Privacy Policy (App)

Deutsche Fassung

This policy covers the PROOF app. For this website, the website privacy policy applies — it stores an email address if you file a deletion request, and nothing else.

Controller

Jeremy Meya, Walczer Straße 21, 59368 Werne, Germany.
support@proofstreak.app — full details in the legal notice (German).

The short version

Proof photos and videos are retrievable only by your own Crew. There is no global feed and no strangers.
The database and the photo storage are in the EU (Frankfurt am Main).
No analytics tool, no ad network, no advertising ID, no location, no health data.
Nothing from your address book is stored — not even temporarily. Only hash values leave the device, and they are discarded immediately after the match.
You can delete your account in the app, or here without it (German).

What is processed

The legal basis is predominantly Art. 6(1)(b) GDPR — processing is necessary to perform the contract of use. Where consent applies (lit. a) you can withdraw it at any time with effect for the future; where a legitimate interest applies (lit. f), it is stated.

Account and profile: Email address from sign-in (Apple, Google or email), username, user ID, time zone, profile picture, chosen accent colour, Coins and purchased frames. Purpose: sign-in, account management and display inside your Crew. Basis: lit. b. Retention: until the account is deleted.
If you sign in with Apple using “Hide My Email”, we only ever receive Apple’s relay address, never your own.
Proofs: photos and videos: The photo or video (up to 5 seconds, with sound) you capture in the app, together with the time, the Crew and the Challenge. Text you place on a photo before submitting is burned into the image and is part of it. Purpose: the core of the app — the proof your Crew sees. Basis: lit. b. Retention: as long as your account and the Crew exist; after a deletion the files are removed from storage within 30 days.
Capture happens exclusively live in the app. There is no gallery upload for proofs, in any version — the gallery is only opened for profile and Crew pictures, and even there only when you reach for it.
Proofs are retrievable only by members of the same Crew, through short-lived signed URLs. The storage itself is not public.
Faces in photos (no face data): A proof photo, a profile picture or a video will usually show a face — that is the point of a proof. It is processed solely as an image. PROOF collects no face data in the narrow sense: no facial geometry, no faceprints, no biometric templates, no face recognition, no matching of faces to people, no comparison between photos, no age estimation, no emotion analysis. The app uses no face recognition or face tracking interfaces of the operating system (no ARKit, no Vision, no Face ID).
Disclosure: photos leave EU storage in exactly one case — with the AI check switched on (see below) the photo is transmitted to Anthropic in order to judge whether it shows what the Challenge asks for (a book, a gym, say). No face is identified, compared or stored in the process; the result is a yes/no and one sentence of reasoning. Otherwise there is no disclosure to third parties, no sale and no use for advertising or model training.
Location and retention: photos are held at Supabase in Frankfurt (EU), are not public and are retrievable only by members of the same Crew through short-lived signed URLs. They are stored for as long as your account and the Crew exist, and removed from storage within 30 days after a deletion. Because no face data is derived, there is nothing derived that could outlast them either.
Comments and voice messages: Short comments (max. 280 characters) or voice recordings (up to 2 minutes) on proofs inside your own Crew, plus reactions, hearts and votes for the Proof of the Week. Purpose: app features. Basis: lit. b. Retention: until you delete them or until the account goes. Optional — the app works without them.
Crews, Challenges and Streaks: Crew name and picture, Challenge titles and goals, memberships, check-in times, Streaks, Freezes used and revivals. Purpose: the mechanic. Basis: lit. b. Retention: as long as the Crew exists.
The Streak of a Challenge belongs to the group. If you delete your account, your proofs disappear and the Crew’s Streak carries on with no reference to you.
Notifications (push): Your device’s push address and a log of which notification you have already received — the latter prevents duplicate pushes. Purpose: reminders before the deadline, the broken Streak, Freeze offers, the Proof of the Week. Basis: lit. b. Retention: until the device signs out or the account is deleted.
Notices about PROOF Plus are separate: they only arrive if you switch them on explicitly in your profile (Basis: lit. a), they are off by default and can be switched off again there at any time.
Purchases: Which product was bought, when, and whether a subscription is running — managed through RevenueCat. Purpose: unlocking and restoring PROOF Plus, Pro Crew and revivals. Basis: lit. b, and lit. c for the retention. Retention: related records for ten years where commercial and tax law require it (§ 147 AO, § 257 HGB).
We never see your payment details. Payment runs through Apple or Google respectively; they are independently responsible for it.
Finding friends through the address book: Optional, and only if you start it. The app reads the address book on the device and forms a SHA-256 hash of each address. Only those hashes go to the server, are there combined with a secret pepper, compared against the existing users — and discarded immediately. Addresses and numbers from your address book are never stored, not even temporarily. The only thing stored is how often someone has run a match; that limits systematic enumeration of the user base. Purpose: finding friends in the app. Basis: lit. a. Retention: none — nothing is kept.
So that others can find you, a hash of your own, confirmed address from sign-in is stored. It cannot be reversed into an address and disappears with your account.
AI check of proofs: Only in Pro Crews, and only if the Crew switches it on for a Challenge. The captured photo is then transmitted to Anthropic before submission in order to judge whether it shows what the Challenge asks for. The result and a short reason are stored. For a video, the still frame is checked. Purpose: app features. Basis: lit. b. Retention: rejected photos are deleted after 24 hours.
The images are not used there to train models, and no face recognition takes place — what is checked is the content (the book, the gym), not the person. If the check is not switched on for your Challenge, no photo leaves EU storage.
Reports and moderation: If you report a proof or a comment: the reason, an optional note and a snapshot of the reported content. Without the snapshot a report would be worthless the moment the reported person deletes. Purpose: examining and stopping abuse, as the store guidelines require. Basis: lit. c and lit. f (protecting the other users). Retention: until the decision, at most 30 days after it.
The reported person never learns who reported them.
Errors and crashes: Crash reports and technical diagnostics (device model, OS version, app version, time, location in the code) through Sentry. Purpose: finding and fixing faults. Basis: lit. f — the legitimate interest in an app that does not crash. Retention: at most 90 days.
Server logs: Time, requested address and IP address when our servers are accessed. Purpose: operation and defence against abuse. Basis: lit. f. Retention: at most 30 days.

