Effective 8 October 2026.
Who we are and what this policy covers
BERKAY TURK, entrepreneur individuel trading as BRT Apps, is the data controller for BronzeMaxx: UV & Tan Tracker and bronzemaxx.com. Our business address is 370 rue centrale, 01200 Valserhône, France. Contact support@bronzemaxx.com or +33 6 14 12 55 74.
This policy covers our website, support communications and the BronzeMaxx iOS and Android apps, including their optional sign-in, cloud backup and cloud coach. BronzeMaxx is intended for adults aged 18 and over and has no public social feed or advertising. The apps do not track you: we do not link app data with other companies' data for advertising, and the apps use no advertising identifier.
Website and support
Our website has no account form, advertising trackers, analytics cookies or session replay. Fonts and images are served with the website rather than loaded from third-party font or image services. Cloudflare delivers and protects the site and processes connection information such as IP address, requested URL, request time, browser information and security events. These technical operations are separate from advertising or behavioural analytics.
When you email us, we receive your email address, message, any attachments you choose to send and our subsequent correspondence. Cloudflare Email Routing forwards messages to a Google Gmail inbox managed by the founder. The inbox is not a Google Workspace account. We use the information to answer your question, handle an issue or act on a privacy request. Do not send passwords, access tokens, payment-card details, unnecessary health information or private photos. The app's support-draft export does not send a message by itself.
App account and optional sign-in
When you first use purchases or a cloud feature, the app creates a random account identifier with our identity provider, Supabase (database region: Frankfurt, Germany). It contains no name, email address or phone number; it links your purchases and the cloud services you choose to your installation. Session credentials are stored in the device Keychain on iOS and encrypted with the Android Keystore on Android; they are not included in exports or analytics.
After a successful purchase you can choose to protect it by signing in, so that access and backup can be recovered on another device. Signing in is never required to buy or to use the app.
- Sign in with Apple (iOS app) shares a stable Apple identifier and the email address Apple provides, which can be a private relay address.
- Google sign-in shares your Google account identifier, email address and, where Google provides it, your name. On Android, it uses Android's Credential Manager.
- Email code: the address you enter receives a one-time code sent by Resend.
Supabase stores your email address and sign-in method, which we use only for sign-in, account recovery and essential service messages. We do not send marketing email. Sign-in emails contain no journal photos, Health records or sensitive profile context; open and click tracking are disabled.
Resend sends our email from Ireland, but stores message content, delivery logs and account records in the United States. Its Free plan retains email and log data for 30 days; provider backups and legally required records have separate retention rules. Transfer safeguards include the standard contractual clauses in Resend's data processing terms. Resend data handling, Resend processing terms.
Your app data and choices
Your personal archive is stored locally: profile and onboarding answers, preferences, product shelf, routines, trips and selected places, sessions, water records, notes, conversations and journal photos. Optional profile fields can include skin response, sensitivity and medication context. These may reveal health information; you can skip personal questions and use a profile without a photo. On Android, this app data is excluded from Android system backup and device-to-device transfer.
On iOS, camera, selected photos, location, notifications and Apple Health are separate permissions. On Android, the app requests no location or camera permission: you choose a city manually, pick photos with the system photo picker or take a photo with your camera app; notifications and Health Connect are separate permissions. You can change permissions in system settings. Manual city selection remains available. On iOS, requested weather sends the selected place's coordinates to Apple WeatherKit, even when you choose the city manually. On Android, the app sends the selected place's coordinates to our API, which rounds them to about 1 km before requesting the forecast from Apple WeatherKit. Apple Weather is shown as the source. This does not send your journal to Apple WeatherKit.
With the relevant Apple Health permissions, the iOS app can read water intake, time in daylight, UV exposure and recorded vitamin D intake; it writes only water entries you confirm and can remove its corresponding entries. It identifies the source of displayed Health records. On Android, if you turn on Health Connect, the app only writes the water entries you log; it does not read Health Connect data, and entries already written are managed in Health Connect. Revoking permission does not erase records created by other apps. Health data and photos are not used for advertising.
