SKINNY-MAID PRIVACY POLICY

Last updated: 2026-06-18

Operator: Skinny R&D
Contact email: contact@skinnyrd.com
Live URL of this policy: https://skinnyrd.com/policy/skinny-maid.html

1. TL;DR

Skinny-MAID is a small business app that reads the advertising
identifier (IDFA on iPhone, AAID on Android) on your device and, when
you tap “Submit MAID” and enter a valid organization code, sends that
identifier to a server operated by Skinny R&D on behalf of the
organization that gave you the code. The app contains no third-party
analytics, advertising, crash-reporting, attribution, push, or
data-broker SDKs. The only network call the app makes is the one
submission request to the Skinny R&D ingest server. Nothing is
collected from you until you tap “Submit MAID” and supply a valid
organization code.

2. Who this app is for

Skinny-MAID is intended for people who have been given an organization
code by an organization that has a contract or memorandum of
understanding (MOU) with Skinny R&D. The organization code is the gate:
without a valid code, the app cannot transmit any data to us. The
read-only display of your advertising identifier works without an org
code and stores or transmits nothing.

If you have not been issued an organization code by your organization,
the app has no useful function for you beyond displaying your device’s
advertising identifier locally. If you nonetheless attempt to submit
data, you are doing so in violation of our terms of service (see
Section 13).

3. What we collect

We collect different things depending on what you do in the app.

3.1 When you open the app (no submission)

The app reads your device’s advertising identifier (IDFA on iPhone,
AAID on Android) locally on your device and displays it on screen.
This read is performed by your device’s operating system using the
standard Apple ASIdentifierManager API on iOS or the Google
AdvertisingIdClient API on Android. The identifier is NOT sent to
Skinny R&D or to anyone else when you merely open the app.

3.2 When you tap “Submit MAID” with a valid organization code

If you tap the “Submit MAID” button while a valid organization code is
entered, the app sends a single HTTPS POST request to the Skinny R&D
ingest server containing:

The mobile advertising identifier (MAID): IDFA on iOS, AAID on
Android. This is a UUID-formatted value assigned by your device’s
operating system.
The organization code you typed in. This is a 16-character code
formatted as XXXX-XXXX-XXXX-XXXX that identifies which of our
customer organizations the submission is for.
The platform value: the string “ios” or “android”.

The Skinny R&D ingest server additionally observes, at the moment of
submission:

The source IP address of the request.
The User-Agent string of the HTTP request.

Both of these are immediately and irreversibly converted to SHA-256
hashes before any value is written to storage. The raw IP address and
raw User-Agent string are never stored and are not retained in any log
beyond the in-memory handling of that single request.

3.3 On iOS only

The app uses Apple’s App Tracking Transparency framework
(expo-tracking-transparency) to ask for your permission before reading
the IDFA. The permission decision (“allowed” / “denied”) is held
locally on your device and is NOT transmitted to Skinny R&D. If you
deny the prompt, the app will not read or submit your advertising
identifier.

3.4 Server-side

Once a submission is accepted, the Skinny R&D server stores the
following in a private PostgreSQL database for the customer
organization that issued the org code:

The mobile advertising identifier (MAID) in cleartext, as a UUID
The platform (“ios” or “android”)
The SHA-256 hash of the source IP address
The SHA-256 hash of the User-Agent string
The UTC timestamp at which the submission was received
A reference to the organization that owns the org code

Audit events (submission accepted, duplicate submission, invalid org
code attempts) are also recorded with the SHA-256 hash of the source
IP and a short, non-reversible context string. Raw IP addresses and
raw User-Agent strings are never written to the database or to any
log file.

4. What we do not collect

We do not collect, and the app does not transmit:

Your name, email address, phone number, or any contact information
Your precise or coarse location
Your photos, contacts, calendar, microphone, or camera data
Your purchase history or payment information
Your browsing history or search history
Your health, fitness, or biometric data
Any advertising or marketing identifiers beyond the single MAID
you explicitly submit
Crash reports, performance telemetry, or analytics events
Any data from third-party accounts you have not connected to the
app (the app does not connect to any third-party accounts)

5. Why we collect it

We collect the MAID only to fulfill the service that the customer
organization has contracted Skinny R&D to perform. Typical uses by
the customer organization include audience reporting, campaign
measurement, and other advertising analytics. The org code tells us
which customer organization the MAID belongs to, so it appears in
that organization’s private dashboard and not in anyone else’s.

We collect the hashed IP and User-Agent for two narrow purposes:

Abuse prevention: to detect and log repeated failed submissions
against the /api/v1/submit endpoint (rate limiting and audit).
Operational security: to investigate anomalous traffic patterns.

The hash is computed before storage so that the raw values cannot be
recovered from the database even by a Skinny R&D operator.

6. Third-party services

The app does not embed any third-party analytics, advertising,
attribution, crash-reporting, push-notification, or data-broker
software development kit (SDK) that reads or transmits your data.

The only third-party native module in the app that touches the
advertising identifier is @sparkfabrik/react-native-idfa-aaid
(version 1.2.0, MIT-licensed, open source). This module is a thin
wrapper that calls your device’s operating-system API
(ASIdentifierManager on iOS, AdvertisingIdClient on Android) and
returns the value to the app. It performs NO network I/O of any kind
in either its Swift or Kotlin source files.

Apple (on iOS) and Google (on Android) may receive standard
operating-system telemetry about your device, such as app installation
events. That telemetry is governed by Apple’s and Google’s own
privacy policies, not by this one.

