Privacy Policy

Last updated: October 9, 2026

1. Who we are

VTaper Max is an iPhone app and this website, vtapermax.app. Both are run by the operator of VTaper Max, based in Ontario, Canada ("VTaper Max", "we", "us"). We decide how and why your information is used, so we're responsible for it (the "controller" under EU and UK law).

Our Privacy Officer is accountable for privacy at VTaper Max under Canada's privacy law (PIPEDA), and is also the person in charge of protecting personal information under Quebec law. Contact the Privacy Officer at privacy@vtapermax.app. For anything else, email support@vtapermax.app.

This policy covers the app, this website and emails you send us. If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy also applies to you.

2. What we collect

In the app

• A random app ID. The app creates it on your phone the first time you open it. There are no accounts, and the ID isn't linked to your name, email, Apple ID or advertising ID. We use it to connect your subscription to your app usage. You can see it, and copy it, in Profile → Privacy and data. "Delete all my data" replaces it with a new one.
• Scan photos and the details sent with them. These are used for a few seconds and not kept. See How the scan works.
• Usage events, such as "scan completed", "routine completed" or "paywall viewed". Each event holds the event name, the screen, the time, the app version, the platform (iOS), a random event ID and a few details, such as which plan you tapped, how long a scan took or which quiz step you finished. Not your answer to that step. Events are designed not to include photos, body measurements, scores, height, weight, age, your name or your email, and our server is built to reject any batch of events that includes them.
• Subscription records. When you buy, renew, cancel or have a billing problem, RevenueCat tells our server. We store the type of event, your random app ID, the plan (weekly, yearly or the yearly offer), the purchase and expiry dates, the store, and whether it was a test purchase. We don't store your name, email, price paid or payment details, and we don't receive them.
• Technical data. Like any online service, our servers see your IP address and basic details of each request when the app connects. We use your IP address to limit how many scans one connection can run per minute, which stops abuse. That count lasts about a minute. Cloudflare keeps technical request logs (such as the time, the address requested and network details) for up to 7 days. Our own log entries are designed to hold only event names and error codes, not what you sent.

On this website

• We don't set cookies, and we don't use advertising or tracking tools.
• Cloudflare Web Analytics counts page views and visits, and shows us totals such as which pages are popular, which sites sent visitors, and broad browser, device and country breakdowns. Cloudflare states that it doesn't use cookies or local storage, and doesn't fingerprint visitors by their IP address or browser.
• Cloudflare hosting. Cloudflare processes your IP address and request details to deliver pages and protect the site from attacks.

When you email us

We get your email address, your name if you include it, and whatever you write. Mail to our vtapermax.app addresses passes through Cloudflare Email Routing, which Cloudflare states doesn't store it, to the inbox we reply from.

What we don't collect

• No account, password, phone number, contacts or precise location.
• No advertising ID. We don't track you across other companies' apps or websites.
• No Apple Health data.
• No payment card details. Apple handles payment.
• No facial recognition. We don't create a face template or any other biometric identifier, and we don't try to work out who you are from your photos.

3. How the scan works

1. On your phone: you take two photos, front and side. Before anything is uploaded, the app pixelates the area around your face.
2. Upload: the photos go over an encrypted connection to our scan service, which runs on Cloudflare. With them go your height and, if you've set them, your goal, body type, training experience and training days.
3. Measuring: a pose-detection model finds points on your body and its outline, and measures widths and angles such as your shoulders, waist, hips, neck and posture. To measure your neck and head posture, it uses the rough position of your pixelated head, including your nose, ears and mouth. It doesn't recognize who you are. Your height turns the measurements into real-world sizes.
4. Scoring: a fixed formula turns the measurements into your V-Taper Score and zone scores, so the same photos give the same numbers. Results are labelled "AI estimate".
5. Coaching note: a text AI model on Cloudflare Workers AI writes a short note. It receives only your scores, ratios and goal, never your photos, height, weight or age.
6. Done: the result goes back to your phone. The photos and the details sent with them are dropped from memory. Our scan service is designed so that they're not written to storage or logged, no one at VTaper Max looks at them, and we keep no record of your scan. The whole thing usually takes a few seconds.

Scanning is optional. A scan starts only when you tap "Scan my frame". "Skip for now" builds your plan from your quiz answers alone.

The pixelation hides the detail of your face while keeping enough of its outline to measure your posture. It makes your face hard to recognize, but it can't promise that nobody could ever recognize you from a photo. That's one more reason we don't keep your photos.

4. What stays on your phone

The app keeps these in its private storage on your iPhone. They aren't sent to us, except for the scan details described above, and we can't see them:

• your quiz answers, including your goal, first name, age, height, weight, training and what's holding you back
• your scan photos (with your face pixelated), scan results and history, and tape measurements
• check-ins, routines completed, protein meals, streaks and reminder settings
• the outcome of the app's safety questions and any pain you report during a routine. The app keeps only the outcome (for example, "neck exercises paused"), not your answers.

