Privacy Policy

Squintly is an Android app by REVLOOM LLC (“Revloom”, “we”). This policy covers the Squintly app and this website, squintly.app. Revloom’s other products and its company website are covered by the Revloom LLC privacy policy.

1. What stays on your phone

Squintly’s facial-tension detection runs entirely on your phone. When you use calibration, Face Check or monitoring, Squintly uses the front camera and analyzes each frame in the moment, on your device, to estimate facial movement and local texture and crease measurements of the brow area. This is about movement and tension, not about who you are: Squintly does not use facial recognition, does not create face templates or identity embeddings, and does not infer your identity, age, gender, ethnicity or race.

• Squintly does not record video and does not save photographs of you.
• Camera frames, and the small image regions used for texture analysis, are held in memory only while they are analyzed and are not written to storage.
• Squintly never uploads camera images, video, facial landmarks, expressions, tension readings, nudges or calibration data.

So that Squintly can show your calibration, statistics and progress, it stores on your phone: calibration values, monitoring history (session times and durations, and per-event times, categories and intensity), progress and achievements, and settings. This stays on your phone and is excluded from Android’s cloud backup and device-transfer backup.

Squintly’s notifications (the monitoring notification, the gentle nudges and, if you leave “Milestones & reminders” on, an occasional note about a milestone or coming back) are created on your phone from information already on it. Their content is not sent anywhere.

Permissions. Camera, used only while calibration, Face Check or monitoring is active. Notifications, for the notifications above; if you decline, monitoring still works. Squintly does not request microphone, location, contacts, photo and media, or storage permissions.

2. What Squintly sends to our servers, and why

Squintly uses a server operated by Revloom and hosted by Supabase for purchases, free access and promotional time, Gift Quest, Ranking and Friends. It processes the following, and never any facial data:

• A random account ID that Squintly creates for this installation, so your purchases, free time and rewards stay attached to you. It is created automatically the first time the app contacts our server. It contains no name, email or phone number.
• When your account last contacted us, and when you first saw an introductory offer: for security, and to run time-limited offers fairly.
• Google Play purchase details (purchase token, product, plan, status, expiry and order number), to confirm and restore your subscription or lifetime purchase and to process refunds and cancellations.
• A one-way code derived from your account ID, sent to Google Play with purchases so Google can link a purchase to your Squintly account without learning who you are.
• Google Play Integrity results (whether the app and device look genuine) and, where enabled, Google Play “Device Recall” markers, to prevent abuse of free access, promotions and Gift Quest.
• Promotion codes you enter, to apply them; and request times, single-use request values and minimal security records (for example that a request was refused and why).

We use this information only to provide Squintly, verify purchases, manage free access and rewards, run Ranking and Friends, and prevent fraud and abuse. We never use it for advertising and never sell it.

3. Sign in with Google (optional)

You can sign in with Google to keep Gift Quest rewards and Ranking when you change phones. You can use Squintly without signing in.

• Google tells our sign-in provider (Supabase) your Google account identifier and, as part of every Google sign-in, your email address, your name and a link to your Google profile picture. Our sign-in provider stores these with your account; Squintly does not show or use your name or picture. They are deleted when you delete your account.
• We use your Google account identifier to recognise your account. Google also shares your email address with our sign-in provider; we do not use it for anything else.
• For Gift Quest fairness, we keep a keyed hash (HMAC) of your Google account identifier, which cannot be recomputed without a secret key we hold, so the same Google account cannot claim the same referral reward twice.
• Your phone shows a masked version of your email so you can see which account is signed in.

4. Gift Quest (invitations and rewards)

• If you invite friends: we create an invite code and link for you (sign-in required). We count how many people joined with your code and how far they got, so we can award your Squintly Pro time.
• If you were invited: when you install Squintly from an invite link, Google Play tells the app which invite code you came from (the Play Install Referrer). The app then automatically sends that code to our server, together with when the install started and when the link was clicked, the app version, and an integrity result. As you use Squintly, the app reports that you completed calibration and started monitoring, and your total monitoring time (durations only), so we can confirm the invitation was genuine. You do not need to sign in.
• If you join through an invitation and your invitation is verified, you unlock 24 hours of Squintly Pro, starting the next time you begin monitoring. To give it only once, we record that your invitation received it and when it started and, if you signed in with Google, keep the keyed hash of your Google identifier described above.
• Invite links open on revloomapp.com, a Revloom website hosted by Vercel. When an invite link is opened in a browser, we count link opens per code per day. We store no IP address, browser details or cookies for this count; like any website host, Vercel processes standard request information such as IP addresses in its service logs.

5. Ranking

If you choose to join Ranking (sign-in required), we store:

• your Ranking name, made from two words you pick from our list, plus a number;
• the country and, in the US, the state you choose (suggested from your phone’s language and region settings; Squintly never uses your location);
• whether your profile is public;
• for each of the last three days, how long Squintly observed you, how long it ran, and how many sessions, plus a random code for this phone. No facial or tension data is included.

Our server turns these into points. Other people see your Ranking name, rank and points on the boards; regional boards reveal your chosen region. You can make your profile private, or leave Ranking. Leaving deletes your Ranking data. A record that you left (and any Ranking ban) is kept until you rejoin or delete your account, so a waiting period before rejoining can be enforced. Daily Ranking data is kept while you are in Ranking and is deleted when you leave Ranking or delete your account.

6. Friends

• You can invite someone to compare progress privately. Invitations are single-use links that expire after seven days. We store only a scrambled form of the link’s secret. Expired invitations are marked expired and are deleted when you leave Ranking or delete your account.
• When the other person accepts, each of you sees the other’s Ranking name, rank and points on your Friends board. Opening a link never accepts it.
• Nicknames you give friends are stored only on your phone.
• Removing a friend, blocking, leaving Ranking or deleting your account ends the connection.

