DECKARD — Privacy Policy
Last updated: 5 October 2026
DECKARD analyses your face. That makes your photographs and the readings taken from them biometric data, a special category of personal data under the EU's General Data Protection Regulation (GDPR, Article 9). This policy says exactly what we collect, why, who else touches it, how long we keep it and how you control it.
1. Who we are
The controller of your data is Jaume Muntal, Masia Can Carerac s/n, 08140 Caldes de Montbui (Barcelona), Spain. Contact us about anything in this policy at support@usedeckard.com.
2. What we collect
Your account. Your email address, and if you sign in with Apple, the identifier Apple gives us and the first name you choose to share. We keep the date and exact wording of the two consents you give at sign-up.
Your photographs. The photographs you take or pick for a rating. For a True Scan, the frames the camera takes during the scan are uploaded as the scan's photographs. We record whether each came from the camera or your library, whether the face is yours or someone else's, and what your phone measured on it before it was sent: the angle of your head, and how bright and sharp your face is.
Your 3D scan. On an iPhone with a Face ID camera, a True Scan also records depth measurements of your face and a face mesh, together with your phone's model and iOS version.
What we work out from them. Your scores, tiers and potential; a description of your features; your strengths and the areas to improve; the sex and pose the analysis reads off the photograph; and, for a True Scan, measurements of your face in millimetres and degrees.
Your routine. The plan built for you, the intensity you chose, your sessions and the exercises you ticked off.
Chadbot. When you ask Chadbot a question, we record that a message was sent and when, to count your plan's allowance. The conversation itself is kept only on your phone. It is deleted after 30 days and when you sign out.
Purchases. When you buy a plan or a scan, Apple gives us the transaction: the product, its dates, whether it was refunded, and an identifier linking it to your account. Apple never gives us your card details.
What we do not collect. No analytics, no crash reporting, no advertising identifiers, no tracking across apps or websites, no location, no contacts. Reminders are scheduled on your phone; we do not send push notifications. The app has no advertising SDKs.
3. Why we use it, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Photographs, 3D scans and everything worked out from them | To rate your face, build your routine and show how it changes | Your explicit consent (Art. 9(2)(a)), given at sign-up and withdrawable at any time |
| Account | To give you an account and keep your data yours | Our contract with you (Art. 6(1)(b)) |
| Routine, sessions, Chadbot count | To provide the features you use | Our contract with you (Art. 6(1)(b)) |
| Purchases | To give you what you bought, and keep accounting records | Our contract with you; our legal obligations (Art. 6(1)(b), (c)) |
We never use your face data to train or improve any AI model, and it is not covered by your consent. We never sell your data, never share it with advertisers or data brokers, and never publish it. There are no public rankings in DECKARD.
4. Photographs of other people (Rate Anyone)
If you rate someone else's photograph, it is analysed exactly as yours would be, and the photograph is deleted from our servers once it has been rated, or once it has been refused (because it is not a face, or the face appears to be under 18). The rating stays in your account until you delete it. Only upload a photograph of an adult who has agreed to it. DECKARD refuses to rate a face that appears to be under 18.
5. Who else processes your data
We use a small number of service providers. Each processes data only on our instructions and only to provide DECKARD.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Everything in section 2 except the Chadbot conversation | Ireland (EU) |
| Anthropic | The AI model that reads your photographs, builds your routine and answers Chadbot | For a rating: the photographs, your stated gender and, for a True Scan, your face measurements. For a routine: your scores and findings, no photographs. For Chadbot: your question, the recent conversation and a summary of your latest reading and routine, no photographs | United States |
| Fly.io | Computes a True Scan's measurements from the depth data | The 3D scan only, through a link that expires in two minutes; nothing is stored | Frankfurt, Germany (EU) |
| Apple | Sign in with Apple, and purchases | Your purchase and sign-in; Apple handles payment, under its own privacy policy (www.apple.com/legal/privacy) | Apple's own |
| Resend | Sends your sign-in codes | Your email address | Ireland (EU) |
Anthropic does not use the data we send it to train its models. It deletes what we send, and what it returns, within 30 days, unless its automated safety systems flag a request as breaking its usage policy, in which case it may keep it for up to two years. Transfers to the United States are protected by the European Commission's Standard Contractual Clauses, which are part of Anthropic's data processing terms with us.
6. How long we keep it
- Your photographs and 3D scans are kept until you delete them. Seeing your face change over time is what DECKARD is for, and your first photograph is the proof. You can delete them at any time (section 7).
- Your ratings are kept until you delete them or your account.
- Photographs of other people are deleted once rated or refused (section 4).
- Chadbot conversations stay on your phone for 30 days.
- When you delete your account, everything in section 2 is deleted. Server logs, which may include your account identifier but no photographs, are kept for up to 7 days, and database backups, which never contain photographs or 3D scans, roll over within 7 days. Apple keeps its own record of your purchases under its own policy.
A deleted photograph can remain reachable through a link you already opened for up to about a minute while caches clear. Nobody else can open it.
7. Your rights and how to use them
You have the right to access, correct, delete and take a copy of your data, to object to or restrict how we use it, and to withdraw your consent at any time. Withdrawing consent does not affect what was done before.
Most of this is in the app, with no need to ask us:
- Download your data — Account → Download my data. You get your profile, your scans and their ratings, your routine and sessions, your purchases, and a list of your photographs.
- Delete your photographs — Account → Photographs. Your ratings are kept.
- Delete a rating — from your history.
- Delete your account — Account → Delete account. Everything goes, and it cannot be undone. Deleting the app does not delete your account, and does not cancel a subscription (cancel it with Apple).
For anything else, write to support@usedeckard.com. We answer within one month. If you think we have mishandled your data you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or the authority where you live.
8. Age
DECKARD is for adults. You must be 18 or over to create an account, and the app refuses to rate a face that appears to be under 18. If you believe a child's data has reached us, write to support@usedeckard.com and we will delete it.
9. Security
Your photographs and scans are stored in private storage that only your account can read, reached through links that expire. Access is controlled on the server, row by row, for every table. Your sign-in is kept in your phone's Keychain. No system is perfectly secure, and if a breach affects you we will tell you and the authorities as the law requires.
10. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect, and ask for your consent again where the law requires it.
11. Contact
Jaume Muntal, Masia Can Carerac s/n, 08140 Caldes de Montbui (Barcelona), Spain, support@usedeckard.com.