PRIVACY POLICY
Last updated: 16/10/2026
THE SHORT VERSION
ModelScore analyses your face entirely on your own device. Your scan photos, your scores, and your answers to the onboarding questions never leave your phone and are never sent to us.
There are two exceptions. The first is always opt-in: the "Future You" feature. If you choose to use it, that one photo is sent to a processing server to generate your portrait, then deleted. The second is install attribution — a small amount of device and install information is shared with our attribution provider so we can tell which advert brought you to the app. Neither exception involves your scans, your scores, or your answers.
We have no user accounts. We cannot see your scores, your photos, or your answers, and we do not know who you are. We do measure which advert an install came from, which is described in full under "Advertising and Install Attribution" below.
ADVERTISING AND INSTALL ATTRIBUTION
We advertise ModelScore. To know which adverts are worth paying for, we need to know which advert an install came from — and nothing more than that.
For this we use AppsFlyer, an attribution provider. When you first open the app, AppsFlyer receives a limited set of technical information: your device's vendor identifier, your device model and operating system version, your language and approximate region, your IP address, and the fact that an install or session occurred. If you start or complete a purchase, it also receives which product it was, its price and currency, and the transaction reference. If — and only if — you grant permission on the App Tracking Transparency prompt, it also receives your device's advertising identifier.
That information is matched against the advertising networks we buy from so the install can be credited to the right advert.
What is never included: your photos, your scans, your scores, your five metric breakdowns, your height, your onboarding answers, or anything else you do inside the app beyond starting or completing a purchase. Those stay on your device, exactly as described below.
Under Apple's definitions this constitutes tracking, and we declare it as such on our App Store privacy label. If you decline the App Tracking Transparency prompt, your advertising identifier is not collected and is not used. You can change that decision at any time in iOS Settings, under Privacy & Security, then Tracking.
Legal basis (UK/EU): consent, given through the App Tracking Transparency prompt where an advertising identifier is involved, and our legitimate interest in measuring our own advertising for the limited technical data above. You can withdraw consent at any time using the iOS setting described above.
AppsFlyer acts as our processor for this. Their own privacy policy is published at appsflyer.com/legal/privacy-policy.
WHAT HAPPENS ON YOUR DEVICE ONLY
The following is processed locally on your iPhone and is never transmitted to us or anyone else:
• Photos you scan. When you capture or select a photo, facial analysis runs on your device using Apple's Vision framework. The image is never uploaded.
• Your scores and breakdowns. Your overall score, the five metric scores, and your category are calculated on-device and stored on-device.
• Your scan archive. Saved scans — including the photo attached to each one — are stored in your app's private storage on your phone. They are included in your encrypted iPhone backup if you use one, but we have no access to them.
• Your onboarding answers. The information you provide during setup (such as your gender, age band, modelling goal, self-assessment, and habit ratings) is stored only on your device and is used only to tailor the wording of your refinement plan.
Because this data never reaches us, we cannot retrieve it, export it, or delete it on your behalf. You control all of it directly — see "Deleting Your Data" below.
THE ONE EXCEPTION: "FUTURE YOU" PORTRAITS
"Future You" is an optional, separately purchased feature that generates an editorial-style portrait based on a photo of you. It is the only part of ModelScore that sends *your photo* off your device, and it only ever runs when you explicitly tap to generate.
Here is exactly what happens when you use it:
1. The photo you have selected is sent over an encrypted connection to our processing endpoint, hosted on Cloudflare Workers.
2. That endpoint immediately forwards the photo to OpenAI, which generates the portrait. OpenAI acts as our processor for this operation.
3. The generated portrait is returned to your device.
4. Our endpoint does not store, log, or retain your photo or the generated image at any point. It holds them only in memory for the few seconds the request takes.
Legal basis (UK/EU): we process this photo on the basis of your consent, which you give by tapping to generate. A facial image used to create a likeness may constitute biometric or special category data in some jurisdictions; your explicit consent is the basis on which we process it. You can withdraw consent at any time by simply not using the feature.
About OpenAI's handling: OpenAI states that data submitted through its API is not used to train its models, and that it may retain API data for a limited period for abuse monitoring before deletion. We do not control OpenAI's systems or that retention period. If you are not comfortable with this, do not use the Future You feature — every other part of ModelScore will continue to work normally and stays entirely on your device.
