What we know about you (almost nothing).

We don't ask for your name, email, phone, or any identifier that ties this app to a real person. You sign in with a randomly-generated 64-character handle stored on your device. We never know who you are.

When you take a scan, your photo is sent to our AI provider (Anthropic) for one scoring pass, then stored on our servers under your anonymous handle until you delete it. Deleting a scan removes the photo from our servers. Deleting your account wipes everything tied to the handle.

When you upload a photo, the following happens:

1. The photo is uploaded to our server over HTTPS.
2. It's stored as a private blob tied to your anonymous handle.
3. The bytes are sent to Anthropic's Claude API for scoring.
4. Anthropic returns the scoring result to us.
5. We save the result alongside the scan record.
6. You can delete the scan and its photo at any time from the History screen.

We use these vendors to run the service. None of them know who you are — they only see your anonymous handle.

We do not share your data with anyone for advertising, marketing, profiling, or behavioral analysis purposes.

The app has two delete actions, both irreversible:

• Per-scan delete (History screen → trash icon on a row): removes that scan's record, its scoring data, and its photo from our servers.
• Delete everything (Settings screen → DELETE EVERYTHING): wipes every scan, every photo, and your handle from our servers. This satisfies CCPA / GDPR right-to-erasure.

We retain no copy after deletion. Because we don't know who you are, deletion is permanent and we can't restore it.

If you can't reach the app for any reason and want all data tied to a handle deleted, file an issue on our support tracker: github.com/ShipItAndPray/formx/issues.

FORM/X is intended for adults (18+). We don't knowingly collect data from anyone under the age limit. If you believe a child has used the app, contact us via the support tracker and we'll wipe any associated handle on request.

All traffic between the app and our servers is HTTPS (TLS 1.2+). We do not claim end-to-end encryption — your photo is sent in plaintext to the AI scoring service because the model needs to see pixels. After scoring, the photo is stored at rest on our server with the standard provider-side encryption applied to all blob storage.

The handle on your device is the auth credential. Treat it like a password — anyone with the handle has access to the scans tied to it.

Under GDPR / CCPA / UK-DPA, you have the right to access, correct, or delete your data. The Settings screen gives you direct access to all of these:

• Access — every scan in your timeline is visible
• Correct — re-scan to update; we don't store anything else editable
• Delete — per-scan or full wipe, both supported in-app

Photos and scan records are retained until you delete them. There is no automatic expiration. If your handle is inactive for 24+ months, we may purge the associated records to free space — your scan history would be lost, but no identifying information would have ever existed on our side anyway.

If we update this policy meaningfully, the "Last updated" date at the top changes and the app shows a one-time prompt on next launch. The app will not retroactively share data collected under a previous version of this policy in ways the previous version didn't allow.

Questions, requests, or deletion-by-support: github.com/ShipItAndPray/formx/issues.

Data controller: ShipItAndPray, the team behind FORM/X.