Client Memory · Effective October 21, 2026

Privacy Policy

This policy covers Client Memory: Beauty Book, including its optional Personal Sync, online booking, and Square payment features. The core client book is stored on your device. Optional online services send the information needed for the feature to Apple, Square, or our Cloudflare-hosted booking service; they do not upload your complete client book to the booking service. Some features described here arrive with app updates and apply once your installed version includes them.

Client records, photos, and local tools

The app handles names, contacts, preferences, tags, sensitivities, service history, formulas, income amounts, product and lot numbers, retail refill reminders, waitlist entries, aftercare notes, photos, consent, plans, and check-ins that you choose to record. Records use protected local storage. Imported photos are re-encoded without source metadata. App Lock uses Apple’s Face ID or device-passcode authentication; the app receives no biometric data. Notifications use general wording rather than client details.

If you scan a product barcode or lot label, the camera image is read on your device with Apple’s VisionKit; only the recognized text you keep is saved, and camera images are not stored or sent anywhere. If you import clients from a spreadsheet file exported from another app, the file is read on your device and is not uploaded.

Optional personal iCloud sync

If you enable Personal Sync, your client book, including its photos and service records, is stored in your Apple Account’s CloudKit private database to sync your own devices. This is personal sync, not a shared staff account or team collaboration service. Apple operates iCloud under its terms and privacy policy. Turning sync off or uninstalling the app does not by itself erase the copy in iCloud.

Booking pages and customer requests

When a merchant creates a booking page, our service stores their display name, time zone, public service menu, page settings, an optional booking policy (for example, cancellation terms), and uploaded logo or background images. These page details and images are public. Only upload content you have permission to publish. Device identifiers, App Attest keys, subscription identifiers and verification status, push tokens, and whether the merchant’s installed app can receive inspiration photos support authorization, Pro access, and booking notifications. Apple handles subscription payments; we do not receive payment-card details.

Customers submit their name, phone number or email address, requested service, preferred time, and optional notes through the booking page. If the merchant has a booking policy, the request records that the customer accepted it, together with the policy text shown at that time. Where the merchant’s app supports it, customers may attach up to two optional inspiration photos; the service re-encodes them without source metadata, stores them encrypted and separately from the request, and deletes them once the merchant’s app receives the request, or when the booking ends if it is never received. Our service stores and delivers this information to the merchant and supports confirmation, changes, cancellation, and management-code lookup. Avoid including medical details, photos of other people, or other unnecessary sensitive information. Booking payloads and photos are encrypted in storage; this is not end-to-end encryption.

Optional Square payments

If you connect Square, the app signs in with Square directly and keeps the Square access credentials in your device’s Keychain; they are not sent to our booking service. To take a payment, the app either opens the Square app (including Tap to Pay on iPhone) or uses Square’s in-app payment tools, and sends Square the amount, currency, and a reference for the service. Square processes the card or contactless payment under its own privacy policy; we do not receive card details. Square’s in-app payment tools ask for location, Bluetooth, or microphone access for in-person payments and card readers, and include Square’s own fraud prevention, diagnostics, and usage analytics; Square may collect precise location, payment information, Square account and device identifiers, product interaction, crash, and performance data under its own privacy policy. To record a payment automatically, the app reads that payment’s status, amount, tip, location, and order or payment identifiers from Square. This payment history is kept on your device only and is not included in backups, Personal Sync, or our booking service.

Security and service providers

Cloudflare hosts booking processing and storage, and Turnstile helps prevent automated abuse. Requests reach Cloudflare with network information such as IP addresses; the verification service can process this information. Our application’s rate-limit records use keyed hashes rather than storing the original IP address. Limited error diagnostics support troubleshooting without intentionally recording booking text, photos, management codes, or authorization tokens. Cloudflare may also process operational logs under its service policies. Apple provides purchase verification, App Attest, iCloud, and push delivery. Square provides optional payment processing. We do not use advertising or cross-app tracking, and we do not add analytics of our own; the only third-party analytics in the app are the diagnostics built into Square’s payment tools described above.

Retention and deletion

Customer cancellation, merchant cancellation or completion, and rejection of an initial request remove the active online booking, its inspiration photos, its management-code record, and related delivery records. Pending requests expire at the requested time; scheduled cleanup provides a fallback. Confirmed bookings remain until the merchant completes or cancels them. An unhandled request to change a confirmed booking does not automatically delete the confirmed appointment.

Keyed anti-replay markers may remain for 48 hours without booking contact details or a readable management code. Cloudflare database recovery copies have a separate retention period, so deletion from the live service does not immediately erase every recovery copy. Merchant settings, device authorization, subscription bindings, and uploaded public images are retained for service operation until you request online account deletion. Use More → Bookings → Delete online account and data. Read the confirmation, type DELETE, and confirm. The service removes the merchant page and active booking data and revokes device access after accepting the request. Background cleanup removes all merchant images, including replaced images, and retries storage failures. A restricted deletion receipt is retained for 24 hours for retry; minimal cleanup records remain longer if cleanup has not finished. Local client records, service plans, private iCloud data, Square connections, and Apple subscriptions are separate. Cancel subscriptions through your Apple account, and disconnect Square in the app or in your Square account.

Pausing a booking page stops new requests but does not delete existing bookings or merchant data. Customers can continue using their management code for existing bookings. Uninstalling the app does not delete booking-service or iCloud data. For questions or requests concerning server-stored information, contact support@thothforge.com; do not send a management code or unnecessary client information by email.

Export, local deletion, and contact

You can export CSV or a complete backup to a destination you choose and manage local records in the app. A backup may contain contacts, notes, sensitivities, and photos; keep it private. Inspiration photos you save from a booking request become part of your local client records. Removing a booking from the online service does not erase the merchant’s local client records, exported copies, or service history. The app is for beauty professionals and is not directed to children under 13. Privacy questions: support@thothforge.com.