Privacy Policy

What Behind collects, why, and how to make it disappear.

Last updated October 24, 2026

This policy covers the Behind iPhone app and getbehind.app. Behind is run by TallyHQ, Inc., a Delaware corporation ("we", "us"), the controller of the data described here. Write to support@getbehind.app about anything in it.

The short version

• In the app, the one face photo you scan or pick is sent once to an AI model from OpenAI, which rates your face and suggests a few grooming and skincare tips. We keep that rating, a few feature ratings and the tips. We also keep one smaller copy of the photo with your account, so your card still shows it if you delete the app, reinstall it or sign back in; it is never shown to anyone else or logged, is replaced when you rescan, and is deleted when you delete your account. The phone also reads how symmetric your face is, on the device, as a fallback number. No face map, landmark set or face template is ever made or sent. On the web, the face is read in your browser and the photo never leaves your device. A copy of the photo is also kept on your phone, protected and excluded from backups, only so your own card and the share image you choose to make can show it; it stays on the device when you sign out, for when you sign back in, is replaced when you rescan, and is deleted when you delete your account.
• We keep only the one photo you choose for your card, never make face templates, and never collect your messages with other people, contacts, or your exact salary. The only protected characteristic we ask for is the gender that defines your cohort, and we ask for it plainly.
• Our product analytics are anonymous: a random id this install made, never your account or your email.
• We do not sell or share your personal information, show ads, or track you across other apps and websites.
• Deleting your account in the app erases your data right away.

What we collect

• Account. The account identifier from Sign in with Apple or Google, and whatever name or email the provider shares with us — with Apple you choose, and you can hide your email. Google also shares a link to your Google profile picture, which we store with your account but do not use. Those are the only two ways to sign in.
• Age and gender. Both decide your cohort: you are ranked against people born the same year, of the same gender, in the country you grew up in (worldwide, if you skip that question). Behind is for people 13 and older. If the age you give is under 13, you are turned away and nothing is stored.
• Your answers. Bands and taps, never exact figures: height, follower range, savings band, your parents' education, the city you grew up in, and the quick-fire cards for privilege, bag, lore, popularity and brainrot. We never ask for your exact salary.
• Your lore. One sentence, up to 120 characters, about something you have done. It is the only free text in Behind. We show it back to you, we turn it into a typed signal for scoring, and we never show it to another person.
• Your LinkedIn, if you are 17 or over. When you choose to import your LinkedIn, we send the name your Apple or Google sign-in gave us (and the city you grew up in, if you answered it) to our search provider to find matching public LinkedIn profiles — only then, and only if you are 17 or over. If you are under 17, nothing is searched and LinkedIn is not offered. Matching public profiles are kept for 24 hours so the same search is not sent twice (a search that finds nobody, for 10 minutes), then deleted. If you pick one, we read that public profile and keep only typed signals from it, never the profile itself.
• A resume, if you upload one. The file is read on your phone. Only typed signals leave it — that something was built, led, won, earned or selected, and roughly at what scale. The document, employer names, dates of birth and addresses never leave your device.
• Your social handle, if you give one. Stored as a claim. If you ask us to check an Instagram, TikTok or Snapchat handle, we read that account's public profile and keep only the handle, its public display name, its follower count, how many accounts it follows, and whether it is private or verified. For a private account, that is all we read. For a public Instagram or TikTok account, we may also read its most recent public posts (up to twelve), only to count their likes and comments, and keep the results as a handful of numbers: posts read, average likes, average comment count, engagement rate, posts per week, the share that are videos, and days since the last post. We never read or store what a post says or shows, captions, hashtags, comment text, who commented or was tagged, messages, or who follows whom. These numbers are kept with the lookup, for 35 days or until you delete your account, and they are not part of your score. If you connect an Instagram account instead, Instagram tells us its id, username, account type and follower count, and nothing more.
• Screen time. Your daily total, read on your phone from a screenshot you pick. We never see which apps you opened. You can choose a range instead.
• Face score, if you scan. The AI's rating of your face with its feature ratings, reasoning and tips, and a facial-symmetry percentile calculated on your phone. See the face scan below.
• Purchases. Your Behind Pro subscription status and the transactions behind it, which Apple sends us through App Store Server Notifications. Apple takes the payment; we never see your card.
• Device and app data. Your storefront country, time zone, and language. A salted hash of your device's vendor identifier, used only to stop invite fraud and to count an invite link that opened the app. Your notification token, if you allow notifications.
• Invites. The invite links you create and whether they were used. When someone opens an invite page, it keeps one random id in that browser's own storage and sends it with the link, so the same browser opening it twice counts once; we keep only a salted hash of that id and of the address it came from, never the id or the address itself. If you already have Behind, the link opens the app instead, which sends the link with the vendor identifier above, kept the same way. The inviter sees only a count from 0 to 3. You never see who opened or used your links, and they never see you.
• Anonymous usage events. Which screens and steps were reached, under a random install id. See analytics.
• Emails you send us. If you write to support@getbehind.app (or any getbehind.app address), we receive your email address, what you write, and any attachments, and use them only to answer you.
• Waitlist. If you join the waitlist on our website before the app launches, we keep the first name, last name and phone number you gave. We use them only to text you once when Behind launches, and it is deleted once we do, or sooner if you ask support@getbehind.app.

