Privacy Policy

1. Who we are

SoftMaxx is operated as an independent venture based in the United States. For any privacy-related question, deletion request, or general inquiry, contact us at privacy@softmaxx.io. Formal legal entity details will be added to this page as the business structure is finalized.

2. What we collect

From everyone who uses SoftMaxx

• Your email address — collected once at the pre-scan email gate. Stored in your browser's localStorage and on our marketing list.
• Your results email — when you give us your email so we can send you your results (including for a bonus scan), we keep a record of your address and the results summary that email showed, so we can send you a few reminder emails afterwards. We also store your browser's anonymous identifier with your address, so those reminder emails can mention the actions you logged on your Today card in the last 7 days (for example, how many of those days you logged one). We store it only when it has the form of the anonymous identifier our pages create in your browser — never your Stripe Customer ID. It is stored the first time we save this record and never changed by a later request: a later results email to the same address keeps the identifier stored first. The record, including the identifier, is kept until 90 days after the most recent results email we sent you, and is then deleted automatically. Unsubscribing stops these emails, so your Today-card log is no longer read for them; the record itself is deleted when its 90 days run out. The "Delete my data" button on your Account page deletes your Today-card log — the one kept under your anonymous identifier, which is the one the reminder emails read, and, on a paid account, the one kept under your Stripe Customer ID when that browser holds the proof of your purchase — so the emails can no longer mention it. To have the record itself deleted sooner, email privacy@softmaxx.io.
• Your daily move email — if you opt in to the daily move email on your Today card, we keep one record with your email address: whether the email is on, the hour you chose (6, 7, 8 or 9 am), your time zone, the hour in UTC we send at, your browser's anonymous identifier (and your Stripe Customer ID on a paid account), today's move as your Today card showed it, the day your count started ("Day 1") and when you opted in and last changed it. We also keep two short lookup entries — your identifier with your address, and your address in the list for your send hour — so the email goes at the right hour and "Delete my data" can find your record. The record and the lookup entries are kept for 400 days after your last change to them, and are then deleted automatically. The email stops when you use its "Stop the daily email" link or unsubscribe from all our emails. After you use its "Stop the daily email" link, turning it on again from your Today card restarts it only on a paid account, in the browser that holds the proof of your purchase; otherwise it stays off. Your choice is removed when you use the "Delete my data" button on your Account page in the browser where you opted in.
• Your trial emails — during a 7-day Pro trial we email you at most once a day, at 9 am your time when we know your time zone (the one recorded when you started the trial — see "Your time zone at checkout" below — else your daily-email choice or your Today-card log), otherwise at 17:00 UTC (the day-1 email goes at 10 am instead, on the calendar day after your trial starts, and is skipped on a day you have already opened the app): day 0, when the trial starts, "Day 0 of 7: here's the plan" or a subject that names today's move (what the trial unlocks, today's move, your trial end date and the price from that date); day 1 "Day 1: your side profile" or "Day 1 of 7" with today's move (adding your side profile, or comparing it once it is in your scan history); day 3, only when there is something true to say, "The how-to for" today's move (until you have asked the coach a question), "Log today's move" (until you log a day), or "Your week scan is ready" or "Your week scan is due" with its date, led by the overall score of your latest scan and the top priority from your results email. To choose which one and fill it in, we read your subscription record, your scan history (including the overall score each scan recorded), whether you asked the coach a question, your Today-card log and your results-email record. These trial tips stop when your trial converts or is cancelled, and each has its own unsubscribe link, "Stop the trial tips": it stops only the tips, and we keep a record of that choice with your email address. On day 5 or 6 of your trial we send one notice before it ends — your week in numbers, the amount and the date of the charge, and how to cancel — and, when your trial becomes a paid plan, one receipt email ("Month 1 on Pro: receipt and the plan") with the amount charged, the renewal date, how to cancel and your next steps. The notice and the receipt still arrive if you stopped only the tips; unsubscribing from all our emails stops them too. Each time one of these trial emails is sent (day 0, 1, 3 or 5, or the receipt), our server records one analytics event in PostHog, trial_email_sent: the trial day, which version of the email went (for example "d3_log" or "numbers_notice") and how many days into the trial it was. It is keyed to your Stripe Customer ID — or to your browser's anonymous analytics identifier when your checkout recorded one — and carries no email address and nothing from the email itself. Because it is sent from our server, not from your browser, a Global Privacy Control or Do Not Track signal from your browser does not stop it; email privacy@softmaxx.io to have these events deleted.
• One free trial per person — when you start a free trial we store three short records so the same person, card or device cannot take a second free trial: a fingerprint of your card that Stripe gives us (not the card number), your email address in a normalised form (lower-case, without a "+tag" and, for Gmail, without dots), and the anonymous ID of the browser the trial was started from, each with your Stripe customer ID. We keep them for 3 years. They are not removed by "Delete my data" and are not part of your data export, because removing them would allow a second free trial; you can ask us to remove them by email.
• Your email at checkout — when you start a trial or subscription we ask for your email before Stripe's checkout page. We pass it to Stripe with your checkout and, if you don't finish, send you one reminder about that checkout (with an unsubscribe link). It is also kept in your browser so you aren't asked again; it is not added to our results or reminder emails.
