Privacy Policy

Last updated October 7, 2026

Save Face is an app for iPhone and Android for keeping a gym habit. You choose your gym days and check in with a photo. It’s free and never charges you. This policy explains what we collect, why, who we share it with and the choices you have. It covers the Save Face app, this website and the services behind them. Save Face is run by OJF, based in Singapore (“we”, “us”).

What we collect

Account: your mobile number (or, for accounts made before phone sign-in, your email address), name, username, birthday and, if you add one, a profile photo. Your birthday is used to check you’re 18 or older and is never shown to anyone.
Your commitment: your gym days, stake, start and end dates, the time zone on your phone when you signed, the terms you signed, your drawn signature and when you signed. We keep earlier versions when you sign changes.
Check-ins: every photo you submit, including retakes, when it arrived, and a fingerprint (checksum) of the file. We also keep some of the photo’s metadata: when it was taken, the time zone offset, the phone make, model, lens and software, and the image size. We don’t collect GPS or any other location.
Live Photo clips: on iPhone, the app’s camera takes a Live Photo, so each check-in can also have a clip of about 3 seconds. It has no sound.
Workout details: what you trained, how it felt, the friends you say you trained with, and the song you were listening to if you add one. For a song we keep its title, artist, cover and links to it on Apple Music.
Photo check results: what our AI check decided about each photo, its reasons and confidence, and any concerns it raised, including explicit or offensive content. We also record reviews and disputes, including any note you add.
Payments, from before 6 October 2026: Save Face no longer takes payments. If you added a card while Committed was offered, we keep a Stripe customer ID, your card’s brand, last four digits and expiry date (and whether you added it with Apple Pay), the charge authorisation you agreed to and when, and a record of each charge: amount, reason, status and Stripe’s payment reference. Your full card number went straight to Stripe and never reached us.
Friends: friend requests, friends, nudges and the messages you write on them, and emoji reactions you give and get.
League and badges: your weekly League points and rank, and the badges you’ve earned. We work these out from your accepted check-ins, reactions and past League weeks.
Safety: people you block, the posts, people and nudge messages you report, reports about you or your posts, and what we decided about each report.
Notifications: your notifications, your notification settings and a push token for each device you use. On iPhone we also keep tokens that let us start and end the Live Activity countdown to your check-in deadline.
Technical data: sign-in sessions, sign-in code rate limits, the version of the app you’re using, and server logs used to run and secure the service.

We don’t use analytics, advertising or crash-reporting tools, and we don’t access your contacts or microphone. Reminder times and appearance settings stay on your phone.

How we use it

to create your account and sign you in with a code sent by text message (or by email, for accounts made with one);
to schedule your gym days, check your photos and decide each day’s result;
to handle disputes about photo checks, and questions about charges made before 6 October 2026;
to show your check-ins to your friends, and to friends of friends unless you turn that off, and to show you theirs;
to work out League points and badges;
to send notifications and reminders;
to spot reused or edited photos, prevent abuse and keep the service secure;
to review reports, remove content and ban accounts that break our Terms;
to answer support requests and meet legal obligations.

We use your information only to run Save Face. We don’t sell it, use it for advertising or track you across other apps and websites.

How photos are checked

Each check-in photo is sent to an AI model through OpenRouter to check that it was taken in a gym, and that it doesn’t show anything explicit or offensive. You don’t need to be in the photo. A photo it finds explicit or offensive isn’t accepted or shown to anyone else, and a person reviews it. Live Photo clips are never sent to the AI. We only allow providers that don’t store the photo or use it for training (OpenRouter’s zero data retention setting). We also use the photo’s metadata and the file’s fingerprint to spot photos that are old, edited or already used for another check-in.

These checks decide automatically whether a gym day counts, and friends see a day that doesn’t count as missed. They can be wrong, so you can retake a photo while the gym day is open, and dispute a photo that wasn’t accepted for up to 14 days after the gym day. A person reviews every dispute and every photo the checks couldn’t assess, looking at the photo, its metadata and the AI’s assessment. If a review accepts the photo, it counts as a check-in.

What other people can see

Friends you add can see your name, username and profile photo, your gym-day schedule (unless you hide it in Settings → Privacy), your check-in photos and their Live Photo clips, your workout details and song, which days you checked in or missed, your streaks and check-in count, and your badges (but not the counts behind them). No one sees any charges or payment status. Photos that weren’t accepted aren’t shown to anyone else.

