Privacy Policy

DBloat is operated from Norway. The data controller for the purposes of the General Data Protection Regulation as incorporated into Norwegian law through the Personal Data Act (personopplysningsloven), and, where applicable, the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR") is:

Benjamin Milne (sole trader trading as DBloat)
Stavanger, Norway
Norway
Contact: hello@thriftd.app

a) Information you give us directly

• Name (if you provide one during onboarding)
• Email address (via Sign in with Apple; may be a private relay address)
• Onboarding answers (area of concern, triggers, age band, gender, goal)
• Optional profile inputs you enter

b) Information collected automatically

• Face scan photographs, transmitted to our analysis service for scoring — see section 3 for details on how these are handled
• Face scan results (score, sub-scores, verdict, insights)
• Daily routine completion state
• Session information required to keep you signed in
• Basic error logs

c) Purchases

• Subscription status (managed via Apple and our subscription provider RevenueCat). We do NOT receive or store your payment card details. Apple handles payment.

Face scan photographs receive special care:

• The photograph is captured on your device.
• It is transmitted over an encrypted (HTTPS) connection to our analysis endpoint, which passes it to a third-party AI provider (Google, via the Gemini API) solely to compute a wellness score.
• The photograph is not retained by us after processing.
• The photograph is not used to train any AI model, to identify you, or for any purpose other than returning your score.
• Only the resulting numerical scores, verdict text, and insights are associated with your account and stored.

You may refuse the face scan feature and continue using other parts of the App.

We process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR) — to provide the App and its features to you.
• Consent (Article 6(1)(a) GDPR) — for optional features such as face scanning. You may withdraw consent at any time by stopping use of that feature.
• Legitimate interests (Article 6(1)(f) GDPR) — for security, fraud prevention, product improvement, and diagnostics.
• Legal obligation (Article 6(1)(c) GDPR) — where required by law.

Face scan photographs are treated as inferred wellness data. Where they could be considered special category data under Article 9 GDPR, we process them only with your explicit consent (Article 9(2)(a)).

We use the information above to:

• Provide, personalise, and improve the App
• Compute your face scan score and daily plan
• Manage your subscription and account
• Respond to support requests
• Prevent fraud and abuse
• Meet legal and regulatory obligations

We do not use your information for automated decision-making that produces legal or similarly significant effects on you.

We share limited data only with the service providers required to run the App. Each is bound by contract to protect your data to a standard equivalent to this policy, including non-retention of your face scan photograph after processing and prohibition on using it to train AI models or to identify you.

• Apple Inc. — Sign in with Apple, App Store, in-app purchases
• Supabase — authentication, account storage
• Vercel — hosting for our analysis proxy
• Google (Gemini API) — face scan photograph analysis (see section 3). Google processes photographs submitted through the Gemini generateContent API under terms providing equivalent protection to this policy: no training on your data, no retention after the response is generated, and no attempt to identify you.
• RevenueCat — subscription state management

We do not sell your personal information. We do not share your information with advertisers or data brokers.

Some of the service providers listed above process data in the United States or other countries outside the EEA. Where such transfers occur, we rely on Standard Contractual Clauses issued by the European Commission (as recognised under Norwegian law and the EEA Agreement), the UK International Data Transfer Addendum where applicable, or on an adequacy decision where one exists (for example, the EU–US Data Privacy Framework).

• Account data: kept for as long as your account exists. You may delete your account at any time from Settings → Delete account. Upon deletion, your data is removed from our active systems within 30 days, subject to any records we are legally required to keep.
• Face scan photographs: not retained by us after processing.
• Face scan scores and insights: kept for as long as your account exists.
• Backup copies: purged within 90 days of deletion.

Depending on where you live, you have the following rights over your personal data:

• Right of access — to know what we hold
• Right to rectification — to correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet — datatilsynet.no). If you are in the EU/EEA you may also complain to your local supervisory authority. In the UK: the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email hello@thriftd.app. We will respond within 30 days.

Californian residents have the additional rights set out in the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to request deletion. We do not sell personal information. To exercise your CCPA rights, email hello@thriftd.app.

DBloat is not intended for anyone under the age of 13. We do not knowingly collect personal information from anyone under 13. If we become aware that a person under 13 has provided us with personal information, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, email us at hello@thriftd.app.

If you are between 13 and 17, we ask that you use DBloat only with the awareness and consent of a parent or legal guardian. Some jurisdictions (including several EU/EEA member states) set the age of digital consent higher than 13, in which case a parent or guardian must provide consent for you to use the App up to that jurisdiction's threshold.

We use industry-standard technical and organisational measures to protect your information — HTTPS transport encryption, encrypted storage at rest via our service providers, principle of least privilege for administrative access, and prompt security patching. No security system is impenetrable and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be surfaced in the App before they take effect. The "Effective date" at the top of this policy always reflects the latest version.

Questions or requests: hello@thriftd.app
Postal: Benjamin Milne (sole trader trading as DBloat), Stavanger, Norway