• A reminder of what your plan includes — if you are a paying member and we have seen no scan, no logged move, no coach message and no visit from you for 7 days, we may send you one email listing parts of your plan you have not used yet and your next rescan date. We send it at most once every 30 days, never during a trial, after you cancel, or while a payment is failing, and never within 3 days of another reminder from us. To decide whether to send it we read your subscription status, the dates of your last scan, logged move and coach message, and the time of your last visit. It stops with the "30-day rescan reminders" setting on your account page or the unsubscribe link in any of our emails.
• Your scans this month — if you pay monthly and, 18 to 22 days into your billing month, you have logged no days and run fewer than two scans in it, we may send you one email with the date your billing month started, the scans you have run since, the scans left in your plan this calendar month and a button to the scanner. We send it at most once per billing month, never during a trial, after you cancel, while a payment is failing, or within 3 days of another reminder from us. To decide whether to send it we read your subscription from Stripe (its status, the start of your billing month, and whether it is billed at full price), your scan history, your Today-card log and your monthly scan count. When it is sent our server records one analytics event in PostHog, member_nudge_sent, keyed to your Stripe Customer ID, with no email address and nothing from the email itself. It stops with the "30-day rescan reminders" setting on your account page or the unsubscribe link in any of our emails.
• The time of your last visit — when you open the app on a device that holds proof of your purchase, we save the time of that visit with your Stripe customer ID, so the reminder above is not sent to members who are using the app. We keep it for 60 days. During a trial we also keep, on the trial record, the anonymous device ID the trial was started from, so the button in a trial email can open your results on another device; it is deleted with the trial record.
• Cancelling, and the cancel link in our emails — the cancel link in our trial emails carries a cancel code, so that one link can cancel your subscription from any browser, without the proof of purchase the cancel page otherwise looks for in your browser. The code is encrypted, so nothing in it — not even your Stripe Customer ID — can be read from the link, and it cannot be altered. It opens only the cancel page and the plan status shown there (your plan, whether you are in a trial and when it ends), and it stops working 30 days after it was made. The cancel page removes it from the address bar as soon as it reads it and keeps it only while the page is open; a code from an email link is not saved in your browser and is not sent to our analytics. When you sign in with a sign-in link we email you, we also save a cancel code of the same kind in your browser's localStorage, so the cancel page works in that browser too; it expires after 30 days, and signing in again replaces it. When you cancel — from that link or from the cancel page on your account — we email you one confirmation at the address on your Stripe account: your plan, the day it ends, that nothing more is charged and that you keep everything until then (if you cancelled during a free trial, it says instead that the trial ended that day and you won't be charged). It confirms something you just did, so it is sent even if you unsubscribed from our emails, and it has no unsubscribe link. So it goes only once per subscription, we keep a send stamp with your Stripe subscription ID for 400 days.
• Your time zone at checkout — when you start a trial, our hosting provider (Vercel) tells us the time zone your connection appears to be in, worked out from your IP address (for example "America/New_York"). We send it to Stripe with your checkout, where it is kept in the checkout's metadata, and we store it on your trial records: the record of your running trial, which is deleted at the latest 30 days after your trial ends, and the record that you have used a trial, which has no expiry. We use it only to show dates and times in our emails on your own calendar day — your trial end date, the charge date, the day your plan ends — and to send the trial emails at 9 am your time. We keep no other location detail from it. To have it deleted, email privacy@softmaxx.io.
• Your monthly recap — on the 1st of each month, paying members (not during a trial) get "Your {month} in numbers": the days you logged, the scans you ran and the questions you asked the coach last month, and — when you scanned twice that month — how your overall score and each pillar changed from your first to your last scan of the month. It has an unsubscribe link.
• Send stamps — so no email repeats and you get at most one of these emails a day, we keep small send stamps with no content beyond the send time: one per trial email (kept for 40 days), one per monthly recap (kept for 60 days), one for the "your scans this month" email (kept for 40 days, with your Stripe Customer ID), and one per day an email went to you (kept for 48 hours). They are removed when you use the "Delete my data" button on your Account page in a browser that can prove the email is yours. Three records are not yet removed by that button: the stamp that your trial's receipt email went (kept with your Stripe Customer ID for 400 days, so it is never sent twice), the stamp that your cancellation confirmation went (kept with your Stripe subscription ID for 400 days, so it is never sent twice) and your choice to stop the trial tips (kept with your email address); to have them deleted, email privacy@softmaxx.io.
• Your selfie photo — uploaded to our service from your device, analyzed by OpenAI's vision API, then destroyed within seconds of analysis completion.
• Your face geometry — 478 anatomical landmark points extracted from your photo by our facial landmark detection engine running in your browser before the photo is sent to our servers. From these landmarks we compute numeric facial proportion ratios.
• Your scan results — the scores, measurements, and analysis text we generate. Returned to you and stored in your browser's localStorage so you can revisit them.
• Basic technical information — your IP address, browser type, and device type, automatically logged by our hosting provider for security and performance.