Friends of friends, people who aren’t your friends but share one with you, see your accepted check-in photos and clips on Home for 24 hours after you post them, with your name, profile photo and the friend you share. They can react to those posts and report them. They don’t see your misses, workout details, song, streaks, gym days or profile grid. This works both ways and is on by default. Turn off Friends of friends in Settings → Privacy and only your friends see your posts, and you only see your friends’. It never includes people either of you has blocked.

Everyone who can see a post can see the reactions on it and who gave them. If a friend says you trained with them, people who see their post see your name on it. A nudge message is seen only by the friend you send it to. Your League is you, your friends and their friends (up to 50 people), and they see your name, profile photo and weekly points.

Anyone else can find you by username, in Suggested (unless you turn it off) and through your invite link (saveface.app/u/your-username), and see your name and profile photo, but not your check-ins.

Reports and bans

You can report a post, a person or a nudge message in the app. A person reviews every report. If something breaks our Terms of Use, we can remove it for everyone or ban the account behind it. A reported post is hidden from you straight away.

Who we share it with

These services process data for us, only to provide Save Face:

Service	What for	What it receives
Convex	Database, file storage and sign-in	All the data above
OpenRouter	AI photo checks, and screening nudge messages with TypeSafe’s Jev model before they’re delivered	Check-in photos (never the Live Photo clips) and the nudge messages you write
Stripe	Cards and charges from before 6 October 2026	Email, card details and charges
Prelude	Sign-in text messages, and checking sign-ins for fraud	Mobile number, an identifier for your phone that only this app uses (on Android, the Android ID), and your phone’s system and app versions
Resend	Sign-in emails	Email address and sign-in code
Expo	Push notifications	Push tokens and notification text
Apple	Push notifications and the Live Activity countdown on iPhone	Push tokens, notification text and your check-in deadline
Google (Firebase Cloud Messaging)	Push notifications on Android	Push tokens and notification text

Song search works differently. When you search for a song, your phone sends the search straight to Apple’s iTunes Search API, with your region, and we never see it. Song covers and 30-second previews also load from Apple’s servers. Apple’s privacy policy covers those requests. We only receive the song you pick.

Push notifications never include amounts. We may also disclose information if the law requires it, to protect our users or others, or as part of a sale or transfer of Save Face, in which case this policy would still apply to your data.

Where your data is stored

Your data is stored in the United States (Convex, US East), and our service providers may process it in other countries. This means it leaves Singapore and Australia. We only use providers that protect it to a standard comparable to Singapore’s Personal Data Protection Act and the Australian Privacy Principles.

How long we keep it

We keep your data while you have an account. Declined friend requests are removed after seven days. When you delete your account, your data is deleted as described below. Stripe keeps its own records of payments made, as payment and tax laws require.

Deleting your account

Delete your account in the app under Profile → Settings → Delete account. It can’t be undone. Deleting starts straight away: you’re signed out, and your sign-in details and friendships go at once. Your photos, check-ins and everything else listed below are removed in the background, usually within minutes. If you added a card before 6 October 2026, it’s removed from Stripe and any unpaid charge is cancelled.

If you can’t sign in, email support@saveface.app from your account’s email address, or tell us your account’s mobile number. We’ll confirm the account is yours, delete it and reply within 30 days.

What we delete: your sign-in details (mobile number or email address), profile (name, username, birthday and profile photo), commitments and signatures, every check-in photo with its copies, Live Photo clips and photo check results, workout details and songs, disputes, friends, friend requests and blocks, nudges, reactions, notifications, League history, badges, reports you made and reports about you, and your push tokens.

What we keep: emails already in our support inbox, such as reports and your messages to us, until we no longer need them to handle a complaint or meet a legal obligation; payment records from before 6 October 2026, which Stripe keeps as payment and tax law requires; and, if you signed in with a mobile number, a sign-in limit for your phone that holds its identifier and a count of recent codes.

Your choices and rights

Edit your name, username and profile photo in Settings.
Turn off nudges, friend and check-in notifications in Settings, or all notifications in your phone’s settings.
Turn off Friends of friends, Show my gym days or Show me in Suggested in Settings → Privacy.
Remove friends, block people, and report posts, people and nudge messages at any time.
Delete your account in the app.
Ask us for a copy of your data, to correct it, or to withdraw consent by emailing support@saveface.app.

We’ll reply within 30 days. The same goes for privacy complaints: email us, and if you’re not satisfied with our answer, you can complain to Singapore’s Personal Data Protection Commission or the Office of the Australian Information Commissioner.

Security

Data is encrypted in transit, card numbers are handled only by Stripe, and access to our systems is limited to what running Save Face requires. No system is perfectly secure. If a data breach is likely to harm you, we’ll tell you and the regulators as the law requires.