Please only upload photos of yourself. Do not upload photos of other people without their permission, and do not upload photos of anyone under 18.
PURCHASES AND SUBSCRIPTIONS
Payments are handled entirely by Apple through the App Store. We never see, receive, or store your name, card details, billing address, or Apple ID.
Apple tells our app one thing only: whether a valid purchase exists. We use that single yes/no answer to unlock features. That check happens on your device.
Apple's own handling of your purchase data is governed by Apple's Privacy Policy, not this one.
SHARING YOUR RESULTS
If you tap to share a score card or portrait, the image is created on your device and handed to the standard iOS share sheet. You choose the destination. We are not involved in, and have no visibility into, what you share or where you send it.
WHAT WE NEVER COLLECT
To be explicit, ModelScore does not collect, and has no technical means of collecting:
• Your name, email address, phone number, or any account credentials — the app has no accounts and no sign-in
• Your location
• Your contacts, calendar, health data, or messages
• Your device advertising identifier (IDFA)
• Analytics, crash telemetry, usage statistics, or behavioural data
• Any information about your face, your scores, or your progress
We do not sell or share personal information, and we do not engage in cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act. We have never done so and have no plans to.
THIRD PARTIES
Only two third parties are involved, and only when you use Future You:
• Cloudflare — hosts the processing endpoint that relays your request. Cloudflare processes the request in transit and does not retain the image.
• OpenAI — generates the portrait. See the Future You section above for details on their handling.
Apple is involved in processing your purchases, as described above.
We use no analytics providers and no product-analytics SDKs. We do not track your behaviour inside the app: which screens you open, what you scan, and what you score are never transmitted. The one third-party SDK in the app is AppsFlyer, used solely to attribute installs and purchases to the advertising that produced them, as described above.
INTERNATIONAL TRANSFERS
If you use Future You, your photo may be processed on servers located outside your country, including in the United States. Where this involves a transfer out of the UK or European Economic Area, it is made on the basis of your explicit consent and, where applicable, standard contractual clauses maintained by our processors.
DATA RETENTION
Data stored on your device stays there until you delete it — either by deleting individual scans in the app, or by deleting the app entirely.
Data passing through Future You is not retained by us at all. OpenAI's retention is governed by their policy, described above.
YOUR RIGHTS
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict processing, and to withdraw consent.
In ModelScore's case, almost all of these you can exercise yourself and instantly, because your data is in your hands rather than ours:
• To access or export it — your scans are in the app on your device
• To delete it — see below
• To withdraw consent for Future You — stop using the feature
If you believe we hold data about you and want to make a formal request, email us and we will respond within 30 days. In practice, the honest answer will usually be that we hold nothing about you, because we do not collect it.
If you are in the UK or EU you also have the right to lodge a complaint with your local data protection authority.
DELETING YOUR DATA
To delete individual scans: open the Archive tab, tap a scan, and choose Delete Scan.
To delete everything: delete the ModelScore app from your iPhone. This permanently removes all scans, photos, scores, and onboarding answers stored on your device. There is no server-side copy to request deletion of.
Note that deleting the app does not cancel your subscription — see the Support page for how to cancel.
CHILDREN
ModelScore is not directed at children and is not intended for anyone under 13. We do not knowingly collect information from children. The Future You feature must not be used with photos of anyone under 18.
SECURITY
Data on your device is protected by iOS's built-in app sandboxing and, if you have a passcode set, by device encryption.
Requests to the Future You endpoint are sent over HTTPS and authenticated. Because we store nothing, there is no database of user data to breach.
A NOTE ON WHAT THE SCORES ARE
ModelScore's scores are an aesthetic and informational estimate based on facial geometry. They are not a medical assessment, a psychological assessment, or a statement about your worth as a person. They should not be used to make health decisions.
CHANGES TO THIS POLICY
If we change how the app handles data, we will update this page and change the "Last updated" date above. Material changes — particularly any that would involve collecting data we currently do not — will be surfaced in the app before they take effect.
CONTACT
Questions about this policy, or about privacy generally:
reynoldsjack47@gmail.com