We do not buy data about you to enrich your profile behind your back. The only lookups that happen are the ones you ask for, and you choose which result is you.

The face scan, and why it is not like the others

The scan is offered at every age from 13, and it is optional every time. It reads a live camera frame or, if you prefer, one photo you pick from your library. You can skip it, and the settings screen and this policy say what happens to the photo.

• The AI read (in the app). The one photo you took or picked is sent over an encrypted connection to our server and from there to OpenAI, once, with your age and gender so it is rated against people like you. OpenAI's model returns a rating, a few feature ratings (such as eyes or skin), two sentences on why, and up to three safe tips (skincare, grooming, hair, sleep, posture — never surgery or weight). We keep those. Separately, one downsized copy of the photo you keep is stored with your account so your card can show it after a reinstall or on a new phone; it is never logged, never shown to anyone but you, replaced when you rescan, and deleted with your account. OpenAI processes it under its API terms: it does not use API data to train its models, and may keep it for up to 30 days to detect abuse.
• On your phone. The phone also measures how symmetric your face is and a few proportions, in memory, and sends only whole-number scores — used if the AI read is not available. No crop, landmark set, embedding or face template ever leaves the device or touches disk.
• If the photo has no clear face, it counts as average (50) until you rescan. Every score is shown only to you and never attached to a crash report.
• Skip the scan and you still get a full card. The sub-score is estimated from your age and marked Estimated, and you can change your mind later.

Biometric laws

Some US states — Illinois (BIPA), Texas (CUBI), Washington — regulate collecting, storing, selling or profiting from biometric identifiers such as a scan of face geometry. Stated precisely: we do not create, collect, store, or possess a scan of face geometry, a face template or any other biometric identifier, and we never sell, lease, trade, or otherwise profit from one. We keep the photograph you chose for your card, and ratings and text about it — never measurements of your face — and we never use any of it to identify you or match you against anyone. We never use face data to identify or verify who you are, and we never match your face against another person's. Because we hold nothing, there is no biometric retention schedule to publish and nothing to destroy — but if a jurisdiction treats the percentile itself as regulated, the same answer applies: it is deleted with your account.

Apple Health

Connecting Apple Health is optional. If you do, the app reads your step count, workouts and sleep on your phone and sends us three averages: steps a day over the last 30 days, workouts a week over the last 8 weeks, and hours of sleep a night over the last 14 nights. We use them only to score the mog tile. Health data is never used for advertising or marketing, never shared with analytics, never sent to the coach or any other AI service, never sold, and is deleted with your account. You can revoke access at any time in the Health app.

