Privacy Policy

1. Scope and important fax privacy information

Fax Studio lets users prepare, send, receive, store, export, and delete fax documents. A fax may contain personal, confidential, financial, health, or other sensitive information selected by the user. We process that content to provide the feature you request; we do not require you to include sensitive data.

When you send a fax, the document and related telephone numbers must be transmitted through telecommunications providers to the destination fax number. The recipient, a destination fax machine, and downstream telecommunications providers may keep copies outside our control. Deleting data from Fax Studio cannot recall a fax already transmitted or delete copies held by recipients or third parties.

Fax Studio is not offered as a HIPAA-compliant service, and we do not currently offer a Business Associate Agreement. Do not use the Service for protected health information when your organization requires a HIPAA-compliant service or a Business Associate Agreement.

2. Data we collect

Data you provide or choose

• Fax documents and content: PDFs, selected images, camera scans, cover-page text, sender details, signatures applied to a document, and other content you choose to send, receive, save, or export.
• Fax and number data: destination and sender fax numbers, a number assigned to you, country or area-code choices, direction, timestamps, page counts, transmission status, delivery or failure information, and document identifiers.
• Selected contact information: if you use the contact picker, the App receives the contact details you select. Fax Studio does not upload your entire address book.
• Support communications: your email address and any information, attachments, or diagnostic details you choose to include when contacting us.
• Rights requests: information needed to locate your account, verify the request, and document our response.

Account, device, and technical data

• Service account data: Fax Studio creates an internal anonymous account and account identifier without requiring a customer login form. Authentication sessions and installation identifiers are stored securely on the device.
• Security and anti-abuse data: App Attest keys and proofs, one-use challenges, request identifiers, idempotency keys, hashed suppression markers, rate-limit or cooldown records, and security logs. These help verify genuine installations, prevent duplicate fax submissions, investigate abuse, and protect the Service.
• Network and platform log data: Our infrastructure providers automatically process information such as your IP address, request time, requested service route, response status, app or operating-system version, and limited diagnostic data. Fax Studio does not intentionally copy your IP address into its application database. We design our own logs to exclude fax documents, credentials, and secrets.
• Push notification data: Apple Push Notification service and Firebase Cloud Messaging tokens, device platform, notification status, and delivery-attempt metadata. If notifications are enabled, an alert may include a fax number and delivery, failure, or receipt status, but not the fax document itself.
• Usage and analytics data: app launches, sessions, screen or tab names, feature interactions, fax-submission and outcome events, number-setup events, device and app information, and approximate network-derived location. Our custom analytics events do not include fax content, fax numbers, contact details, document filenames, backend record identifiers, or failure-message text.

Website data

iphonefax.app is currently a static informational website. It does not use advertising technology, analytics scripts, account forms, or marketing cookies. Our hosting provider may nevertheless create standard server logs containing data such as an IP address, request time, requested page, browser or device information, and error information for security and reliable delivery.

3. Data processed on your device

Drafts, imported documents, saved sender details, and a saved signature are stored in the App on your device. Preparing, editing, signing, and exporting documents occurs on your device. A prepared PDF is uploaded to our service only when you choose to send it. Incoming fax documents are downloaded when needed for viewing, sharing, or export.

Camera, Photos, Files, Contacts, Face ID, and notification access are controlled by iOS. Fax Studio receives only the content or result needed for the feature you request. Apple performs biometric matching; we do not receive or store your facial or fingerprint data. You can change permissions in iOS Settings.

4. How and why we use data

We do not use fax documents to train artificial-intelligence models. We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We do not make decisions that produce legal or similarly significant effects using solely automated processing.

5. Who receives data

We disclose data only as needed to provide and protect the Service, follow your instructions, or comply with law. Recipients may include:

• Supabase: authentication, database, protected document storage, serverless functions, and service infrastructure.
• Telnyx and telecommunications providers: fax-number search and assignment, fax transmission and receipt, delivery events, and provider-side records needed to operate those services.
• Google Firebase: app analytics and Firebase Cloud Messaging used to route optional push notifications.
• Apple: App Store distribution, operating-system services, App Attest, and Apple Push Notification service.
• Smartlook: product analytics and session replay configured in wireframe mode.
• Website hosting and operational providers: hosting, security, support, and professional advisers where needed.
• The recipient you choose: the destination fax service, fax machine, organization, or person receives the content you direct us to transmit.

