Privacy Policy

Progress Pics is operated by GlobalHashtag (글로벌해시태그), a sole proprietorship operated by Jaeseon Lee in the Republic of Korea. The operator is responsible for the information processed on its behalf under this policy.

This policy covers the app and product support correspondence. Visits to our public product pages are covered by the GlobalHashtag website Privacy Policy. Stores, advertising services, and user-controlled platform accounts also have their own privacy notices for processing they perform independently.

Website Privacy Policy

Depending on the features you use, Progress Pics may process the following categories of information:

• Progress photos, thumbnails, capture timestamps, and orientation or check-in metadata stored on your device.
• Weight entries, dates, units, and related history you choose to record.
• Settings and preferences such as app lock, photo lock, reminders, and display choices.
• Purchase and entitlement information needed to support one-time Pro unlock purchases and purchase restoration.
• Advertising and diagnostics information that may be processed by third-party SDKs, such as device or other identifiers, crash diagnostics, and app interaction information.
• Support request information that you send to us, such as your email address and the contents of your message.

Progress Pics is designed to keep core check-in content on your device. We do not currently operate a standalone hosted account system for photo history or body progress logs.

This means your core photos, comparisons, and weight history are intended to remain primarily in app storage on your device unless you export content or use platform-level sharing features.

On iOS, the encryption key may sync through iCloud Keychain when platform settings allow it. This key synchronization supports reinstall recovery and does not upload your photos or progress history through that feature.

• To save, organize, and display your check-ins, photo comparisons, and weight history.
• To apply privacy and security settings such as app lock and protected photo access.
• To create optional export output such as timelapse or comparison videos when those features are available.
• To verify purchases, restore entitlements, and operate paid export features.
• To display, measure, secure, and troubleshoot limited ads in the free version of the app.
• To detect bugs, investigate crashes, improve reliability, and respond to support requests.
• To comply with legal obligations, enforce our terms, and protect users, the app, and our business.

Progress Pics may request or rely on the following permissions or system capabilities when relevant to the features you enable:

• Camera to capture progress photos.
• Photos or media access where needed to import, export, save, or share generated media.
• Biometric or device authentication where supported for app lock or protected photo access.
• Notifications if reminders or related app notices are enabled.

Progress Pics may use third-party providers to support app operations, including the following categories:

• Apple and Google platform services for app distribution, billing, notifications, and device features.
• RevenueCat for purchase entitlement state management and purchase restoration support.
• Google Mobile Ads and related Google advertising services for limited free-tier banner delivery and compliance operations.
• Firebase Crashlytics and Firebase Performance Monitoring for error reporting and performance diagnostics.
• Sentry for error diagnostics and sampled performance measurements. App content, photos, PIN values, and backup contents are excluded from these reports. Session replay and screenshots are disabled.
• Google-hosted email for the messages and attachments you send to product support.

These providers may process categories such as purchase records, app diagnostics, device or service identifiers, IP address, limited ad-delivery data, and support correspondence needed to provide their services. RevenueCat, Firebase diagnostics, and Sentry process app service information on our behalf. Stores and advertising providers also perform their own billing, security, advertising, and legal processing under their notices.

In version 1.0.5 and later, optional Firebase and Sentry diagnostic sharing is off by default. You can choose whether to share it and change your choice under Settings → Privacy → Share diagnostics. Turning it off stops future optional diagnostics collection; it does not remove reports already received by a provider. Diagnostics may include technical information such as app version, device model, OS version, code stack locations, operation duration, and diagnostic identifiers. Providers also receive network information when reports are transmitted. Core app content stays on the device unless you explicitly export or share it through a supported feature.

The free version of Progress Pics may display limited banner ads on selected in-app surfaces. Ad-related processing may involve device or advertising identifiers, IP address, approximate region information, and information about ad delivery or interaction according to the policies of the ad provider.

In version 1.0.5 and later, the app uses Google's consent flow before requesting ads when consent is required. When Google requires a privacy options entry, open Settings → Privacy → Ad privacy choices to review your choice, including if you have Pro. Google and your device also provide privacy controls where available. Diagnostic sharing controls do not disable the advertising SDK's operational data processing.

You can delete individual check-ins or clear local app data from within the app where those controls are available. You can also uninstall the app, which may remove local data stored on your device, subject to platform behavior.

Third-party providers may keep their own records for longer periods under their own policies and legal requirements. For example, purchase records, billing records, fraud-prevention records, and crash reports may be retained for operational, accounting, security, audit, or legal reasons.

Support correspondence includes the sender's email address, message, attachments voluntarily supplied, and our replies. We use it to handle the request and necessary follow-up, not to build an app-content archive.

Under this revised rule, routine correspondence is kept while the request and necessary follow-up are being handled. When that purpose ends, eligible messages and attachments are deleted without undue delay. Open requests are reviewed monthly; the review schedule does not permit keeping information after it is no longer needed.

If a specific legal obligation, ongoing dispute, or other lawful retention ground requires continued storage, we keep only the necessary records, restrict their use to that purpose, record the ground and retention period or end condition, and delete them when that ground ends.

Deletion is performed manually using the email service's deletion controls, including removal from Trash where available. This rule takes effect when this revised notice is published. Existing correspondence must also be reviewed under the rule; publication does not mean historical messages have already been deleted. Provider backups and independent provider records follow the provider's own deletion process.

Firebase Crashlytics retains crash traces and associated installation identifiers for 90 days before starting removal from its live and backup systems. Firebase Performance retains IP-associated events for 30 days and installation-associated or de-identified performance data for 60 days before starting removal. These periods describe the start of provider deletion, not guaranteed completion of all backup deletion.