Export: Profile → Privacy and data → Export my data creates a file with your scan history and photos that you can save or share.

Delete: Profile → Privacy and data → Delete all my data wipes all of it from your phone and gives the app a new random ID. You confirm by typing DELETE. Before it resets, the app offers to email us your current app ID so we can delete the server records linked to it. Deleting the app also removes its data from your phone.

Backups: if you back up your iPhone to iCloud or a computer, the backup may include the app's data. That's handled by Apple and your settings, not by us.

We can't restore it: because this data is only on your phone, we don't have a copy. If you delete it, delete the app, or lose, reset or replace your phone without a backup, it may be gone for good. Keeping your phone secure and backed up is up to you; see our Terms of Use.

Sharing and reminders: a share card goes only where you send it from your iPhone's share sheet. Reminders are set on your phone, so we don't receive a notification token.

5. How we use information

• To run your scan and give you your result.
• To provide your subscription, check it's active and restore purchases.
• To understand and improve the app, for example to see where people get stuck and to fix bugs. We use usage events and website totals for this.
• To keep the service secure and prevent abuse, using IP addresses and request logs.
• To answer your emails and handle your requests.
• To keep the financial records that tax law requires, using subscription records.

We don't sell your information, share it for targeted advertising, show ads, or build advertising profiles. Your scores are calculated automatically, but they're estimates for your own use. We don't make any decision about you that has legal or similarly significant effects.

AI and training

We don't train AI models on your photos, measurements, scores or anything else of yours. We use ready-made models as they are. Cloudflare, which runs the text model, states that it doesn't use customer content to train the AI models on Workers AI.

6. Legal bases (EU and UK)

If you're in the European Economic Area, the UK or Switzerland, the law requires a legal basis for each use:

• Scan photos and body measurements: your explicit consent, because they may count as health data. You give it by choosing to scan, and you can withdraw it at any time by not scanning. Withdrawing doesn't affect scans already done.
• Subscription records and the random app ID for purchases: to perform our contract with you.
• Keeping subscription records for tax: to meet a legal obligation.
• Usage events, website totals, request logs and rate limits: our legitimate interests in understanding, improving and securing the app. You can object.
• Support emails: to perform our contract with you, or our legitimate interest in answering you.

7. Who processes your data

We use a few service providers. They process data for us under their contracts with us.

• Cloudflare, Inc. (United States) hosts this website, our API and our scan service. It runs the pose-detection and AI text models, stores usage events and subscription records, provides website analytics and routes our email. Cloudflare's privacy policy.
• RevenueCat, Inc. (United States) manages subscriptions and checks App Store receipts. It receives your random app ID, your purchase and receipt data, your device type and iOS version, when you last used the app, and your region and currency settings. Like any web service, it also sees your IP address when the app connects. RevenueCat's privacy policy.
• Apple takes your payment and manages your subscription through your Apple ID. Apple does this as an independent company under its own privacy policy. It doesn't give us your name, email or card details.
• Our email provider stores the emails you send us.

We may also disclose information when the law requires it, for example under a valid court order, or to protect someone's safety. If VTaper Max is ever sold or transferred, your information would go to the new owner under this policy, and we'd give notice in the app or on this website first.

8. Where your data is processed

We're in Canada, but our providers process data in other countries, mainly the United States. Information processed in another country is subject to its laws, and its authorities may be able to access it.

• Scans run in Cloudflare data centres around the world, usually one near you. So your photos may be processed, briefly, outside your country.
• Subscription records are stored in Cloudflare's Eastern North America region, which may be in the United States or Canada.
• Usage events and request logs are kept on Cloudflare's network.
• RevenueCat stores data on Amazon Web Services in the United States.

For data from the EEA, the UK or Switzerland, Cloudflare relies on its certifications under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, backed by the European Commission's Standard Contractual Clauses. For our other providers, we rely on the safeguards in their data protection terms.

9. How long we keep it

• Scan photos and the details sent with them: only for the seconds a scan takes. Not stored.
• Scan results: not kept by us. They stay on your phone until you delete them.
• Everything stored on your phone: until you delete it or the app.
• Usage events: Cloudflare deletes them automatically after three months.
• Subscription records in our database: six years after the end of the tax year they relate to, as Canadian tax law requires. Then we delete them.
• Subscription data at RevenueCat: while we use RevenueCat to manage subscriptions. We can ask it to delete a person's records.
• Request logs: up to 7 days.
• Scan rate-limit counts: about a minute.
• Website analytics: we only ever see totals, not individual visitors.
• Support emails: as long as we need them to help you and handle any follow-up, then we delete them. For a privacy request, we keep a record of the request and our answer for as long as we need to show we handled it properly.

10. Security

We use reasonable safeguards for the information we handle:

• Connections between the app, this website and our servers are encrypted in transit (HTTPS).
• Our scan service is designed to hold scan photos only in memory and not to write them to disk.
• We hold very little: no accounts, passwords, names or email addresses on our servers.
• Our server is built to reject analytics that contain photos or body data, and our own logs are designed not to record what you send.
• On your phone, the app's data sits in its private storage, which iOS protects. Use a device passcode.