What does not happen

No location. The app does not ask for it and does not need it.
No health or fitness data. A Challenge may be called “Gym” — what is collected is still only a photo.
No face recognition, no biometric data. A face in a photo stays a photo — it is not measured, compared or matched.
No analytics tools, no Google Analytics, no pixel, no advertising ID.
No sale of data, no sharing with advertising partners, no profiling.
No global feed. What you submit is seen only by the members of your Crew.
No phone number. It is not even collected when finding friends.

Who else processes the data

Everyone named works for us on our instructions (processors under Art. 28 GDPR). They pass nothing on to third parties and may not use the data for their own purposes.

Supabase: Database, sign-in and photo storage. The data is held in the EU, Frankfurt am Main region.
Expo (push): Delivery of notifications to your device, together with Apple (APNs) and Google (FCM). What is transmitted is the push address and the text of the notification. USA, on the basis of the EU standard contractual clauses.
RevenueCat: Management of purchases and subscriptions. USA, EU standard contractual clauses.
Sentry: Crash and error reports. USA, EU standard contractual clauses.
Anthropic: Only with the AI check switched on, and only the photo being checked. USA, EU standard contractual clauses.
Apple and Google: Handling payments and distributing the app. For that they are independently responsible, not processors — their own privacy policies apply.

How long, at a glance

Account, profile, contributions: Until you delete the account.
Proof files after a deletion: Removed from storage within 30 days.
Photos rejected by the AI: 24 hours.
Reports: Until the decision, at most 30 days after it.
Purchase records: Ten years, where required by law.
Crash reports: At most 90 days.
Server logs: At most 30 days.
Hashes from your address book: Not stored.

Deleting your account and data

In the app: Profile → Account → Delete account. Without the app through proofstreak.app/konto-loeschen (German). That page also sets out in detail what is deleted and what remains.

You can take back an individual proof yourself within two minutes of submitting it; after that it is immutable — that is the core of the app. Your own comments can be deleted at any time.

Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on a legitimate interest (Art. 21). Consent you have given — address book matching, Plus notices — can be withdrawn at any time with effect for the future, without the processing carried out until then becoming unlawful.

Write to support@proofstreak.app for that. You also have the right to lodge a complaint with a supervisory authority — the one responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Age

PROOF is rated 13+. Anyone in the EU under the age of 16 may only use the app with the consent of their legal guardians (Art. 8 GDPR). If we learn that an account was created without that consent, we delete it. Please send any information about that to support@proofstreak.app.

Changes

If what the app processes changes, this page changes with it. We will point out material changes in the app. Last updated: 14 September 2026.

The short version

Proof photos and videos are retrievable only by your own Crew. There is no global feed and no strangers.

The database and the photo storage are in the EU (Frankfurt am Main).

No analytics tool, no ad network, no advertising ID, no location, no health data.

Nothing from your address book is stored — not even temporarily. Only hash values leave the device, and they are discarded immediately after the match.

You can delete your account in the app, or here without it (German).

What is processed

Account and profile

Email address from sign-in (Apple, Google or email), username, user ID, time zone, profile picture, chosen accent colour, Coins and purchased frames. Purpose: sign-in, account management and display inside your Crew. Basis: lit. b. Retention: until the account is deleted.
If you sign in with Apple using “Hide My Email”, we only ever receive Apple’s relay address, never your own.

Proofs: photos and videos

The photo or video (up to 5 seconds, with sound) you capture in the app, together with the time, the Crew and the Challenge. Text you place on a photo before submitting is burned into the image and is part of it. Purpose: the core of the app — the proof your Crew sees. Basis: lit. b. Retention: as long as your account and the Crew exist; after a deletion the files are removed from storage within 30 days.
Capture happens exclusively live in the app. There is no gallery upload for proofs, in any version — the gallery is only opened for profile and Crew pictures, and even there only when you reach for it.
Proofs are retrievable only by members of the same Crew, through short-lived signed URLs. The storage itself is not public.

Faces in photos (no face data)

A proof photo, a profile picture or a video will usually show a face — that is the point of a proof. It is processed solely as an image. PROOF collects no face data in the narrow sense: no facial geometry, no faceprints, no biometric templates, no face recognition, no matching of faces to people, no comparison between photos, no age estimation, no emotion analysis. The app uses no face recognition or face tracking interfaces of the operating system (no ARKit, no Vision, no Face ID).
Disclosure: photos leave EU storage in exactly one case — with the AI check switched on (see below) the photo is transmitted to Anthropic in order to judge whether it shows what the Challenge asks for (a book, a gym, say). No face is identified, compared or stored in the process; the result is a yes/no and one sentence of reasoning. Otherwise there is no disclosure to third parties, no sale and no use for advertising or model training.
Location and retention: photos are held at Supabase in Frankfurt (EU), are not public and are retrievable only by members of the same Crew through short-lived signed URLs. They are stored for as long as your account and the Crew exist, and removed from storage within 30 days after a deletion. Because no face data is derived, there is nothing derived that could outlast them either.

Comments and voice messages

Short comments (max. 280 characters) or voice recordings (up to 2 minutes) on proofs inside your own Crew, plus reactions, hearts and votes for the Proof of the Week. Purpose: app features. Basis: lit. b. Retention: until you delete them or until the account goes. Optional — the app works without them.

Crews, Challenges and Streaks

Crew name and picture, Challenge titles and goals, memberships, check-in times, Streaks, Freezes used and revivals. Purpose: the mechanic. Basis: lit. b. Retention: as long as the Crew exists.
The Streak of a Challenge belongs to the group. If you delete your account, your proofs disappear and the Crew’s Streak carries on with no reference to you.

Notifications (push)

Your device’s push address and a log of which notification you have already received — the latter prevents duplicate pushes. Purpose: reminders before the deadline, the broken Streak, Freeze offers, the Proof of the Week. Basis: lit. b. Retention: until the device signs out or the account is deleted.
Notices about PROOF Plus are separate: they only arrive if you switch them on explicitly in your profile (Basis: lit. a), they are off by default and can be switched off again there at any time.