From paying subscribers

• Payment information — handled entirely by Stripe. We never see or store your full credit card number. Stripe returns us a token confirming your subscription tier and status.
• Your Stripe Customer ID — used to look up your active subscription status when you scan.
• Your reason for cancelling — when you cancel, the reason you tap (one of five fixed choices; you cannot type your own) picks the offer we show you next and is kept with your Stripe Customer ID for 180 days; a copy kept in your browser for 30 days lets the coach take it into account, and both are removed when you use the "Delete my data" button on your Account page in that browser.
• Journal photos (Elite tier only) — if you use the progress-photo journal, the photos you add are stored only in your own browser (on this device, via IndexedDB). They are never uploaded to our servers, are separate from scan-analysis photos, and only you, on this device, can see them. You can delete any photo — or all of them — at any time, and they are removed from the device immediately. The "Delete my data" button on your Account page also clears them.

Stored in your browser (not on our servers)

• localStorage keys we use: your email, your scan history, your subscription state. This data stays in your browser and is transmitted to our servers only as needed to deliver the service.
• Your scan photos — after a scan succeeds, a smaller copy of each photo you sent for analysis (front, and side if you added one) is saved in your browser on this device (localStorage and IndexedDB), so your results page can show your photos again when you come back. When the scan includes a front photo, a larger copy of it is saved the same way. These copies are not stored on our servers and have no expiry: your next successful scan replaces them and removes any photo that scan did not include, and they are removed when you use the "Delete my data" button on your Account page or clear your browser's site data.
• A photo held at your scan limit — if you reach your scan limit while scanning, the photo you were scanning may be kept on this device only for up to 24 hours, so you can scan it after upgrading without taking it again. It is not stored on our servers and is sent to us again only when you tap Scan now. See Section 5 for when it is deleted.

Peptide pages, calculators and the tracker

• Peptide education pages and calculators — the pages collect no health data, and the calculators do the math in your browser; we do not store what you type into them. On these pages analytics runs with no session recording and no click capture, and peptide names and amounts are removed from every analytics event before it is sent (see Section 3).
• The tracker, when the tracker launches — it is not live today. When it launches it will store the substances, amounts and times you log, injection sites, vial details, side effects and notes, and only after you give a separate opt-in consent (accepting our Terms does not count as that consent). Photos you add to it will stay on your device, and it will not collect your location. You will be able to export or delete your tracker data at any time. This is consumer health data; how we handle it, who processes it and your rights are set out in our Consumer Health Data Privacy Policy.