The coach

Behind Pro includes a coach you can ask questions. Its answers are written by an AI model from OpenAI. When you ask, we send OpenAI your question, your last few messages and your card's scores, your age, gender and most-used app — never your photo, your face score's inputs, your health data, your written answers or your handles. OpenAI processes it to write the reply under its API terms (it does not use API data to train its models, and keeps it for up to 30 days to detect abuse). We do not store your messages; the conversation is kept only on your phone. The coach asks for your agreement before your first question.

Never collected, at any age

Face templates or landmarks. The content of your messages with other people. Contacts. Your exact salary. And every protected characteristic except the gender that defines your cohort, which we ask for plainly and declare here and to Apple. Behind asks for no precise location. If you connect Apple Health, we read three averages on your phone — daily steps, workouts a week and nightly sleep — and only those three numbers are sent; see Apple Health.

How we use it, and our legal basis

Everything above is used to run Behind: to calculate your eight sub-scores against published reference data for people your age and gender, to rank you against the people born your year in the country you grew up in, or worldwide if you did not say (UN World Population Prospects 2024), to tell you when your rank moves, to manage your subscription, and to stop fraud and abuse. Your rank is a statistical position in that population, not a comparison with other Behind users. No other user can see your card, your answers, or your lore unless you share the card yourself.

If you are in the EEA, the UK or Switzerland, our lawful bases are:

• Performing our contract with you — your account, your answers, your scores, your subscription, your invites. Without them there is no card to give you.
• Your consent — the camera for the face scan, notifications, connecting a social account, and any lookup you ask us to run. Withdraw it at any time, in iOS Settings or in the app; withdrawing does not undo what was lawful before.
• Our legitimate interests — anonymous product analytics, keeping the service secure, and stopping invite fraud, balanced against your interests and kept to the minimum that works.
• Legal obligation — keeping records we are required to keep, and answering lawful requests.

Your score is produced by a deterministic calculation, not by an AI making a decision about you, and it produces no legal or similarly significant effect. Nothing you write is used to train a model.

Analytics

We use PostHog to see which screens and steps people reach, and whether a step was answered or skipped. It is anonymous by construction:

• The id it uses is a random one this install made. It is never your account id, your email, or a device identifier, and it is thrown away when you delete your account — the next session is a stranger to analytics too.
• Event properties are closed lists of fixed values. No age, no score, no answer, no free text can reach them.
• Nothing is used to track you across other apps or websites. We never read the advertising identifier, so you will never see the App Tracking Transparency prompt, and we answer "no" to tracking on our App Store privacy label.

Who we share it with

We disclose personal information only to the companies that run Behind for us, each under a contract that limits them to our instructions, and only the part each one needs:

