Privacy Policy

The short version

PeachLock counts your squats on your phone. The camera frames used for pose detection never leave your device — no upload, no recording, no buffer that persists past the moment you finish.

We do collect a small amount of data needed to run a paid app: anonymous subscription state (via RevenueCat) and anonymous marketing attribution (via AppsFlyer, only if you allow tracking). We never collect your name, email, contacts, location, photos, or microphone. We never sell your data.

The rest of this page explains exactly what we do, why, and what rights you have. If anything is unclear, write to team@peachlock.com.

Who we are

“PeachLock,” “we,” or “us” refers to the developer of the PeachLock iOS app and the operator of peachlock.com. For privacy questions, the data controller can be reached at team@peachlock.com.

What this policy covers

This policy covers the PeachLock iOS app and this website (peachlock.com). It does not cover third-party services we link to (Apple, RevenueCat, AppsFlyer) — those have their own policies, linked below.

1. Camera & pose data — on-device only

PeachLock uses your device’s front camera and Apple’s Vision framework (VNDetectHumanBodyPoseRequest) to count squats. Specifically:

• Frames are processed in memory on your device, frame-by-frame.
• No frame is ever uploaded, transmitted, recorded, saved, cached on disk, or sent to a server.
• No image, video, or biometric template is created, stored, or shared. The 19 keypoint coordinates Vision returns are used only to compute joint angles, then discarded.
• The camera is only active while you are on the squat screen. Closing or backgrounding the app stops the capture session.

Camera access is requested with a system prompt and can be revoked any time in iOS Settings → Privacy & Security → Camera. Without it, the squat-unlock feature does not function.

2. Screen Time / Family Controls data — on-device only

PeachLock uses Apple’s Family Controls, ManagedSettings, and DeviceActivity frameworks to apply the app shield. In line with Apple’s App Review Guideline 5.1.5:

• We do not transmit any Screen Time, Family Controls, or usage data off your device.
• Apple’s API gives us only opaque tokens (ApplicationToken, CategoryToken) representing your selected apps. These tokens cannot be reverse-engineered into app names or identities, and we never see which apps you chose.
• Your blocked-app selection, unlock history, streak counter, and settings are stored locally in UserDefaults and a shared App Group container, accessible only to PeachLock and its iOS extensions.
• Uninstalling PeachLock removes all locally stored data.

3. Subscription data (RevenueCat)

Subscriptions are handled in-app through Apple’s StoreKit and tracked by RevenueCat, our subscription infrastructure provider.

• What is collected: an anonymous app user ID generated by RevenueCat, your subscription status, purchase and renewal events, country, app version, and device model.
• Why: to grant you access to paid features, sync entitlements across reinstalls, handle restores, and surface renewal/cancellation issues.
• Legal basis (GDPR): performance of a contract (Art. 6(1)(b)).
• Retention: for the life of your subscription plus up to 24 months for billing/refund disputes, then deleted.
• Where: RevenueCat, Inc. (United States). See RevenueCat’s privacy policy.

4. Marketing attribution (AppsFlyer) — only with your permission

To understand which marketing channels are working, PeachLock integrates the AppsFlyer SDK.

• App Tracking Transparency (ATT): on first launch, iOS shows you a system prompt asking whether PeachLock can track you across other companies’ apps and websites. If you choose “Ask App Not to Track,” we do not collect your IDFA and AppsFlyer falls back to SKAdNetwork and AdServices — Apple’s privacy-preserving, aggregate-only attribution.
• What is collected (always): AppsFlyer ID (anonymous), app open events, install source, device model, OS version, country, language, IP address (used for geolocation, then discarded).
• What is collected only with ATT consent:Apple’s IDFA.
• Why: measure which campaigns drive installs, in aggregate. We never use this to build profiles of individuals.
• Legal basis (GDPR): consent (Art. 6(1)(a)) for tracking with IDFA; legitimate interest (Art. 6(1)(f)) for non-tracking install measurement, balanced against the limited, anonymous nature of the data.
• Retention: 24 months at AppsFlyer, after which event-level data is anonymized or deleted per their policy.
• Where: AppsFlyer Ltd. (Israel/EU/US). See AppsFlyer’s privacy policy.

You can change your tracking preference any time in iOS Settings → Privacy & Security → Tracking.