No method of sending data over the internet or storing it electronically is 100% secure, so we can't guarantee absolute security.

Your part: you're responsible for the security of your phone (for example its passcode and iOS updates), your backups, and any export or share card you create and send. As far as the law allows, we're not responsible for data once it's stored on your device or in your backups, or after you share it, or for how Apple handles information as an independent company under its own privacy policy. We remain responsible, as the law requires, for the providers that process data for us.

If a breach creates a real risk of significant harm, we'll report it to the regulators and tell the people affected, as the law requires. We don't have your contact details, so we'd do that in the app and on this website.

11. Your rights

Most of your data lives only on your phone, so you control it directly: export it or delete it in the app at any time. You can also email us. We answer privacy requests from anyone, wherever they live.

Canada

Under PIPEDA, you can ask to see the personal information we hold about you and have it corrected. You can withdraw your consent, subject to legal or contractual limits, and you can challenge how we comply with the law. Please contact us first. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Quebec

Under Quebec's private-sector privacy law, as amended by Law 25, you can also ask to access or correct your information, withdraw your consent, and get a copy of information you gave us in a structured, commonly used format. You can also ask us to stop sharing your information or to de-index it. You can complain to the Commission d'accès à l'information du Québec.

EU, UK and Switzerland

You have the right to access, correct or erase your data, restrict how we use it, get a copy you can take elsewhere, object to our use of it, and withdraw consent at any time. You can complain to your local data protection authority: EU authorities, the UK's Information Commissioner's Office or Switzerland's FDPIC.

California

The California Consumer Privacy Act (CCPA), as amended by the CPRA, applies only to businesses above certain size limits. Whether or not it applies to us, California residents can:

• know what personal information we've collected about them, where it came from, why, and who received it, and get a copy
• have it deleted or corrected
• opt out of its sale or sharing. We don't sell or share personal information.
• limit the use of sensitive personal information. We use it only to provide the scan you ask for, so there's nothing to limit.
• use these rights without being treated differently

In the past 12 months, we collected these categories of personal information:

• Identifiers: the random app ID, IP address, and your email address if you contact us.
• Commercial information: subscription records.
• Internet or other electronic network activity: app usage events and website totals.
• Visual information: scan photos, processed briefly and not kept.
• Sensitive personal information: body photos and measurements, processed briefly to give you your scan and not kept.

These come from you, your device, and Apple through RevenueCat. We use them for the purposes in section 5 and disclose them for business purposes only to the providers in section 7. We haven't sold or shared personal information, including that of anyone under 16. How long we keep each category is in section 9. You can use an authorized agent; we may ask for proof that they act for you. We don't share personal information with others for their own direct marketing.

Other US states

Many states, including Virginia, Colorado, Connecticut, Texas and Oregon, give residents rights to confirm, access, correct and delete their personal data, get a copy, and opt out of targeted advertising, sale and certain profiling. We don't do targeted advertising, sell personal data or profile people in ways that have legal or similarly significant effects. We treat a Global Privacy Control signal from your browser as an opt-out request. If you live in Washington, Nevada or Connecticut, see also our Consumer Health Data Privacy Policy.

12. How to use your rights

1. In the app: Profile → Privacy and data → Export my data, or Delete all my data.
2. By email: write to privacy@vtapermax.app. Tell us what you'd like and where you live. It's free.

Because there are no accounts, the records on our servers (subscription records and usage events) are linked only to a random app ID, not to your name or email. To let us find yours, include your app ID: in the app, go to Profile → Privacy and data, where you can copy it or tap "Request deletion of server records" to send us an email with it filled in. Without the ID we can't match server records to you. Send the request before you use "Delete all my data", because that gives the app a new ID and older records can no longer be connected to your phone. We can delete your subscription records and ask RevenueCat to delete its records for your ID. Usage events are deleted automatically after three months. Subscription records are kept for the period tax law requires, even if you ask us to delete them, where the law allows us to keep them.

We'll ask only for the information we need to check a request is genuine, and never for a password. We'll reply within 30 days. Some laws allow more time; if we need it, we'll tell you why.

Appeals: if we turn down your request, reply with "Appeal" in the subject line. We'll answer in writing within 45 days. If you're still not satisfied, you can complain to your privacy regulator or, in the US, your state Attorney General.

13. Adults only

VTaper Max is for adults 18 and over only. The app asks your age and doesn't let anyone under 18 continue, and it's rated 18+ on the App Store. We don't knowingly collect information from anyone under 18. If you believe a minor has used the app, contact us. Data on their phone can be deleted in the app, and we'll delete anything of theirs we can identify.

14. Changes

If we change this policy, we'll update this page and the date at the top. If a change is significant, we'll also tell you in the app or on this website before it takes effect. Where the law requires it, we'll ask for your consent.

15. Contact

VTaper Max, Ontario, Canada.
Privacy questions and requests: privacy@vtapermax.app
Everything else: support@vtapermax.app