Client Memory · Effective September 8, 2026

Privacy Policy

This policy covers Client Memory: Beauty Book, including optional Personal Sync and booking features available in testing for version 1.0.2. The core client book is stored on your device. Optional online services send the information needed for the feature to Apple or our Cloudflare-hosted booking service; they do not upload your complete client book to the booking service.

Client records, photos, and local tools

The app handles names, contacts, preferences, tags, sensitivities, service history, formulas, income amounts, photos, consent, plans, and check-ins that you choose to record. Records use protected local storage. Imported photos are re-encoded without source metadata. App Lock uses Apple’s Face ID or device-passcode authentication; the app receives no biometric data. Notifications use general wording rather than client details.

Optional personal iCloud sync

If you enable Personal Sync, your client book, including its photos and service records, is stored in your Apple Account’s CloudKit private database to sync your own devices. This is personal sync, not a shared staff account or team collaboration service. Apple operates iCloud under its terms and privacy policy. Turning sync off or uninstalling the app does not by itself erase the copy in iCloud.

Booking pages and customer requests

When a merchant creates a booking page, our service stores their display name, time zone, public service menu, page settings, and uploaded logo or background images. These page details and images are public. Only upload content you have permission to publish. Device identifiers, App Attest keys, subscription identifiers and verification status, and push tokens support authorization, Pro access, and booking notifications. Apple handles payments; we do not receive payment-card details.

Customers submit their name, phone number or email address, requested service, preferred time, and optional notes through the booking page. Our service stores and delivers this information to the merchant and supports confirmation, changes, cancellation, and management-code lookup. Avoid including medical details or other unnecessary sensitive information in notes. Booking payloads are encrypted in storage; this is not end-to-end encryption.

Security and service providers

Cloudflare hosts booking processing and storage, and Turnstile helps prevent automated abuse. Requests reach Cloudflare with network information such as IP addresses; the verification service can process this information. Our application’s rate-limit records use keyed hashes rather than storing the original IP address. Limited error diagnostics support troubleshooting without intentionally recording booking text, management codes, or authorization tokens. Cloudflare may also process operational logs under its service policies. Apple provides purchase verification, App Attest, iCloud, and push delivery. We do not use advertising, third-party analytics, or cross-app tracking.

Retention and deletion

Customer cancellation, merchant cancellation or completion, and rejection of an initial request remove the active online booking, its management-code record, and related delivery records. Pending requests expire at the requested time; scheduled cleanup provides a fallback. Confirmed bookings remain until the merchant completes or cancels them. An unhandled request to change a confirmed booking does not automatically delete the confirmed appointment.

Keyed anti-replay markers may remain for 48 hours without booking contact details or a readable management code. Cloudflare database recovery copies have a separate retention period, so deletion from the live service does not immediately erase every recovery copy. Merchant settings, device authorization, subscription bindings, and uploaded public images are retained for service operation until you request online account deletion. In version 1.0.2, use More → Bookings → Delete online account and data. Read the confirmation, type DELETE, and confirm. The service removes the merchant page and active booking data and revokes device access after accepting the request. Background cleanup removes all merchant images, including replaced images, and retries storage failures. A restricted deletion receipt is retained for 24 hours for retry; minimal cleanup records remain longer if cleanup has not finished. Local client records, service plans, private iCloud data and Apple subscriptions are separate. Cancel subscriptions through your Apple account.

Pausing a booking page stops new requests but does not delete existing bookings or merchant data. Customers can continue using their management code for existing bookings. Uninstalling the app does not delete booking-service or iCloud data. For questions or requests concerning server-stored information, contact [email protected]; do not send a management code or unnecessary client information by email.

Export, local deletion, and contact

You can export CSV or a complete backup to a destination you choose and manage local records in the app. A backup may contain contacts, notes, sensitivities, and photos; keep it private. Removing a booking from the online service does not erase the merchant’s local client records, exported copies, or service history. The app is for beauty professionals and is not directed to children under 13. Privacy questions: [email protected].