This policy applies to the Android app Hold That Pose.
Controller
Dominik Schweizer – Lionclaws Media, Im Wengertle 4, 71522 Backnang, Germany. Email: business@lionclaws.de. Telephone: +49 1573 0387777.
In short
The app needs no account and contains no ads and no general usage analytics operated by us. The app does not send your camera images, photos or live-match results to us or to Google. Data mainly leaves your device in two cases: if you agree to live match, Google receives technical diagnostic data. If you use the purchase screen or have Pro, RevenueCat and Google receive purchase data.
Camera and photos
The app uses the camera to show a pose over the camera image and to take photos. Photos and saved cards are stored in your device's media library. They remain there after the app is uninstalled until you delete them. The app does not read your existing photos and does not ask for your location. The legal basis is providing the feature you use (Article 6(1)(b) GDPR).
Live match
Live match is optional and only runs after you agree in the app. On your device, the app then detects body position and a face in the camera image. It uses facial features to estimate head orientation. It does not match identities or create a profile to recognise a person again.
Camera frames and the body points and head angles calculated from them are processed only temporarily on the device and are neither stored nor transmitted. The actual direction of the eyes is not measured. The percentage estimates how closely the pose matches the example and may be inaccurate. There is no automated decision with legal effect on you.
Other people in the picture
The analysis also affects the person you photograph. Tell them first and only turn on matching for them with their agreement. Without live match you can use the figure and the standard camera. If you publish photos of others or use the app professionally, you are responsible for the necessary consents and information.
Google ML Kit during live match
Live match uses Google ML Kit. Analysis runs on the device. According to Google, ML Kit does not send the images and their results to Google servers. While no match is running, the app does not create an ML Kit detector.
While a match runs, ML Kit sends technical data to Google in encrypted form, according to Google (developers.google.com/ml-kit/android-data-disclosure): manufacturer, model, operating system version and build, available ML accelerators, package name and app version, a per-installation identifier, performance metrics such as latency, API configuration such as image format and resolution, input and output sizes, feature version, event type and error codes. For pose detection, ML Kit also uses Firebase Installations and Firebase Remote Config.
According to the ML Kit terms (developers.google.com/ml-kit/terms), Google uses this data to measure performance, debug, maintain and improve the APIs and to detect misuse or abuse. We do not receive or store this individual data ourselves. Google determines the retention period; the pages named above give no fixed period for ML Kit.
The legal basis is your consent (section 25(1) of the German TDDDG, Article 6(1)(a) GDPR). You may withdraw it at any time for the future in the app under Me › Live match. This does not affect the lawfulness of processing before withdrawal. Without consent no match runs; all other features remain available.
Data on your device
Setup answers, saved poses, progress, photo history, settings and the time of your consent stay only in the app on your device. The app excludes them from Android backup and device transfer. You can clear the history in the app. Uninstalling removes this data from the device. Photo or device backups you have set up run independently of the app. Uninstalling does not delete purchase data held by Google Play and RevenueCat.
Before-and-after card and sharing
The card is created on your device. The app does not transmit it. If you share it, the Android menu opens. The privacy policy of the app you select there applies. Gallery and system services may sync saved images according to your settings.
Notifications
If you allow notifications, the app schedules reminders locally on your device. No push token is sent to us for them. You can turn them off at any time.
Purchases
We do not receive credit-card or bank-account details. However, we process purchase and transaction data to verify your purchase entitlement. For purchases through the standard Google Play billing system in Germany, Google Commerce Limited is your contracting party and Google Ireland Limited operates Google Play. In the Play Console we see order data such as order number, product, price, country and time.
We use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, as a processor to verify and manage your purchase entitlements. RevenueCat only starts when you open the purchase screen, restore purchases or have Pro active. It processes a randomly generated pseudonymous app user ID, your purchase history, Google's purchase receipt, device type, operating system and, for technical reasons, the IP address. This identifier does not make the data anonymous.
Processing takes place under a contract pursuant to Article 28 GDPR and on our instructions. Where the data is necessary to show prices and to provide or restore your purchases, processing is based on Article 6(1)(b) GDPR.
Purchase data is retained for as long as it is needed to verify, provide and restore an existing entitlement. Once that entitlement ends, only data necessary for unresolved refund or legal claims or statutory retention duties is kept, restricted to those purposes. We may need your purchase identifier to locate your data.
Transfers to the United States
Google diagnostics may be processed by Google LLC in the United States. Where the specific transfer is covered by the EU-US Data Privacy Framework and Google LLC's active certification, we rely on the adequacy decision under Article 45 GDPR. Entry and scope: www.dataprivacyframework.gov/participant/5780.
For transfers to RevenueCat we use the EU Standard Contractual Clauses agreed in the contract (www.revenuecat.com/dpa), Module 2. Information about these safeguards and a copy are available from business@lionclaws.de.
Downloads and crash reports
When you download and update the app, Google processes account and device data as operator of Google Play under its own responsibility. Google Play shows us aggregated statistics and crash reports.
Contact and support
When you contact us, we process your email address or phone number, your message and any purchase or device details you provide to handle your request. Contract-related enquiries are processed under Article 6(1)(b) GDPR, statutory data-protection requests under Article 6(1)(c), and other enquiries on the basis of our legitimate interest in responding under Article 6(1)(f). We retain correspondence until the matter is resolved and thereafter only where evidence, legal-claim or retention purposes require it. Our mailbox is hosted by IONOS SE, Germany.
This website
These pages are hosted on Google Sites. When you visit them, Google processes technical access data such as the IP address. The legal basis is our legitimate interest in providing this information (Article 6(1)(f) GDPR).
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability. Write to business@lionclaws.de. You may also complain to a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Objection where processing relies on legitimate interests: If we process personal data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop that processing unless compelling overriding grounds or the establishment, exercise or defence of legal claims justify continuing it. Contact: business@lionclaws.de.
Whether you must provide data
The purchase data described above is necessary to verify purchases and restore entitlements; without it we cannot verify the entitlement. Camera access and notifications are optional. Camera functions require camera permission and reminders require notification permission.
Notes for individual countries
Switzerland: We also comply with applicable Swiss data-protection law. The international disclosures described above mainly involve the United States. The safeguards used are the Swiss-U.S. Data Privacy Framework where the transfer is covered by it, and Standard Contractual Clauses adapted for Switzerland. You may complain to the Swiss Federal Data Protection and Information Commissioner.
United States: We do not collect, store, sell or share biometric data. The face analysis for live match runs only on your device, we have no access to it, and head angles are not stored.
Australia: Data may be processed in the United States. Send privacy concerns to business@lionclaws.de.
Minimum age
The app is intended for people aged 18 and over.
Changes
We inform you in good time about material changes to processing. If new consent is required, we obtain it before the relevant processing begins.
Last updated: 5 November 2026