Photo appearance estimates and labelled cosmetic simulations run on your device. They are uncertain, do not diagnose conditions and do not overwrite your manual profile. Original files may contain GPS or other metadata. Optimized, shared and AI-transfer copies remove unnecessary metadata while preserving the orientation and colour information needed to display them. Copies you save to Apple Photos or another photo library, or share elsewhere, are controlled separately.
When you share a card from the app (today's sun, golden hour, trip countdown, achievement or the season story), the card image is uploaded to our server only after you complete the share, so that the short link printed on it (bronzemaxx.com/c/…) can show that image to whoever receives it. The image can include the place name you chose for the card and your own counts; it carries no account, record, photo or note. The server stores the image, its kind, its language and view counters, never your IP address or an account identifier, and deletes it after 180 days. You can take a card down earlier in the app under Settings → Shared cards: the key that proves the card is yours stays on your phone (in the device's secure storage, not in backups) until the card expires or you remove it. Cards shared from an earlier app version cannot be listed there and expire on schedule. After a removal the link shows that the card is no longer available; copies people already saved are not affected. After a removal the server keeps only the card's short id and a one-way hash of its key for one hour, so that an upload still on its way cannot bring the card back; nothing else is kept. Opening a card link in a browser shows that one card and links to the app stores; no cookies are set.
In the iOS app, Apple and RevenueCat handle purchase history, transaction and app-user identifiers, products, entitlements and renewal information for purchase verification, access and restoration. RevenueCat also supplies purchase and subscription statistics for BronzeMaxx. In the Android app, Google Play handles payment through Google Play Billing; the purchase carries a pseudonymous account reference, and our server verifies the purchase token and subscription status directly with Google through the Google Play Developer API. RevenueCat is not used in the Android app. We do not receive your payment-card details or send your profile, Health records or journal photos to RevenueCat or Google Play. A pseudonymous purchase identifier is not a guarantee of anonymity, particularly if later linked to a verified account. Purchase processing and WeatherKit are separate from the optional cloud services.
Crash reports (Sentry, EU). When the app crashes or hits an internal error, a crash report is sent to Sentry, hosted in the European Union. It contains the device model, operating-system version, app version and build, free memory and storage, battery and orientation state, the language and time-zone settings, the time, a technical stack trace (our code and the system frameworks it called) and the app's last foreground/background steps as fixed state words. Before it leaves the device the report is cleaned: user, request and address fields are removed, error descriptions are reduced to a short technical summary, web addresses are kept only as the host name of our own services, and known patterns such as e-mail addresses, credentials, coordinates and long numbers are removed; the report carries no account, name, note, conversation, photo, place you saved, Health value or purchase detail. The Sentry software keeps a random installation identifier on the device so that app sessions can be counted for a crash-free rate; it is not linked to you or your account. On arrival Sentry derives an approximate location (country and city) from the connecting address and keeps that with the report; the address itself is not stored, and the app does not attach screenshots or screen contents. Crash reports are kept for 90 days and then deleted. Debug builds, test runs and the Watch and widget extensions never send crash reports. This processing rests on our legitimate interest in keeping the app reliable (Article 6(1)(f)); it cannot be switched off inside the app because it contains no personal content, but you may object by contacting us.
Optional usage events (PostHog, EU). If you turn on "Share anonymous usage events" on the welcome page or in Settings, the app sends a small set of usage events to our own server, which forwards them to PostHog, hosted in the European Union. The events are limited to a fixed list: an onboarding step viewed, onboarding started or completed, the paywall shown or closed, a plan selected, a checkout opened, a purchase started, completed, cancelled or failed (with the plan name and a coarse failure category, never the price or a transaction identifier), the first value reached, a share card opened or shared (card kind, look and destination category only) and the season story viewed. Each event carries a random installation identifier created only after you turn the choice on, the app version and build, the platform and your app language. It carries no account, name, email, answer, note, photo, place, coordinates, Health value, device identifier or advertising identifier. Your IP address reaches only our server, where it is used momentarily for rate limiting and to derive your approximate location at country and region level (for example "TR, Istanbul"); the country and region are attached to the event, while the address itself, your city and coordinates are neither stored nor forwarded. PostHog is configured to discard client IP data and not to build person profiles. We do not match the installation identifier with purchase or account records. Events are kept for at most 12 months. Turning the choice off deletes the identifier and any pending events on your device and stops sending; it does not recall events already received, which remain under their random identifier until they expire and cannot be linked back to you. The choice is off by default, and the app works the same either way.
