Who we are
ShapeMax (“we”) is a physique-scoring service published by Hugo Baras, publication director. Contact: support@shapemax.fr. This policy explains how we process personal data when you scan, create an account, or browse the site.
Data we process
Photos: processed in memory only, never stored on disk, never sent to a third-party vision API. They can reveal the body and are treated as special-category data (GDPR art. 9) with your explicit consent. Derived data: geometric landmarks, scores, progression points, optional training plan, height/weight/sex/age/goal and optional weak zones you enter. Account: email and a hashed password if you register. Device: a random identifier used to limit the free scan to once per device. Password-reset tokens: hashed, expire after one hour. We do not generate a biometric identification template and we do not use photos to train models.
Legal bases
Consent (GDPR art. 6.1.a and art. 9.2.a) for photo processing and age confirmation (18+). Contract (art. 6.1.b) for the account, saved scores and paid reports. Legitimate interest (art. 6.1.f) for abuse prevention (one free scan per device, rate limits). You can withdraw consent by deleting your account; photos are already discarded at the end of each request.
Retention
Images: none. Scores and landmarks: until you delete your account, and in any case no more than 24 rolling months (automatic purge). Device identifier and “already scanned” flag: up to 13 months. Password-reset records: until used or expired (1 hour). Session token lives in your browser until you sign out.
Social feed
If you create a social profile, we store a public handle, display name, an optional compressed profile photo (small JPEG, never scan photos), published workout summaries (never photos), badges, streaks and rank names (never your numeric score), plus likes and comments you post. Followers you accept can see this content; you can block users and report posts or comments.
Your rights
Access, rectification, erasure, restriction, portability, and objection, under GDPR. Use Export my data and Delete my account on the Account screen, or email support@shapemax.fr. You may lodge a complaint with the CNIL (cnil.fr).
Transfers and processors
Inference runs on our API host in the European Union. Web payments, when enabled, are handled by Stripe. Exercise demonstration GIFs are loaded from jsDelivr (open-source exercise dataset); those requests do not include your photos or account. Transactional email (password reset) is sent through the SMTP provider configured on the server when mail is enabled. If error monitoring is enabled, Sentry receives crash reports without photos or session tokens. We prefer EU regions.