Referral links and bonus scans

• Your share link — once you have scanned, we create a personal share link for you: softmaxx.io/?r= followed by a random 8-character code. The code is tied to your browser's anonymous identifier, and to your Stripe Customer ID if you subscribe and the browser asking for your link holds the proof of your purchase. No name, email address, or photo is involved. If your browser sends Global Privacy Control or Do Not Track when your link is created, we save that setting with the code, and we send no analytics event about bonus scans your link earns. The code has no expiry.
• Your network prefix, hashed — to stop people referring themselves, each time one of our pages loads your share link we store a one-way hash of your network prefix: the first three parts of your IP address (for example, 203.0.113 from 203.0.113.45), never your full address. We keep up to your 8 most recent network hashes, for 180 days after your link was last loaded.
• When a friend scans through your link — the friend's browser stores your code and, if they scan within 30 days, sends it with their first scan. When that first scan passes our checks, we record that it was counted (kept with no expiry, so it can only ever be counted once) and a one-way hash of the friend's network prefix, made the same way (kept for 400 days). We also keep a count of the bonus scans your link has earned this month (expires after 35 days) and a count of new bonus scans you have not seen yet (expires after 90 days).
• Bonus scan for your email — if you choose to enter your email address on the scan-limit screen to get a bonus scan, we email you your results and add you to the same reminder emails you get when you ask us to email you your results. Every one of those emails has an unsubscribe link. Your address is stored the same way, and for the same length of time, as it is for that results email. To give the bonus only once per person, we also store a one-way hash of your normalized address (lower-cased, with any "+tag" removed, and with dots removed for Gmail addresses) and a device marker tied to your browser's anonymous identifier. Both are kept with no expiry. If you have unsubscribed from our emails, you still get the bonus scan but no email is sent.

These records exist to give bonus scans and to stop the same bonus being claimed twice, so the "Delete my data" button on your Account page does not remove them.

3. What we DO NOT collect or do

To be explicit:

• We do not retain your face photo on our servers after scan analysis completes. (If you use the Elite progress-photo journal, those photos are stored only in your own browser on this device and never reach our servers — see Section 5 for details.)
• We do not identify you by your face. SoftMaxx measures proportions; it does not perform facial recognition or match your face against any database.
• We do not train AI models on your photo. The photo is sent to OpenAI for a single analysis request, then destroyed.
• We do not sell, rent, trade, or share your face data, email, or scan results with third parties for advertising or marketing purposes.
• We do not use cookies for tracking. We use localStorage, which remains in your browser under your control.
• We do not use advertising or cross-site tracking of any kind, and we do not sell or share your data for advertising.

The analytics tools we do use. Our pages load two tools from our hosting provider, Vercel (the four calculator pages load only the first): Vercel Web Analytics, which gives us page-level visit counts in aggregate (which page, the referring site, approximate location and device type), and Vercel Speed Insights, which measures how fast pages load. Vercel states that neither ties its data to an individual visitor or IP address; Web Analytics tells visits apart with a hash of the request, discarded after 24 hours, instead of a cookie. We use PostHog, a first-party product-analytics tool, to understand how SoftMaxx is used — which pages people read, where they get stuck, and whether a change helped. It stores an anonymous identifier in your browser's localStorage (not a cookie) and records which pages and buttons you use, plus an approximate location derived from your IP address. On the app pages it may also record how you move through the interface ("session replay"), with all typed input masked and all images — including your photos — blocked from the recording. Session replay is never used on our blog or article pages. PostHog never receives your photo. What you type into a field is masked, but text shown on the screen on the app pages — for example your scores and readings, or a message to the coach once it appears in the conversation — can appear in a session recording. On our peptide pages and calculators there is no session recording and no click capture, and peptide names and amounts are removed from every event before it is sent.

How to turn it off. If your browser sends a Global Privacy Control or Do Not Track signal, we do not load PostHog at all — no identifier is created and no PostHog events are sent from your browser. Vercel's aggregate page counts and speed measurements, which hold no identifier and set no cookie, still load. One event comes from our server instead and is not stopped by that signal: trial_email_sent, recorded when we send you a trial email (see "Your trial emails" above). Most privacy-focused browsers and extensions can send this signal for you. You may also email privacy@softmaxx.io and we will confirm removal of any data tied to your identifier.