• Supabase — our database, authentication and server hosting. It holds everything we store.
• Apple — sign-in, purchases, age range, push notifications. Google — sign-in, if you use it.
• Superwall — decides which pay wall design you see. It is presentation only: we pass it no account id, no age, no answer and no score, only whether you currently have Pro. On a locked card we pass eight unlabeled bar lengths and colours, shuffled, with no number and no tile attached. Its SDK also sees ordinary device and app information, such as your iOS version and locale.
• PostHog — the anonymous product analytics described above.
• Sentry — crash reports from the app. When the app crashes or freezes, it sends where in our code that happened, the app and iOS versions, and the same random install id analytics use; it also counts whether each session ended in a crash. Never your account id, an answer, a score, your age, health data, your photo or anything about your face, and never a screenshot.
• OpenAI — the face photo you scan or pick in the app, once, with your age and gender, to rate it (see the face scan); and, if you use the coach, the question you ask, your recent messages and your card's scores, as described in the coach, with a safety check of each message.
• TypeSafe — reads your lore sentence, and nothing else, to turn it into a typed signal. It never sees your account, your age or your other answers, and no language model is ever part of scoring itself.
• Serper (web search) — if you are 17 or over, the name from your Apple or Google sign-in (and your hometown, if you answered it), sent when you choose to import your LinkedIn so you can pick your profile, and any name you retype; and when you ask us to check an Instagram or TikTok handle, that handle, so the account can be confirmed in a second or two. When you check an Instagram handle, your phone first opens that account's public Instagram page directly, the way a browser would, to show its name and follower count; only if that cannot be read is the handle sent to our search provider. Nothing from the page is kept except the follower range you confirm. People Data Labs does the LinkedIn search job instead, when it is the provider in use. Search results are kept for 24 hours (a search that finds nothing, for 10 minutes); nothing else is kept unless you pick a result, and then only typed signals.
• Bright Data — only when you paste a LinkedIn address, pick a LinkedIn result, or confirm a TikTok handle is yours: we send that public address or handle so the public profile can be read — and, for a public Instagram or TikTok account, its most recent public posts, reduced on our server to the counts described above, with everything else discarded. We keep only the counts, or typed signals, as described above.
• Meta — only if you choose to connect an Instagram account: you sign in to Instagram on Instagram's own page, and it sends us the four fields above.
• Resend — receives email sent to getbehind.app addresses and delivers it to the inbox we answer from. It handles the email itself: your address, what you wrote, and attachments.
• Vercel — hosts getbehind.app. Like any web host, it sees your IP address and browser details when you load a page, and keeps short-lived request logs to run and secure the site.

We also disclose data when the law requires it, to respond to a lawful request, to enforce our Terms of Use, or to protect someone's safety — and, if Behind is ever sold or merged, to the buyer, who would be bound by this policy or would have to tell you before changing it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in California and other US state privacy laws. We have never done either, at any age.

Where your data goes

Our service providers are mostly in the United States, so your data is processed there and in other countries where they operate. If you are in the EEA, the UK or Switzerland, that is a transfer out of your region: we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where it applies), together with each provider's own safeguards, and we keep the transfer to the minimum the feature needs.

How long we keep it

We keep your account and your answers until you delete your account. Inside that, the specific schedules are:

• Your account, answers and current scores — until you delete your account.
• Score history — one row a week, for 56 days. The history sheet shows six weeks; older rows are purged.
• Profile and handle lookups — 35 days, then purged. Search results are cached for 24 hours under a one-way hash of the query, not tied to you.
• Subscription notification records and failed-job records — 90 days.
• The salted hash of a deleted account's device — 90 days, so that deleting and reinstalling cannot be used to fake invites. It is a hash: it cannot be turned back into your device or your identity.
• Support emails — kept as long as we need them to answer you and handle any follow-up, then deleted; ask and we delete yours sooner. Deleting your account in the app does not reach our inbox, so ask us if you want your emails gone too.
• Crash reports — held by Sentry for up to 90 days, then deleted. Like analytics events, they carry no account id.
• Anonymous analytics events — held by PostHog for as long as our PostHog plan keeps events, then deleted by PostHog. They carry no account id, so they cannot be linked back to you or deleted by account.

Deleting your account — settings › delete account — erases your account, answers, scores, invites and notification tokens immediately, and resets the anonymous analytics id. If you signed in with Apple, the app signs in once more during deletion so that your Apple sign-in tokens can be revoked with Apple; no Apple token is ever stored. Backups held by our hosting provider expire on their own schedule.

Behind Pro

Behind Pro is one plan: $4.99 a week, auto-renewing, sold and billed by Apple through the App Store. You manage or cancel it in the Settings app, under your name › Subscriptions. Whether you have it is told to us by Apple's App Store Server Notifications; that status, and the transaction history behind it, is all we store about the purchase.

Children and teens

Behind is not for children under 13, and we do not knowingly collect anything from them. Under 13 is a hard stop: if the age you give is under 13, no account is created, nothing is stored, and there is no retry. If you believe a child under 13 has given us data anyway, write to support@getbehind.app and we will delete it.

