Privacy Policy
Last updated: 18 June 2026
This Privacy Policy explains how CB Scala Limited ("Spine", "we", "us", "our") — a company registered in Malta under registration number C 115983, with registered office at 47 Triq Ghajn Rasul, San Pawl Il-Bahar, SPB 3673, Malta (VAT MT32857612) — handles information in connection with the Spine mobile application (the "App") and the website spineapp.app (the "Site").
For the purposes of the EU General Data Protection Regulation (GDPR) and Maltese data protection law, we are the data controller.
If you have any questions, contact us at support@spineapp.app.
Our core principle: your data stays on your device
Spine is built local-first. Your posture photos, scans, and results are captured and processed entirely on your device. We never upload them, never store them on our servers, and never have access to them. If you uninstall the App, that data is deleted with it.
What we collect — and what we don't
Posture photos and scan results. When you scan your posture, the photo and the resulting measurements (e.g. forward-head angle, posture score) are created and stored only on your device. They are not transmitted to us or to any third party. We cannot see them.
No account. You don't create an account to use the App. We don't ask for your name, email, or sign-in to deliver the core experience.
Subscription information. Paid subscriptions are processed through Google Play Billing and managed via our subscription provider, RevenueCat. To operate subscriptions and unlock premium access, RevenueCat processes a randomly generated app-user ID, your purchase and transaction history, and device/app identifiers. We never receive your payment card details — those are handled solely by Google.
Product analytics. We use PostHog to understand how the App is used so we can improve it. PostHog records in-app usage events (such as which screens you open and which features you use), associated with a random, app-generated identifier. It does not receive your posture photos or scans. You can opt out of analytics in the App's settings.
Crash and error reporting. We use Sentry to detect and fix problems. When the App crashes or errors, Sentry receives diagnostic information (such as the error, your device model, and operating-system version). It does not receive your posture photos or scans.
Advertising and attribution. We do not currently use any advertising or attribution SDKs in the App. If we introduce them in future (for example, to measure marketing campaigns), we will update this policy and obtain your consent where required before any advertising identifier is processed.
Website waitlist. If you submit your email address on the Site, we use it solely to contact you about Spine's launch and updates. You can unsubscribe at any time.
Support. If you email support@spineapp.app, we process your message and email address to respond to you.
A note on health-related data
Posture information can be considered health-related. Because it is processed only on your device and is never transmitted to us, we do not collect or hold any special-category (health) data on our systems.
How we use information
- To provide and operate the App and its features.
- To process and manage your subscription and premium access.
- To keep the App stable and to understand and improve how it is used.
- To respond to your support requests.
- To comply with legal obligations.
Legal bases (GDPR)
- Performance of a contract — to deliver the App and your subscription.
- Legitimate interests — to keep the App secure and stable (crash reporting) and to understand and improve how it is used (product analytics), balanced against your rights. You can opt out of analytics in the App.
- Consent — for any future advertising/attribution that requires it. You can withdraw consent at any time.
Who we share information with
We do not sell your data. We rely on a limited set of processors:
- Google — app distribution and Google Play Billing.
- RevenueCat — subscription management.
- PostHog — product analytics.
- Sentry — crash and error reporting.
- Cloudflare — Site hosting and email routing.
International transfers
Some providers may process data outside the EU/EEA (for example, in the United States). Where that is the case, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses. Where a provider offers EU-based hosting, we use it.
Data retention
- On-device data (photos, scans, results): kept until you delete it or uninstall the App.
- Subscription records: retained by our providers for as long as needed to operate subscriptions and meet legal/accounting obligations.
- Analytics and crash data: retained for a limited period in line with the providers' settings.
- Waitlist and support emails: kept until you unsubscribe or ask us to delete them.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to certain processing, and to withdraw consent at any time. To exercise these rights, email support@spineapp.app.
You also have the right to lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC) — idpc.org.mt.
Children
Spine is not directed to children under 16, and we do not knowingly process data from anyone under 16.
Security
We take reasonable technical and organisational measures to protect information. Because the most sensitive data (your photos and scans) never leaves your device, the App's design itself minimises risk.
Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes will be highlighted in the App or on the Site.
Contact
CB Scala Limited, 47 Triq Ghajn Rasul, San Pawl Il-Bahar, SPB 3673, Malta — support@spineapp.app