Your photos stay under your control.

This website has no cookies, analytics, advertising, contact forms, or tracking scripts. Cloudflare serves the static files and may process ordinary request metadata for delivery and security under its own service policies.

Smile photo sources, metadata-stripped full-frame analysis derivatives, and smile-only display crops are stored in complete-protection, backup-excluded app files. Tracking details, routine events, immutable results, settings, and reminders are stored locally for the features you choose to use.

There is no Smile Monitor account and no cloud photo history. Saved local history remains available offline and after subscription access ends.

The app asks for explicit photo-processing consent before camera permission or analysis. For an accepted photo, it creates bounded, metadata-stripped JPEGs for the current image and any required comparison roles.

The frozen request is sent over HTTPS to the Smile Monitor service on Cloudflare and forwarded once to OpenAI for bounded cosmetic interpretation. The request uses store set to false so the Responses API does not create stored response state.

The OpenAI production project currently uses default data controls. OpenAI may retain customer content in abuse-monitoring logs for up to 30 days, or longer when required by law or reasonably necessary for safety. A flagged image may be retained for safety review.

Smile Monitor does not store image bytes, encoded image bodies, request bodies, raw face rectangles, landmark coordinates, masks, face templates, embeddings, or free-form provider prose in its service database or logs. Those items are also excluded from Smile Monitor analytics and crash traces.

Smile Monitor processes the front-camera still photo you choose to take. It can contain your face, mouth and teeth. Apple Vision temporarily detects one face rectangle, lip landmarks and pose on your iPhone only to guide framing, check capture quality, create the smile crop and assess whether photo conditions support a comparison.

Smile Monitor does not use Face ID or TrueDepth depth data. It does not create or keep a face template, embedding or identity profile, recognize or identify a person, infer age, ethnicity, emotion or attractiveness, or use face data for advertising or marketing. Landmark coordinates and live preview frames are discarded on device after the immediate check and are never saved, sent or logged.

After you continue through the disclosure and take a photo, bounded metadata-stripped JPEG copies of the accepted current photo and any required comparison photos are sent through Smile Monitor’s Cloudflare service to OpenAI solely for the visible cosmetic analysis you requested. Cloudflare and OpenAI receive no face landmark coordinates from the app. Smile Monitor stores no image bytes in its service database or logs.

Accepted captures are retained on your iPhone in three protected, backup-excluded forms: the camera source, a metadata-stripped full-frame analysis derivative, and a smile-only display crop. Byte-identical current, previous, and baseline upload copies may remain temporarily on your iPhone only while an analysis must be submitted or safely recovered. Rejected captures are not saved or sent. The accepted image forms and saved result remain until you use Delete All or remove the app. Temporary request copies are removed when the request reaches a terminal outcome.

While an analysis request is being serviced, Smile Monitor’s Cloudflare Worker receives the accepted photo copies and bounded derived observations needed to validate and complete that request. It does not write image bytes, encoded image bodies, request bodies, raw face rectangles, landmark coordinates, masks, face templates, embeddings, or free-form provider prose to its database, object storage, logs, analytics, or crash traces. A short-lived structured replay result may contain the appearance score, visible-tooth observations, and bounded aggregate geometry or comparison indicators. Those indicators are not used for recognition or identification.

Apple’s signed app transaction is checked ephemerally. Its raw signed value and raw transaction identifier are not stored or logged. A one-way app-scoped allowance subject and capped count of successful photo analyses prevent included use from resetting after deletion or reinstall. These records contain no photo, face geometry, name, email address, or inferred identity.

Apple and RevenueCat manage purchase and subscription records separately under their own terms.

Face and mouth photo copies are disclosed only to Cloudflare and OpenAI as service providers for the analysis the user explicitly requests. Cloudflare executes Smile Monitor’s request boundary and processes the copies during that request. The Worker forwards only the metadata-stripped JPEG copies and their current, previous, or baseline role labels once to OpenAI with response storage disabled. Neither provider receives raw Apple Vision landmark coordinates from the app.

Apple and RevenueCat process app-transaction, purchase, and subscription information, but Smile Monitor does not send them smile photos, face landmarks, or face geometry. Face data is not sold and is never used for advertising, marketing, profiling, authentication, or identification. Service providers may process data in countries where they operate under their respective service and security terms. Smile Monitor requires each provider to limit personal data to the service, security, and legal purposes described here and to protect it to the same or an equivalent standard required by this policy and applicable law.

Rejected captures, live preview frames, raw face rectangles, and landmark coordinates are discarded after immediate on-device processing and are not saved or sent. Accepted local image forms and derived saved results remain on the user’s iPhone until Delete All or app removal. Temporary upload and comparison copies remain only while an interrupted or pending request requires safe recovery.

Smile Monitor stores no photo bytes on its service. A structured replay result containing scores, visible-tooth observations, and bounded aggregate geometry or comparison indicators may remain for up to 24 hours. A full terminal request record and provider audit may remain for up to 30 days.

After that 30-day period, a compact tombstone containing the request ID, terminal state, and a one-way SHA-256 fingerprint of the exact request may remain with the operational installation solely to recognize an exact retry and prevent a duplicate provider call. It is not a face template or embedding and is not used to identify a person. It is removed when the operational installation is deleted after active work resolves, or after 400 days of installation inactivity.

A minimal one-way app-scoped allowance subject, capped successful-analysis and provider-cost counters, and a pseudonymous billing identifier remain for the lifetime of the included-analysis offer. They contain no photo, face geometry, name, email address, or inferred identity and prevent deletion or reinstalling from resetting the allowance or incurred provider cost.

OpenAI may retain request content in abuse-monitoring logs for up to 30 days, or longer when required by law or reasonably necessary for safety. A flagged image may be retained for safety review.

Smile Monitor includes the first three successful photo analyses. Further analyses require Smile Monitor Pro.

Delete All removes local tracking records, results, managed photos, preferences, reminders, offline entitlement cache, and the active device-bound installation identifier. The app also requests deletion of the current operational installation record and linked request state held by the service.

If the service is unavailable, local deletion still completes. A scoped credential may remain in the device Keychain for up to 30 days solely to retry service deletion when the app launches or returns to the foreground. The credential is removed after success or expiry.

A non-photo one-way app-scoped allowance subject and capped count of successful photo analyses remain so included use does not reset after deletion or reinstall.

Delete All cannot shorten OpenAI’s applicable retention period for content already sent. Smile Monitor has no server photo copy to retain or separately delete.

Delete All does not cancel an Apple subscription, restore deleted local history after reinstall, or erase older device backups. Apple and RevenueCat subscription records persist independently. Manage an active subscription in Apple subscription settings.

You can decline photo processing and use completed local history. You can remove all app data through Delete All. You may also request access, correction, deletion, restriction, or objection where applicable under your local law.

The service has no named account that directly identifies you. Include only the non-sensitive context needed to understand your request. Never email a smile photo, technical identifier, or app token. Contact hello@swtchd.io.

Smile Monitor is intended for adults and is not directed to children under 13. A parent or guardian who believes a child supplied personal data can contact us for review and deletion.

Local files use iOS file protection and backup exclusion. Network requests use HTTPS, scoped credentials, bounded payloads, and frozen request identifiers. Production analysis remains unavailable when required backend or billing configuration is missing.

No system can guarantee absolute security. Please report a suspected privacy or security issue promptly to the monitored contact address.

Material updates will appear on this page with a new revision date. Where required, the app will request renewed consent before a changed processing activity begins.

Contact email: hello@swtchd.io.