Why we process information
- Requested functionality and purchases: we rely on performance of our contract with you, or steps you request before entering one, for information necessary to provide the requested routine, weather, purchase, restore and related support functions (GDPR Article 6(1)(b)). This does not authorise unrelated uses of optional data.
- Security and support: our legitimate interests are to deliver a reliable website, prevent abuse and fraud, resolve general enquiries and understand aggregate purchase and subscription statistics using proportionate, limited information (Article 6(1)(f)). We balance these purposes against your rights; you may object. We do not use this basis to justify advertising profiles or optional sensitive-data sharing.
- Optional processing: we rely on consent where required for optional photo, location, Health and cloud-context processing (Article 6(1)(a)); processing that reveals health information requires explicit consent under Article 9(2)(a). A system permission alone is not consent to unrelated processing or cloud sharing. You can refuse or withdraw optional choices without losing access to existing records, export, deletion, support or purchase restoration. Withdrawal does not invalidate processing that was lawful before it.
- Legal obligations and claims: we process only records needed to comply with an applicable legal duty (Article 6(1)(c)) or to establish, exercise or defend a legal claim where permitted. This does not justify keeping your full journal with financial records.
How long information is kept
Your local profile, routines, notes, sessions and conversations remain until you delete them. Subscription expiry or 12 months of inactivity does not automatically erase them. Normally deleted photos remain in Recently Deleted for 7 days; you can delete them permanently sooner. You can erase guest data without creating an account. We cannot erase copies you exported or saved in another service.
We delete closed support conversations and their attachments 30 days after closure. The procedure covers incoming and outgoing copies, saved attachments and permanent removal from Trash. Open requests remain while needed to resolve them; an accepted erasure request is not delayed merely to complete the ordinary support period. This is our mailbox-handling policy, not an automatic Gmail deletion schedule. Google's infrastructure and legally required copies follow its own retention processes.
Minimal purchase records are kept separately from journal content only while needed to maintain or restore a valid entitlement, reconcile a payment or refund, handle a dispute, or meet an applicable record-keeping duty. Relevant fields include transaction/product identifiers, app-user or account linkage, entitlement status and dates, refund/revocation status and the evidence needed for that purpose. We remove unnecessary linkage and records when those purposes and applicable claim or legal periods end. Apple, Google and RevenueCat retain their own transaction and service records under their applicable policies and obligations.
Technical information is retained according to its purpose: delivery and short-term troubleshooting, investigation of a specific security incident, or a binding legal requirement. Our operational target for content-free technical logs is no more than 30 days unless a specific incident or legal obligation requires a justified extension. Provider-managed logs and recovery copies follow the provider's service-specific retention cycles; this target is not a promise that every provider uses the same period. We do not use technical logs to archive journal or photo content.
Providers and international processing
Apple supplies the iOS platform, weather for both apps, iOS purchases and Sign in with Apple; RevenueCat supplies purchase verification and subscription statistics for the iOS app; Supabase supplies identity and backed-up records; Cloudflare hosts and protects the website and our API, stores backed-up photos and routes support email; Google supplies the Android platform, Google Play purchases and purchase verification, the cloud coach (Gemini API) and Google sign-in, and stores support correspondence in Gmail; Resend sends sign-in code emails; Sentry (EU data region) receives crash reports; PostHog (EU cloud) receives the optional usage events described above. Access is limited to what is needed for the relevant service. See Apple Privacy, RevenueCat Privacy, Supabase Privacy, Cloudflare Privacy, Google Privacy, Resend Privacy, Sentry Privacy and PostHog Privacy.