Our Sentry organization currently uses the Developer plan with a 30-day error-event retention period. Records collected under an earlier plan follow the retention rule that applied when collected. Other data types and provider backups have separate retention rules.

Purchase and advertising records follow the applicable store or provider retention requirements. A local reset, uninstall, or diagnostic opt-out does not erase records already received by those providers.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction that requires a legal basis for processing, for example under the EU General Data Protection Regulation (GDPR) or the UK GDPR, we generally rely on one or more of the following:

• Performance of a contract or steps requested by you, for example to provide app features, restore purchases, or respond to product requests.
• Legitimate interests, for example to secure the app, prevent abuse, maintain app reliability, support core operations, and respond to support inquiries, provided those interests are not overridden by your rights.
• Consent, where we ask for it under applicable law or platform policy, including for certain permission-based or advertising-related processing.
• Legal obligations, where processing is required to comply with applicable law, lawful requests, accounting duties, or enforcement obligations.

Information is transmitted over the internet when you use a purchase or restore feature, request an ad, enable diagnostics, or email support.

RevenueCat, Inc. processes purchase and entitlement information in the United States. Functional Software, Inc. (Sentry) stores the diagnostic events for our organization in the United States.

The information sent depends on the service: transaction and entitlement records for RevenueCat; technical errors, timings, and device or installation identifiers for diagnostics; advertising delivery and interaction information for Google Mobile Ads; and the correspondence you send for email support. The retention section explains the verified diagnostic periods and the limits of deletion requests.

You can stop optional diagnostic transfers using the app setting, manage advertising choices where offered, and choose whether to use backup or purchase features. These choices do not remove provider records already created. Contact the privacy contact below for access, deletion, or transfer-related requests. Required contractual safeguards or consent must apply to the particular transfer; accepting this policy alone is not consent to every international transfer.

Provider details: Firebase privacy and retention · Sentry retention · RevenueCat privacy · Google privacy.

Firebase Crashlytics and Performance Monitoring use Google's global infrastructure. Google does not designate a single processing country for these services; processing can occur at the Google Cloud and data-center locations it publishes. Google Mobile Ads also uses Google's global infrastructure under Google's privacy policy.

Product support email uses Google Workspace without a geographic data-region restriction under our current service. Google may process it where Google or its subprocessors have facilities. The published location lists describe possible processing locations, rather than a verified country for an individual report, ad request, or email.

Firebase processing locations · Google Cloud countries and regions · Google data-center locations · Workspace processing locations · Google privacy policy

For processing subject to the Republic of Korea's Personal Information Protection Act, you may request access, correction or deletion, suspension of processing, or withdrawal of consent where applicable. You may submit a written request by email or act through an authorized representative. We request only the verification or authorization information reasonably needed to handle the request.

We handle requests within the period required by applicable law. If a request must be restricted, deferred, or refused on a lawful ground, we explain the reason and how to challenge the decision by contacting the privacy contact again. We cannot remotely access or delete local app content or identify every provider record; those limits do not remove your statutory rights.

You can also seek help from the KISA Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee. These independent bodies are separate from our product support service.

Depending on your location and applicable law, you may have rights that can include the right to request access to personal data, correction of inaccurate data, deletion, restriction, objection, withdrawal of consent, portability, and information about recipients or categories of recipients.

If you are a California resident and the CCPA or another state privacy law applies, you may also have rights that can include the right to know, delete, correct, opt out of certain sale or sharing activity, limit certain uses of sensitive personal information, and receive equal service without unlawful discrimination for exercising your rights.

Progress Pics does not have an app account. Delete photos and weight records using the app's local controls. We cannot remotely access or delete that local content. For information you sent to support or information held by service providers, you may send an access or deletion request to the address below. We will review what records can be identified, any verification needed, and applicable retention requirements. A local reset does not delete providers' records or cancel a purchase.

For privacy questions, access or deletion requests, contact progresspics@globalhashtag.com and identify the product involved and your country or state where relevant. Do not send progress photos, app PINs, passwords, or encryption keys. We may direct you to a provider's own privacy controls when records are held independently or cannot be identified from the information available to us.

Progress Pics is not directed to children under 13, or to children who cannot validly consent under applicable law. If you believe a child has provided personal information to us in a way that requires action, contact us and we will review the request.

Progress Pics is a utility for personal progress tracking. It is not medical advice, diagnosis, treatment, nutrition coaching, or emergency support.

We may update this policy from time to time to reflect product changes, legal requirements, or changes in providers or processing practices. When we do, we will update the "Last updated" date on this page.

Privacy requests are handled by Jaeseon Lee, the GlobalHashtag operator. Contact progresspics@globalhashtag.com to request access, correction, deletion, restriction, or withdrawal of consent where applicable.

We ask only for information needed to verify and locate the relevant records. Do not send private app content, PINs, passwords, backup files or keys, or payment card details. An email address alone may not identify an SDK diagnostic record. We explain any identification or deletion limits and respond within the period required by applicable law.

progresspics@globalhashtag.com

Progress photos use encrypted app-private storage. Platform authentication and app lock controls protect access to the local app. Diagnostic reporting excludes private app content, PIN values, and backup contents; screenshots and session replay are disabled in the app configuration.

Support requests can contain personal information you choose to send. Send only the details needed to resolve your request. Privacy requests do not require sending your notes or photos. Provider access and deletion are handled through the relevant authorized account or provider process.