5. Diagnostics & crash reports (Apple)

If you opted in to share with developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple may deliver aggregated, anonymized crash logs and performance metrics to us through App Store Connect. We use these only to fix bugs.

6. The peachlock.com website

The website is a static page hosted on Vercel.

• We do not set tracking cookies or run third-party analytics.
• Vercel automatically logs basic request information (IP address, user agent, request path) for security and abuse prevention. See Vercel’s privacy policy. Logs are typically retained for up to 30 days.
• Fonts are served by Google Fonts. Google may receive your IP address when fonts load. See Google’s privacy policy.

7. What we do not collect

• Your name, email, phone, address, or social account.
• Photos, videos, or any image of you.
• Biometric templates or facial recognition data (Vision returns anonymous keypoint coordinates, not identity).
• Your contacts, microphone audio, location, or health data.
• The names of the apps you choose to block.
• Your browsing or app-usage history outside PeachLock.

8. Sharing of personal information

We share data only with the service providers listed above (RevenueCat, AppsFlyer, Apple, Vercel, Google Fonts), each acting as a processor or independent controller for the limited purposes described.

We may disclose data if required by law (subpoena, court order, regulatory request) or to protect rights, safety, or property. If PeachLock is acquired or merged, data may transfer to the successor entity, subject to this policy.

We do not sell your personal information. We do not “share” it for cross-context behavioral advertising as defined by the California CPRA.

9. International data transfers

Our service providers are located in the United States, the European Economic Area, and Israel. Where data is transferred out of the EEA, UK, or Switzerland, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision (e.g., the EU–U.S. Data Privacy Framework, where the recipient is certified).

10. Security

All network traffic between the app and our providers uses TLS. Local data is stored within iOS’s sandbox and protected by the device’s passcode/biometrics where applicable. We pick providers with SOC 2 / ISO 27001 controls. No system is perfectly secure; we’ll notify users and regulators in line with applicable law if a breach materially affects you.

11. Retention

Local app data persists until you uninstall. Subscription data is kept for the contract term plus up to 24 months for dispute resolution. Attribution data is kept up to 24 months. Server logs are kept up to 30 days. Anonymized aggregates may be kept longer.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion;
• Receive a portable copy;
• Object to or restrict certain processing;
• Withdraw consent (this does not affect prior processing);
• Opt out of cross-context behavioral advertising (we do not engage in this);
• Lodge a complaint with your local data protection authority (e.g., your country’s DPA in the EU/EEA, the UK ICO, the California Privacy Protection Agency).

Because we do not maintain user accounts, exercising rights generally means:

• For app-local data: uninstall the app, which erases everything on your device.
• For RevenueCat / AppsFlyer data: write to team@peachlock.com and we’ll route the request to the relevant provider. Please include your RevenueCat App User ID or AppsFlyer ID if known (visible in app settings).

We respond to verifiable requests within 30 days (45 under CCPA).

13. California residents (CCPA / CPRA)

In the past 12 months we have collected the following categories of personal information, as defined by the CCPA: identifiers (anonymous AppsFlyer ID, RevenueCat user ID, IDFA if you allow tracking, IP address), commercial information (subscription status), internet/device information (device model, OS, app version), and geolocation (country only).

We do not sell or share personal information for cross-context behavioral advertising. We do not knowingly collect personal information from minors under 16.

14. Children

PeachLock is not directed at children under 13 (under 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided data, contact us and we’ll delete it.

15. iOS permissions summary

• Camera — required for squat detection. Frames never leave the device.
• Family Controls / Screen Time — required to apply and remove the app shield.
• Notifications — optional, used for streak reminders if enabled.
• App Tracking Transparency — optional, controls whether AppsFlyer can use your IDFA.

16. App Store privacy nutrition label

Our App Store listing declares the following data linked to you: purchase history, identifiers (AppsFlyer ID, IDFA when permitted), and usage data (app open events). Data not linked to you: diagnostic data. Data used to track you (only with ATT consent): IDFA, used for marketing attribution. The label is the canonical source if it ever differs from this policy.

17. Changes

When we change this policy materially, we’ll update the effective date and surface a notice in the app on next launch. Continued use after the effective date constitutes acceptance.

18. Contact

Privacy questions, rights requests, or concerns: team@peachlock.com. We aim to respond within 5 business days.