We may also disclose information when reasonably necessary to comply with law or a valid legal process; protect users, third parties, our rights, or the security of the Service; investigate fraud or abuse; or complete a merger, acquisition, financing, reorganization, or sale of relevant assets, subject to applicable safeguards.

6. Analytics, session replay, and website technology

Firebase Analytics collects standard app and session events and a small set of feature events. Fax Studio disables IDFA collection, IDFV collection, automatic screen reporting, ad-network registration, and ad-personalization signals in its Firebase configuration.

Smartlook may record how users interact with the App to help us diagnose problems and improve usability. We configure Smartlook to use wireframe rendering so fax documents, signatures, and contact text are not sent as screen pixels, and we do not attach custom user identifiers or fax-content payloads. Despite this configuration, analytics providers may process technical data such as device, session, network, and interaction information under their applicable terms.

Fax Studio does not display third-party advertising and does not use the Apple advertising identifier. The current iphonefax.app website does not use analytics or session replay.

7. Retention and deletion

We keep information only for as long as needed for the purposes described above, subject to operational, legal, security, and provider constraints:

• Fax history and documents: server-side fax records and available sent or received documents remain until you delete an eligible fax or delete your account. There is currently no automatic expiry for active fax history. A fax that is still sending or has an uncertain provider outcome must be resolved before deletion can finish.
• Local data: drafts and saved details remain on your device until you remove them, delete your account, or remove the App. Re-downloadable document caches, unused temporary files, and exports are eligible for cleanup after 24 hours.
• Account deletion: accepted deletion requests block new activity, release your personal fax number, remove account records and protected documents, and delete the service authentication identity after pending operations are resolved. A deletion-status receipt that contains no former account ID, document, or number data expires after 90 days.
• Notifications: registrations not seen for more than 60 days are excluded from delivery. Completed push-delivery records older than seven days are eligible for cleanup.
• Security records: limited installation-verification, cooldown, idempotency, and hashed late-event suppression records may remain as needed to prevent abuse, duplicate transmissions, or reappearance of deleted records.
• Analytics and support: analytics providers retain data according to our configured account settings and their applicable terms. Support and legal records are retained as needed to respond, resolve disputes, and meet legal obligations.

Deletion from our active systems does not delete recipient copies. Provider billing, security, legal, or backup records may remain for the provider's applicable retention period. Backup deletion may not be immediate, and deletion markers may be reapplied if a backup is restored.

You can export your account in the App under Info → Account data → Export account. You can delete individual eligible faxes from their detail screen and request irreversible account deletion under Info → Account data → Delete account.

8. Security

We use measures intended to protect personal data, including encrypted network connections, protected document storage, short-lived access paths, account-level access controls, server-side ownership checks, Keychain storage for credentials, App Attest for supported security flows, authenticated provider callbacks, and deletion workflows with retry and reconciliation. The optional App Lock uses Face ID, Touch ID, or the device passcode and obscures the App in the app switcher.

No system is completely secure. You are responsible for securing your device, reviewing the recipient number before sending, controlling notification previews in iOS, and protecting exported or shared copies.

9. International transfers

Our providers and fax networks may process data in the European Economic Area, the United States, and other countries. A fax may be routed to the country associated with the recipient number. Where applicable law requires safeguards for an international transfer, we use an approved legal mechanism or require the relevant provider to do so, such as an adequacy decision or standard contractual clauses.

10. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and lodge a complaint. These rights can be subject to legal exceptions and identity verification.

• Use the App's account export and deletion controls where available.
• Change Camera, Photos, Contacts, Face ID, and notification permissions in iOS Settings.
• Contact support@iphonefax.app for a privacy request or to object to analytics processing.

Withdrawing consent does not affect processing already carried out lawfully. Some data is necessary to transmit faxes, maintain an account, or protect the Service; if that processing stops, the related feature may no longer work.

If the GDPR applies, you may complain to your local supervisory authority or to the Office for Personal Data Protection of the Slovak Republic.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data directly from a child under 16. If you believe a child has used the Service contrary to this section, contact us so we can investigate and take appropriate action.

12. Changes and contact

We may update this Privacy Policy to reflect changes to the Service, providers, or law. We will post the updated policy here, change the date above, and provide additional notice when required by law. Material changes apply prospectively.