← All privacy policies

Privacy Policy

for CortiMax

Last updated · 16 June 2026

Terms of Use · About CortiMax

Short version

CortiMax estimates a personal stress pattern from a daily selfie plus your Apple Health signals. Your selfies, your face measurements, your Health data, and your scores all stay on your iPhone — they are processed on the device and are never uploaded to us or anyone else. We have no server that stores your data, no analytics SDK, no ads, and no account system. The only off-device traffic is a pseudonymous receipt validation with Apple via RevenueCat when you subscribe to CortiMax Pro.

1. Who we are

CortiMax is published by Akhaneva (“we,” “us,” “our”). This policy describes how the CortiMax iOS app handles information. By using CortiMax, you agree to the practices described here. Questions: akhaneva.co@gmail.com.

2. What we collect, and where it lives

CortiMax is a privacy-first, on-device app. We do not operate a server that receives your personal data. There is no account, no login, and no profile held by us. Everything the app needs to work is stored locally on your iPhone using Apple’s frameworks (Codable files in the app’s Application Support container and UserDefaults):

  • your onboarding answers and profile,
  • each scan’s extracted face signals and the resulting Cortisol Index,
  • your personal 7-day baseline and history,
  • your ritual progress, streak, and settings.

This data never leaves your device through CortiMax. We never see your IP address, and we have no record that the app was even opened. The single exception is in-app purchase validation, described in section 8.

3. Your face scans

The heart of CortiMax is a daily front-camera selfie. Here is exactly what happens:

  • The front camera streams frames only while a scan screen is open. Apple’s Vision framework detects that a face is present and a single frame is captured.
  • That frame is analysed on your device to extract five geometric/colour signals (periorbital puffiness, cheek fullness, jaw definition, skin inflammation, and eye/brow tension). These signals, compared against your own baseline, produce your Cortisol Index.
  • The photo is not uploaded anywhere. It is processed in memory on the device. CortiMax does not save your selfies to a server, does not send them to any third party, and does not require Photos-library access to function.

The matching permission string you see is: “CortiMax scans your face to estimate your daily cortisol pattern. Photos stay on your device.”

4. Apple Health (HealthKit)

With your explicit permission, CortiMax reads three Apple Health metrics to cross-check your face score: heart-rate variability (HRV / SDNN), resting heart rate, and sleep. This is what powers the ”✓ HRV Confirms” cue.

  • HealthKit access is requested only when you tap Continue/Connect on the Health screen — never silently. You can decline, and the app still works with a non-Health fallback.
  • CortiMax only reads these metrics. It never writes any data back to Apple Health (the write-usage string explicitly states: “CortiMax does not write any data to Health.”).
  • Your Health data is used only for on-device display and scoring. It is never transmitted to our servers or any third party, in line with Apple’s HealthKit guidelines (Guideline 5.1.3 — no HealthKit data shared with third parties for advertising or use beyond providing the feature).

You can revoke CortiMax’s Health access at any time in iOS Settings → Privacy & Security → Health → CortiMax.

5. Onboarding answers and profile

During onboarding CortiMax asks a few questions about how you feel, your sleep, and where you carry stress, and stores your answers and a basic profile locally to personalise the experience. These answers are stored on the device only and are never sent anywhere. None of them are required to identify you, and we ask you not to enter your real name or other identifying details.

6. Camera, microphone, photos, location

  • Camera — used live, on-device, only during a scan, as described in section 3.
  • Microphone — CortiMax does not request microphone access. Scans are silent; no audio is recorded.
  • Photos library — CortiMax does not require Photos access and does not read your photo library.
  • Location, contacts, Bluetooth, motion — none of these are requested. CortiMax has no use for them.

7. AI coaching (on-device)

CortiMax may show a short, encouraging, non-medical suggestion alongside your reading. When your device supports Apple Intelligence (the on-device Foundation Models framework, iOS 26+), that suggestion is generated entirely on the device. Nothing about your reading leaves your phone to produce it. On devices without Apple Intelligence, the app simply shows static, pre-written copy. CortiMax does not send your score, Health data, or any personal data to a cloud AI service.

8. Purchases — CortiMax Pro

CortiMax offers a CortiMax Pro auto-renewing subscription (weekly and annual options) that unlocks the full experience. Purchases are handled entirely by Apple In-App Purchase through StoreKit. Apple receives your Apple ID, payment, and billing details. We never see your card number, name, email, or postal address.

We use RevenueCat as the entitlement validator. When you subscribe or restore, the app sends RevenueCat a pseudonymous, randomly-generated identifier and the Apple-signed purchase receipt; RevenueCat returns whether the Pro entitlement is active. RevenueCat may also receive standard request metadata (device model, OS version, app version, and a transient IP address for fraud prevention).

RevenueCat does not receive your selfies, face signals, Cortisol Index, Health data, onboarding answers, or anything else the app stores. RevenueCat’s handling is governed by RevenueCat’s privacy policy. The subscription supports Family Sharing where Apple permits.

9. Children’s privacy

CortiMax is intended for adults (17+). We do not knowingly collect personal information from children. Because the app collects no personal information on our servers from anyone, there is nothing for us to delete; if you believe a child has used the app and you want confirmation, contact us at akhaneva.co@gmail.com.

10. Third parties

CortiMax embeds no third-party analytics, advertising, attribution, A/B-test, crash-reporting, or social-login SDKs. The only parties involved, and their narrow purpose:

That is the entire list. No Firebase, no Mixpanel, no Amplitude, no Adjust, no AppsFlyer, no Meta SDK, no Google Analytics, no Sentry.

11. Data retention and deletion

Because CortiMax stores everything on your device, you control retention completely:

  • Reset app in Settings clears your profile, scans, baseline, scores, and ritual progress from the device.
  • Delete the app removes the entire local store — every byte the app held is gone.
  • Revoke Health access in iOS Settings stops any further reads from Apple Health.

We have no copy on a server to delete on your behalf, because we never received one.

12. Your rights

Privacy laws — including GDPR, UK GDPR, CCPA, and Indonesia’s UU PDP — grant rights over personal data: access, deletion, correction, portability, and objection. Because we do not collect or hold your personal data on any server, those rights are satisfied directly on your device (view, reset, or delete in-app). You can still email us and we’ll confirm in writing that we hold nothing about you.

13. Data security

Your data is protected by iOS device security — your passcode, Face ID / Touch ID, and Apple’s on-device encryption. Because nothing is transmitted to or stored by us, there is no server-side database of your information to breach. We recommend keeping iOS up to date and enabling a device lock.

14. Medical disclaimer

CortiMax is not a medical device and does not provide medical advice, diagnosis, or treatment. The “Cortisol Index” is a personal score relative to your own baseline (a z-score), not a measurement of the cortisol level in your body and not a clinical or laboratory result. It is intended for personal wellness, reflection, and entertainment only. Always consult a qualified healthcare provider before making any health decision. Do not use CortiMax as a substitute for professional medical advice.

15. Contact

Questions about this policy, or a written confirmation request: akhaneva.co@gmail.com (subject line: Privacy Inquiry — CortiMax).

16. Changes to this policy

If we add features that change how data is handled — for example, optional iCloud sync across your devices — we will update this page and bump the “last updated” date before the feature ships. Material changes will also be surfaced in-app and in the App Store release notes.

← Back to home