Purchases

Which product was bought, when, and whether a subscription is running — managed through RevenueCat. Purpose: unlocking and restoring PROOF Plus, Pro Crew and revivals. Basis: lit. b, and lit. c for the retention. Retention: related records for ten years where commercial and tax law require it (§ 147 AO, § 257 HGB).
We never see your payment details. Payment runs through Apple or Google respectively; they are independently responsible for it.

Finding friends through the address book

Optional, and only if you start it. The app reads the address book on the device and forms a SHA-256 hash of each address. Only those hashes go to the server, are there combined with a secret pepper, compared against the existing users — and discarded immediately. Addresses and numbers from your address book are never stored, not even temporarily. The only thing stored is how often someone has run a match; that limits systematic enumeration of the user base. Purpose: finding friends in the app. Basis: lit. a. Retention: none — nothing is kept.
So that others can find you, a hash of your own, confirmed address from sign-in is stored. It cannot be reversed into an address and disappears with your account.

AI check of proofs

Only in Pro Crews, and only if the Crew switches it on for a Challenge. The captured photo is then transmitted to Anthropic before submission in order to judge whether it shows what the Challenge asks for. The result and a short reason are stored. For a video, the still frame is checked. Purpose: app features. Basis: lit. b. Retention: rejected photos are deleted after 24 hours.
The images are not used there to train models, and no face recognition takes place — what is checked is the content (the book, the gym), not the person. If the check is not switched on for your Challenge, no photo leaves EU storage.

Reports and moderation

If you report a proof or a comment: the reason, an optional note and a snapshot of the reported content. Without the snapshot a report would be worthless the moment the reported person deletes. Purpose: examining and stopping abuse, as the store guidelines require. Basis: lit. c and lit. f (protecting the other users). Retention: until the decision, at most 30 days after it.
The reported person never learns who reported them.

Errors and crashes

Crash reports and technical diagnostics (device model, OS version, app version, time, location in the code) through Sentry. Purpose: finding and fixing faults. Basis: lit. f — the legitimate interest in an app that does not crash. Retention: at most 90 days.

Server logs

Time, requested address and IP address when our servers are accessed. Purpose: operation and defence against abuse. Basis: lit. f. Retention: at most 30 days.

What does not happen

No location. The app does not ask for it and does not need it.

No health or fitness data. A Challenge may be called “Gym” — what is collected is still only a photo.

No face recognition, no biometric data. A face in a photo stays a photo — it is not measured, compared or matched.

No analytics tools, no Google Analytics, no pixel, no advertising ID.

No sale of data, no sharing with advertising partners, no profiling.

No global feed. What you submit is seen only by the members of your Crew.

No phone number. It is not even collected when finding friends.

Who else processes the data

Everyone named works for us on our instructions (processors under Art. 28 GDPR). They pass nothing on to third parties and may not use the data for their own purposes.

Supabase

Database, sign-in and photo storage. The data is held in the EU, Frankfurt am Main region.

Expo (push)

Delivery of notifications to your device, together with Apple (APNs) and Google (FCM). What is transmitted is the push address and the text of the notification. USA, on the basis of the EU standard contractual clauses.

RevenueCat

Management of purchases and subscriptions. USA, EU standard contractual clauses.

Sentry

Crash and error reports. USA, EU standard contractual clauses.

Anthropic

Only with the AI check switched on, and only the photo being checked. USA, EU standard contractual clauses.

Apple and Google

Handling payments and distributing the app. For that they are independently responsible, not processors — their own privacy policies apply.

How long, at a glance

Account, profile, contributions

Until you delete the account.

Proof files after a deletion

Removed from storage within 30 days.

Photos rejected by the AI

24 hours.

Reports

Until the decision, at most 30 days after it.

Purchase records

Ten years, where required by law.

Crash reports

At most 90 days.

Server logs

At most 30 days.

Hashes from your address book

Not stored.

Deleting your account and data

In the app: Profile → Account → Delete account. Without the app through proofstreak.app/konto-loeschen (German). That page also sets out in detail what is deleted and what remains.

You can take back an individual proof yourself within two minutes of submitting it; after that it is immutable — that is the core of the app. Your own comments can be deleted at any time.

Your rights