Privacy Policy

The short version

We, the people who make ProgPics, never receive your photographs or anything you record in the app. There is no account, no server, no analytics, and no third-party code, so nothing is sent to us or to anyone else as you use it. Everything the app makes — your photographs, the outlines it draws from them, the numbers it measures — is stored on your phone.

It leaves the phone only in ways you set up or start yourself: your own device backup, the folder backup if you switch it on, a file you export or share, and, if you allow it, weights saved to Apple Health. Each is described below. If you email us, we receive what you send; see Emailing us.

What the app stores, and where

• Photographs you take with the app, and any you import into it. They are kept in the app's own private storage on your phone, behind your device passcode. If you set a passphrase and mark a routine as private, that routine's photographs and the body outlines used to line them up are additionally encrypted. The app makes a random key for this and stores it wrapped by your passphrase (and, if you turn it on, in the device keychain behind Face ID or Touch ID). Without the passphrase the photographs cannot be opened — not from a backup, and not by us — and a lost passphrase cannot be recovered. Archiving a routine takes it off the main screen and changes nothing about how its photographs are stored: a private routine stays encrypted while it is archived.
• Outlines, dates, notes, weights and measurements derived from or written about those photographs. The outline traced for each pose's target, the dates and names of your routines and poses, the match scores, any notes, diet or weights you enter, and the body measurements are stored in the app's index, which is protected by your device passcode but is not encrypted with your passphrase; that is what lets the app show which pose is which while it is locked. The index contains no photograph. Weights are either typed in by you or, if you allow it, read from Apple Health.
• Poses traced from a photo. If you set up a pose from a photo you choose, the app finds the person in it and keeps only the line around them, in the index above. The photo itself is not copied or stored.
• Your settings, including your height if you enter it.

Nothing above leaves the phone except in the ways described below: backups, sharing and exporting, and Apple Health.

Backups

Your photographs are included in your iCloud or computer backup like any other app data, which is also how they move to a new phone. Photographs in a private routine are encrypted inside the backup as well; the index described above is not. Apple's backup service is governed by Apple's privacy policy.

The folder backup

Under Settings there is a second, optional backup, switched off until you turn it on. You choose a folder — one in iCloud Drive, another sync service, or on the phone itself — and the app keeps a copy of your library there, copying only what changed since the last time. We run no server and see none of it: the app writes files into a folder you picked, and whatever syncs that folder is a service you already have and whose terms apply to it.

What goes into that folder is what is on your phone, byte for byte. Photographs in a private routine stay encrypted there, and are as unreadable without your passphrase as they are anywhere else. The index is not encrypted, so routine and pose names, dates, notes, weights and anything else you logged can be read by whoever can open the folder, as can the outline traced for each pose's target. It is a mirror, so a photograph you delete on the phone is deleted from the folder at the next backup.

Only one phone writes a given backup. The folder records which phone that is; another phone pointed at it is told so, and can either restore from it or take it over, at which point the first phone stops writing.

Sharing and exporting

When you share a timelapse or a side-by-side picture, or export your photographs, the app writes the file into its own protected temporary storage, hands it to the app you choose (Messages, Files, Photos, and so on), and removes its copy when you leave that screen. From that point it is governed by the app you chose. ProgPics does not keep a record of what you shared or where. An export is for reading elsewhere, so nothing in it is encrypted with your passphrase — including routines that were private on the phone. Alongside the photographs it writes a ProgPics.json holding the rest of what the app knows about them: your routines and poses, which shots belonged to which session, your notes, diet entries, weights and reminders. Treat the exported folder as you would the photographs themselves. If you switch on Blur Faces, faces the app can find are blurred in the file it makes, in a way that cannot be undone, and you can place blur circles of your own over anything else. A face it misses is not blurred, and the rest of the picture is still a photograph of you, so look before you share.

Buying the app

ProgPics is free to download, with one optional purchase that unlocks the rest of it for good. The purchase is made through Apple's App Store and belongs to your Apple Account, not to your phone: Apple keeps the receipt, and the app asks Apple whether you have bought it. ProgPics never sees your name, your email address or your payment details, and keeps no record of the purchase beyond Apple's own answer. On a new phone, Restore Purchases asks Apple again. A promo or offer code is redeemed through the App Store too, and works the same way as a purchase.

Permissions

• Camera — to take the photographs. Required.
• Photos — only if you choose to set up a pose from a photo, or to import photographs. The system picker shows you your library; the app only ever receives the pictures you pick. Saving a picture or timelapse to your library from the share sheet asks separately, for permission to add to it, not to read it.
• Face ID / Touch ID — to lock the app: Require Face ID to Open, on unless you switch it off, asks for Face ID, Touch ID or the phone's passcode when ProgPics opens. The phone does the checking; the app is only told yes or no. And optionally, to open private routines without typing the passphrase: the key that opens them is stored in the device keychain, protected by the biometric, and never leaves the device.
• Motion — the phone's tilt, read while the camera is open, so a later photograph can be lined up with an earlier one. Stored with each photograph; never transmitted.
• Apple Health — optional, and yours to set to one of three positions in Settings. Off means ProgPics never opens Health. Read weights means your weight and height are read, so a number can be shown with a photograph without typing it twice, and your sex if Health has it, so the default outlines are the ones drawn for you; the readings are copied into the app's own storage on this phone and nothing goes back. Read and write means that, and additionally that weights you type in ProgPics are saved to Health — where other apps you have permitted can read them, and where iCloud may sync them if you have Health sync switched on. Removing a weight in ProgPics also removes the one it wrote to Health. ProgPics asks for access only when you choose a position that needs it, asks for no other data type, and uses what it reads for nothing else.
• Notifications — optionally, for a weekly reminder you set on a routine. Asked for when you set one. The reminder is scheduled on your phone and carries only the routine's name; nothing is sent anywhere.

Deleting your data

Deleting a photograph, a pose, or a routine removes its files from the phone. Settings → Delete Everything removes every routine, session and photograph at once; your settings, your passphrase, and the weights and measurements you logged stay until you delete them or the app.

Deleting the app removes everything it stored on the phone. It does not reach what has already left it:

• The folder backup is a mirror while the app runs: what you delete in the app is deleted from the folder at the next backup. Once the app is deleted, nothing updates the folder, so what is in it stays until you delete it.
• iCloud and computer backups made before you deleted something still hold it, until newer backups replace them or you delete them.
• Files you exported or shared stay wherever you put them.
• Weights saved to Apple Health stay in Health. Removing a weight in ProgPics removes the one it wrote; deleting the app does not. Delete them in the Health app.
• The phone's keychain is the one place iOS keeps after an app is deleted. If you let Face ID open private routines, their key stays there, readable only by ProgPics reinstalled on this phone, and it opens nothing without the photographs.

Emailing us

Writing to the support address is separate from using the app. If you do, we receive what you send: your email address, your message, and any screenshots or files you attach. We use it only to deal with your message, share it with no one, and delete it if you ask. The app never sends email by itself: the row in Settings opens your own mail app with a new message, and nothing is sent until you send it.

Children

ProgPics is not directed at children under 13 and does not knowingly collect information from anyone.

Changes

If this policy changes, the date at the top changes with it, and the new text is published at the same address.

Contact

Questions about this policy: [email protected].