People aged 13 to 17 can use Behind, buy Pro, and send invites like everyone else. If you are under the age of digital consent where you live — 16 in much of Europe — use Behind only with a parent's or guardian's permission, and they may exercise the rights below on your behalf. Purchases go through Apple, including Ask to Buy where a family has turned it on. Two things that matter for a teenager: the face scan is optional at every age, and its photo is used only to rate it and to show on your own card, and nothing you write is ever shown to another person.

We do not sell or share the personal information of anyone under 16, and we never have.

Your rights

Wherever you live, you can:

• See and correct your answers in the app, and change any of them.
• Delete everything — settings › delete account — or ask us to.
• Skip any question. A skipped answer is estimated from your age and marked Estimated.
• Turn off camera or notification access at any time in iOS Settings.

To make a request by writing to us, email support@getbehind.app from the address on your account, or tell us enough to find it. We answer within 45 days (extendable once by 45 more, if we tell you why), or within a month in the EEA and UK. We do not charge for this and we will not treat you worse for asking. An authorised agent may act for you with written proof; we may still ask you to confirm it yourself.

California

Under the CCPA as amended by the CPRA, the categories of personal information we collect are the ones listed under What we collect — identifiers, commercial information (your subscription), internet or app activity, inferences (your scores), and, where a state law reads them that way, sensitive personal information (your account log-in and your gender). We collect them from you; from Apple and Google when you sign in or buy; and, only when you ask, from the public profile you point us to. We use them for the purposes above, and disclose them for a business purpose to the providers named above. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share it, so there is no "Do Not Sell or Share My Personal Information" link to give you; we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. You have the rights to know, access, correct, delete, and portability, and the right not to be discriminated against for using them.

Other US states

If you live in a state with a consumer privacy law — Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect — you have the rights to confirm, access, correct, delete, and receive a portable copy of your data, and to opt out of targeted advertising, sale, and profiling with legal effects. We do none of those three. If we refuse a request you may appeal by replying to our answer; we will decide within 45 days and tell you how to contact your attorney general if you are still unhappy. Behind receives no biometric identifier and never collects precise location. If you connect Apple Health, we receive the three averages described above (steps, workouts and sleep); where a state law such as Washington's My Health My Data Act or Nevada's SB 370 treats them as consumer health data, we collect them only after you allow it in Apple's Health prompt, use them only to score your mog tile, never sell or share them, and delete them with your account or when you ask us to.

EEA, UK and Switzerland

You have the rights of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw consent at any time. You may also complain to your supervisory authority — in the UK, the Information Commissioner's Office — though we would rather you told us first.

Do Not Track and Global Privacy Control

Behind and getbehind.app do not track you across other apps or websites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. getbehind.app sets no cookies and loads no trackers. The web app keeps your sign-in in your browser's own storage, and an invite page keeps the one random id described above; its fonts come from Google Fonts, which sees your IP address as any web request does, and it is hosted on Vercel, which does too.

Links to other services

Behind links to Apple, Google, Instagram, LinkedIn and others. What happens on their pages is governed by their own privacy policies, not this one.

Security

Data is encrypted in transit. Database access is restricted so that a signed-in person's queries can only reach their own rows, and the keys that could read everyone's data never ship inside the app. Every value the app sends is checked on the server for type, range and length, and rejected if it is wrong. No system is perfectly secure, and we do not promise one is.

We do not use a crash-reporting service today. If we add one, its reports will carry the error type, file, line, stack, and the app and OS version — never an answer, a score, your age, or anything from a face scan — and this policy will say so before it starts.

If a breach affects your personal data, we will notify you and the relevant regulator as the law requires — in the EEA and UK, within 72 hours of becoming aware, where the rules call for it.

Changes

If this policy changes in a way that matters, we will tell you in the app before the change takes effect, and the date at the top of this page changes with it. Smaller corrections are made here, with the date updated.

Contact

support@getbehind.app · TallyHQ, Inc., a Delaware corporation