7. Reports and moderation

You can report a Ranking name or behaviour. We store who reported whom, the reason, and the name at the time. Reports are kept when either person leaves Ranking, so they can still be reviewed; they are deleted when either person deletes their account. Our moderators can hide or reset a name, or ban someone from Ranking. We keep a log of moderation actions, which can include a previous Ranking name. This log is kept, including after account deletion, for as long as needed to enforce the Ranking rules and handle disputes; it has no fixed deletion date. If you are banned from Ranking, we keep a keyed hash of your Google identifier (not your email), even after you delete your account, so the ban cannot be undone by creating the account again. It is kept until a moderator lifts the ban; bans do not expire on their own.

8. Payments

Squintly Pro is sold and processed by Google Play under Google’s own terms and privacy policy. Squintly receives from Google Play whether a purchase is active, which plan it is, and a purchase token, which our server verifies with Google Play (section 2). We never receive your payment card or other payment credentials.

9. Who we share data with

We do not sell your data or use it for advertising. Squintly contains no advertising, analytics or crash-reporting SDKs and does not use an advertising identifier. We use:

• Supabase (hosting, database and sign-in) as our service provider. Like any internet service, it also processes technical request information such as IP addresses in its service logs to operate and secure the service;
• Google for Google Play purchases, Play Integrity, Play Install Referrer and Sign in with Google, under Google’s privacy policy;
• Vercel, which hosts revloomapp.com, where invite links open; and Cloudflare, which hosts this website. This website sets no cookies and uses no analytics or trackers.

Other Squintly users see only what is described under Ranking and Friends.

10. Keeping and deleting your data

Reset all local data (Settings) deletes the Squintly information on this phone, including Gift Quest and Ranking information cached on it. It does not delete your Squintly account on our servers; use Delete account for that. Uninstalling the app also removes the information on the phone.

Delete your account in the app at Settings → Delete account, signed in with Google or not. You can also ask us by email; see Delete your Squintly account.

Deleting your account removes your account; your entitlements, free-access and promotion records; your Gift Quest codes and rewards; and all your Ranking and Friends data. On your phone, the app forgets the account and clears Ranking data. Your monitoring history stays on your phone until you reset it.

After you delete your account, we keep:

We delete or unlink everything else. Some records are kept after deletion. Where we say a record is unlinked, it no longer points to your account; that is not always the same as anonymous, so each item says which it is. We do not run automatic deletion of these records on a schedule; each is kept only for the reason given.

• Purchase records: The Google Play purchase token, product, purchase state and time, and Google’s country code for the purchase. The link to your Squintly account is removed, but these records are not anonymous: Google Play can still connect them to the purchase on your Google account. We keep them so refunds, chargebacks and cancellations still take effect, and for as long as needed to meet our legal and tax obligations. There is no fixed deletion date.
• Security records: For example a failed code attempt or a rejected purchase check: only the type of event, a short technical code and the time. The link to your account is removed, so they no longer identify you or your account. We keep them for as long as needed to protect Squintly against abuse. There is no fixed deletion date.
• If you joined through an invitation: the record of that invitation (the invite code, when the install and its milestones happened, how long you monitored, and the integrity result) without any link to your account, so the person who invited you keeps their credit. If you invited others, the daily counts of how often your invite link was opened (numbers only) are also kept.
• Keyed hashes of your Google account identifier: if you signed in with Google: a scrambled value made with a secret key we hold. It does not contain your email or name and cannot be turned back into your identifier, but it is not anonymous: if the same Google account signs in to Squintly again, we can recognise it. We use it so the same Google account cannot claim the same Gift Quest reward or the invited-friend gift twice, and, if you were banned from Ranking, so the ban cannot be undone by creating a new account. The Gift Quest records have no fixed deletion date; a ban record is kept until a moderator lifts the ban, and bans do not expire on their own.
• Audit logs: of Gift Quest and moderation actions: what happened and when, the internal random number your account had (which no longer leads to any account) and, for moderation, the Ranking name involved at the time. These are not anonymous. We keep them for as long as needed to investigate abuse and disputes. There is no fixed deletion date.

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play → Payments & subscriptions. Purchases stay on your Google account and can be restored.

If you email support, we receive your email address, the name your mail account shows and your message. We keep support messages as long as reasonably necessary to answer you and keep ordinary business records; please do not send photographs of you, health details or payment details.

11. Your rights

Depending on where you live, you may have rights over personal information we hold about you, including access, correction, deletion, portability, restriction and objection. Write to [email protected]. We respond to verifiable requests as applicable law requires. If you are in the European Economic Area, the United Kingdom or California, the GDPR, UK GDPR or CCPA may give you additional rights, including the right to complain to your local authority. The information that stays on your phone (section 1) is not something we can hand over or delete, because we do not have it: you control it directly.

12. Children

Squintly is not a children’s app and is not intended for children under 13. To use it you must be at least 13, or older if the law where you live sets a higher minimum age; if you are under the age of legal majority, you may use Squintly only with a parent or guardian’s permission where the law requires it. We do not knowingly receive personal information from a child through the app.

13. International users

Revloom LLC is based in Oregon, in the United States. Squintly processes your facial analysis on your own phone, wherever you are, and does not transfer it anywhere. The information in sections 2 to 7 is processed on infrastructure hosted by Supabase, which may be located in the United States or other countries. Where the law that applies to you requires a legal basis or safeguards for this, we rely on the mechanisms that law permits. Nothing in this policy reduces a right you have under the law where you live.

14. Changes and contact

We may update this policy as Squintly or the law changes. If a change is material, we will give notice where appropriate, and this page always shows the current effective date.

REVLOOM LLC, Oregon, United States · [email protected] · Terms: Terms of Service