4. How we use what we collect

5. Biometric data disclosure (BIPA, CUBI, Washington 19.375)

If you live in Illinois, Texas, Washington, or another jurisdiction with a biometric privacy law, please read this section carefully.

Washington, Nevada and Connecticut residents: your face-scan data is also consumer health data. See our Consumer Health Data Privacy Policy (Washington RCW 19.373, Nevada NRS 603A, Connecticut CGS 42-515) for your rights to access, delete and withdraw consent.

6. Third parties we share with

We share data with these third-party services to deliver SoftMaxx. We do not share with anyone else for marketing or advertising purposes.

Consumer health data. Face-scan data, readings inferred from your scans, lifestyle answers, what you tell the coach and (when the tracker launches) tracker entries are consumer health data under Washington, Nevada and Connecticut law. Which of these processors receives which of them, and how to contact each one, is listed in our Consumer Health Data Privacy Policy.

7. Your rights

You have the right to:

• Access any data we have about you — email privacy@softmaxx.io
• Delete your data — email the same address. We will delete your email from our marketing list and confirm via reply. Since we do not retain biometric data, your email is the primary item to delete on our end.
• Opt out of marketing emails — every marketing email contains an unsubscribe link.
• Opt out of analytics — enable Global Privacy Control or Do Not Track in your browser and we will not load PostHog at all (Vercel's aggregate page counts, which hold no identifier, still run), or email privacy@softmaxx.io and we will remove data tied to your identifier.
• Object to processing — stop using SoftMaxx and email us to confirm deletion of your remaining data.
• Portability — your scan results are stored in your browser's localStorage and can be exported by you directly.
• Withdraw consent for biometric processing — stop submitting scans. Past scan data is already destroyed; no further capture occurs.

If you are a California resident under CCPA — you have the right to know what categories of personal information we have collected (see Section 2), the right to delete, and the right to opt out of any "sale" of personal information. We do not sell personal information.

If you are an EU or UK resident under GDPR — the above rights apply. You also have the right to lodge a complaint with your local data protection authority.

8. Children

SoftMaxx is for users 18 years and older. We do not knowingly collect personal data from anyone under 18.

If you are under 18, please do not use SoftMaxx and do not submit photos to our service. If we discover we have collected data from someone under 18, we will delete it immediately.

If you are a parent or guardian and believe your child has used SoftMaxx, please contact us at privacy@softmaxx.io and we will delete any associated data.

9. Security

We use standard security practices including:

• HTTPS encryption for all data in transit
• Transient processing — photos are processed and destroyed within seconds; no long-term photo storage on our servers
• Stripe for payment processing — Stripe is PCI-DSS Level 1 certified, and your full payment card information never touches our infrastructure
• Webhook signature verification for all Stripe events to prevent forgery
• Per-email rate limits to prevent abuse

No system is 100% secure. We cannot guarantee absolute security, but we make reasonable efforts to protect your data.

10. International users

SoftMaxx is operated from the United States. By using SoftMaxx from outside the US, you consent to the transfer of your data to the United States for processing. We comply with applicable cross-border data transfer requirements.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this document. For material changes that affect how we use your data, we will notify you via email if we have one on file. Continued use of SoftMaxx after a policy update constitutes acceptance of the updated policy.

11a. Refunds and Billing

For information about subscription pricing, auto-renewal, cancellation and refunds, please see Section 5 of our Terms of Service.

In summary: every plan starts with a free scan, and Pro with a 7-day free trial. For purchases made on or after 2026-09-18, paid periods are not refundable except where required by law; charges made in error are refunded. Purchases made before that date keep the 14-day guarantee they were sold under.

Payment processing is handled entirely by Stripe. We never store or see your full payment card details. Your Stripe Customer ID is retained to manage your active subscription status.

12. Contact

For privacy questions, deletion requests, or any other privacy-related inquiry:
privacy@softmaxx.io

For general product support:
support@softmaxx.io

For BIPA, CUBI, or Washington 19.375 inquiries (Illinois, Texas, Washington residents):
privacy@softmaxx.io — please include "BIPA inquiry" or your state's law in the subject line for fastest routing.