Providers can process information outside France and the European Economic Area. A European storage location does not make all support, logs and subprocessors European. Google's published safeguards include adequacy decisions, the EU–US Data Privacy Framework for covered recipients and standard contractual clauses where required. RevenueCat and Cloudflare describe standard contractual clauses and other applicable safeguards in their data-processing terms. You can contact us for information about the safeguards relevant to your data. Google transfer frameworks, RevenueCat processing terms, Cloudflare processing terms.
Optional cloud services
Backed-up records are stored by Supabase in Frankfurt, Germany. Backed-up photos are stored in a private Cloudflare R2 bucket restricted to the EU jurisdiction. Requests pass through our Cloudflare Workers API. The cloud coach is provided by Google through the paid Gemini API. These locations do not mean that all processing remains in the EU.
Backup requires a separate choice, showing which records and photos are selected. Creating or linking an account does not enable backup or AI sharing. In the iOS app, photo backup offers optimized high-quality or original files; the Android app backs up an optimized copy without location or device metadata. The allowance is 100,000,000 bytes during an eligible trial and 1,000,000,000 bytes with paid access. Previews and trash count; recovery copies do not count twice. Full storage stops new uploads rather than deleting existing records.
For each cloud-coach request, you choose the text and context sent: city name and time zone, weather, routine, product shelf and selected plan or trip. Separate profile/history choices can add skin response, sensitivity, medication context and up to three recent sessions. City coordinates are not included in that structured coach context; text you enter may still contain personal information. Photo requests use only the one or two photos selected and authorised for that request. Backup permission does not authorise AI photo processing. Suggested actions require your confirmation.
The coach allowances are 5 completed replies per eligible trial, 30 per paid weekly period and 120 per usage month for monthly and annual access. Unused allowances do not roll over; restoring, linking or changing a plan does not reset consumption. A completed reply delivered in the app uses one unit, including one or two selected photos; errors, cancellation and undelivered replies do not. Local guidance and on-device photo work use no cloud allowance.
Our temporary AI copies are removed after the response or error, and interrupted work within 24 hours. Google's paid Gemini terms exclude model/product improvement use of prompts and responses but allow limited security/abuse retention and international processing. No-training does not mean zero retention, and removing our copy does not instantly erase Google's copy. Gemini data terms, Gemini retention.
After trial or paid entitlement actually ends, cloud photos remain available for reading, downloading and deletion for 30 days; new uploads stop, and the app warns 7 days and 1 day before removal. Renewed access cancels scheduled expiry cleanup. Local copies remain. Sign-out, cloud-archive deletion, local deletion and full-account deletion are separate actions; cloud-archive deletion disables automatic backup. Full-account deletion offers export and subscription management, brief identity verification and final confirmation, without a mandatory support conversation, survey or waiting period. Failed or offline requests are not labelled complete. Accepted deletion stops writes and sync, removes active service data within 24 hours and recovery copies within 30 days, and deletion records prevent older devices restoring erased content. Our purchase linkage for a deleted account is removed with it. Deleting an account does not cancel an Apple or Google Play subscription, and restoring a purchase does not restore permanently deleted journal content.
Your rights and contact
Contact support@bronzemaxx.com to request access, correction, deletion, restriction or portability where applicable, withdraw consent, or object to processing based on legitimate interests. Step-by-step deletion instructions, including how to request deletion without the app, are on our support page. In-app viewing, export and deletion of existing records do not require another purchase. We do not make solely automated decisions that produce legal or similarly significant effects about you.
We respond without undue delay and normally within one month of receiving a rights request. For complex or numerous requests, the GDPR permits up to two additional months; we explain the extension within the first month. We request additional identity information only if reasonably necessary and normally handle requests free of charge, subject to the GDPR's limited exceptions. You may complain to the CNIL or another competent supervisory authority.
We update this policy when our services or processing change and show the effective date above. A material new use that requires your consent will have a separate choice before it begins.