MaxxPrivacy Policy
Last updated: 9 October 2026
Maxx is a skin care app from Itworked Systems (Amsterdam, the Netherlands). You take one selfie, answer a few questions, and Maxx gives you a skin score, a routine and a chat coach. This page explains exactly what happens to your information. There are no accounts and no ads.
- Your selfie is sent for analysis to our server and to OpenAI, our AI provider. We do not store it. The only saved copy is on your phone.
- Your name, answers, reports, routine and chats stay on your phone.
- We never sell your data and never use it for advertising or tracking.
- You can delete everything on your phone any time: Settings, then Delete my data.
What leaves your phone, and why
| What | Why | Where it goes |
|---|---|---|
| Your selfie | To read your skin and write your report | Our server, then OpenAI. Not stored by us. |
| Your answers (age range, skin type, sensitivity, goal) | To fit the report and answers to you | Sent with the selfie and chat messages. Not stored by us. |
| Your chat messages (recent ones), your score and your routine | So the coach can answer your question | Our server, then OpenAI. Not stored by us. |
| An anonymous purchase ID | To check that your subscription is active | RevenueCat and Apple |
What we keep on our side
- Free preview: if you have not subscribed yet, we keep the generated report (not the photo) for 24 hours so it can be unlocked after you subscribe. It is linked only to a scrambled anonymous ID, then deleted automatically.
- Daily limits: to stop abuse we count requests per day against a scrambled (hashed) anonymous ID and a scrambled network address. These counters are deleted automatically within a few days.
- Server logs: standard technical logs from Google Firebase, for example the time of a request and an error code. They contain no photo and no chat text.
Our AI provider: OpenAI
Maxx uses OpenAI's API to analyse your selfie and to write chat replies. OpenAI processes the photo and text you send in order to return a result. According to OpenAI's published API terms, data sent through the API is not used to train its models unless the developer opts in, and we have not opted in. OpenAI may keep API inputs and outputs for a limited period (currently up to 30 days) to detect abuse. You can read their policy at openai.com/policies/privacy-policy. The app asks for your permission before your first selfie is sent.
Other services
- Google Firebase hosts our server.
- RevenueCat manages subscriptions and receives an anonymous ID and purchase information. See revenuecat.com/privacy.
- Apple handles payments. We never see your card or Apple ID.
Your choices and rights
- Delete everything on your phone: Settings, then Delete my data. This removes your photos, reports, routine and chats. Deleting the app does the same.
- Camera: you can turn camera access off in iOS Settings at any time.
- Cancel your subscription: in your Apple ID settings, at least 24 hours before the period ends.
- If you live in the EU, the UK or elsewhere with similar laws, you can ask us for access to, correction of or deletion of anything we hold about you. Because we hold almost nothing, this is usually answered with a short confirmation. Write to the address below.
Children
Maxx is not for children under 13 and we do not knowingly process their data.
Not medical advice
Maxx gives cosmetic guidance from a photo. It is not a medical device and does not diagnose, treat or prevent any condition. For anything that worries you, see a doctor or dermatologist.
Changes
If this policy changes, we update this page and the date at the top.