these things. If you are a resident of California, Colorado, Connecticut, Virginia, Utah or another state with a comprehensive privacy law, you have the right to know, delete and correct your personal information, to obtain a portable copy, to opt out of sale, targeted advertising and profiling (none of which we do), and not to be discriminated against for exercising those rights. Use the in-app buttons above, or email us. We honour Global Privacy Control signals on our website.

We are not a HIPAA covered entity and TensaSkin is not a healthcare service. Nothing you record in the app is protected health information under HIPAA, and no doctor-patient relationship is created by using it.

19. Security

Traffic between the app and our servers is encrypted in transit. Our database uses row-level security so an account can only ever read its own rows, our AI provider keys live only on the server and are never shipped inside the app, and account deletion is authenticated so that a request can only ever delete the account that made it.

Your progress photos sit inside your iPhone's app container, protected by iOS file encryption and your device passcode. Keeping a passcode on your phone is the single most useful thing you can do to protect them.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.

20. Other services

The app and this site may link to services we do not operate, such as the App Store or Apple's subscription management. We are not responsible for their content or their privacy practices, and this policy does not cover them.

21. Changes to this policy

We will update this page when our practices change, and the date at the top will change with it. If a change is significant we will tell you in the app before it takes effect. Continuing to use TensaSkin after a change means you accept the updated policy. A change that would send data off your device which previously stayed on it will always be opt-in.

22. Contact us