7. Data storage and retention

Mobile advertising identifier (MAID): stored in a private
PostgreSQL database operated by Skinny R&D. Retained until you,
the customer organization, or we delete it (see Section 9). The
MAID is the data the service exists to deliver, and the retention
period is governed by the contract between the customer
organization and Skinny R&D.
Hashed IP address and hashed User-Agent: stored alongside each
submission and audit event for as long as the corresponding MAID
is retained. The hashes are one-way SHA-256 and cannot be reversed
to recover the raw values.
Raw IP address and raw User-Agent: never stored. They exist only
in the in-memory handling of the single HTTP request that receives
the submission and are immediately hashed and discarded.
Organization code: held in memory for the duration of the
submission and stored only as a foreign-key reference to the
organization that owns it; the org code is not stored in cleartext
in the submissions table itself.
App-side storage: the app does not write the MAID, the org code,
or any submission data to local storage on your device.

We may retain data for a longer period if required to comply with a
legal obligation, defend a legal claim, or honor a contractual record-
keeping requirement under the customer organization’s agreement with
Skinny R&D.

7.1 Deletion requests

Customer organizations can request deletion of ANY OR ALL of the MAIDs
we hold under their org code at any time. Send the request to
contact@skinnyrd.com. We will respond and complete the deletion within
72 HOURS of receipt of the request.

NOTE: requests received on Friday evening do not count Saturday or
Sunday toward the 72-hour window — the 72-hour clock is paused over
the weekend and resumes on the next business day. Only business days
count.

If you as an individual end-user see an error in a submission you made
(for example, the wrong MAID is on file, or your org code has
changed), please contact your organization first. Your org code may
have changed, and your organization is the party that will communicate
with us to correct the issue.

8. Sharing and subprocessors

We do not sell your data. We do not share it with advertisers, data
brokers, or marketing networks.

MAIDs submitted under your org code are not exposed to your
organization, to any other organization, or to any third party through
a dashboard, web interface, or self-service export tool. No
organization can even see their own dashboard. ONLY Skinny R&D has
access to the server database, and even that access is only available
from Skinny R&D hardware.

We use the following subprocessors to operate the service:

Skinny R&D hosting (the PostgreSQL database, the ingest API, and
the admin dashboard). Skinny R&D personnel with database or server
access may technically be able to view stored MAIDs as part of
operating the service. Such access is logged and limited to staff
with a defined operational need.
ngrok (HTTPS transport tunnel from your device to the Skinny R&D
ingest server). ngrok forwards encrypted traffic and does not see
or store the contents of the request body.

If we are required to disclose data by law, court order, or to enforce
our terms of service, we may do so. We will challenge requests that
are overbroad or that lack legal basis to the extent we are permitted
to do so.

9. Your rights and how to exercise them

Because Skinny-MAID is a business-to-business service used by people
acting under contract with Skinny R&D, the rights below are honored
under that contract rather than under a generic consumer framework.
In practical terms, that means:

Access: you can ask us what MAIDs we hold under your org code
and the related metadata.
Correction: if a MAID we hold is wrong (for example, it was
submitted from a device that is no longer yours), you can ask us
to correct or remove it.
Deletion: you can ask us to delete the MAIDs we hold under your
org code at any time. We will action the request within a
reasonable timeframe and confirm completion in writing.
Withdrawal of consent: you can stop using the app and remove it
from your device. Future submissions can be prevented by revoking
the org code with your organization.

To exercise any of these rights, email contact@skinnyrd.com from the
address your organization has on file, or ask your organization’s
administrator to make the request on your behalf. We may need to
verify your identity or your relationship to the org code before
acting on a request, to prevent unauthorized deletion of another
organization’s data.

If your request is denied because we reasonably believe it is not
being made by an authorized person, we will explain why in writing.

10. Children’s privacy

Skinny-MAID is not directed at children. The app is not intended for,
and may not be used by, anyone under 18 years of age. We do not
knowingly collect personal data from anyone under 18. If you believe
that someone under 18 has submitted a MAID through the app, contact
us at contact@skinnyrd.com and we will delete the submission.

11. Security

We use reasonable technical and organizational measures to protect
the MAID and the related data we hold. These measures include:

HTTPS encryption in transit from your device to the Skinny R&D
ingest server (via the ngrok tunnel)
A shared API key (X-API-Key) that the mobile app must present
with every submission
SHA-256 one-way hashing of the source IP address and the
User-Agent string before they are written to storage
PostgreSQL unique constraints that reject duplicate
(organization_id, MAID) rows at the database level
Rate limiting on the submission endpoint to slow brute-force
attempts
Restricted, logged access to the database for Skinny R&D staff
with a defined operational need

No method of transmission over the internet or method of electronic
storage is completely secure, so we cannot guarantee absolute
security.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we
will revise the “Last updated” date at the top of this page. For
material changes, we may also notify you by:

Posting a notice in the app at next launch
Contacting the customer organization that issued your org code

Continued use of the app after a material change becomes effective
indicates that you accept the updated policy.

13. Terms of service relationship

By tapping “Submit MAID” and sending a submission to Skinny R&D, you
confirm that:

You have been issued the organization code you entered by the
organization you believe issued it
The submission is made under, and is governed by, the existing
agreement (contract or memorandum of understanding) between your
organization and Skinny R&D
You are authorized by your organization to make the submission

If you have not been issued an organization code and you nonetheless
attempt to submit data to Skinny-MAID, you are doing so in violation
of our terms of service. We do not extend the protections in this
Privacy Policy to people who are attempting to submit data without
authorization, including by guessing, fuzzing, or brute-forcing
organization codes, or by reverse-engineering the app to bypass
client-side validation. We may log, ignore, or report such attempts,
and we reserve the right to take technical and legal action in
response.

14. Contact

If you have any questions or requests regarding this Privacy Policy
or our data practices, contact us at:

Email: contact@skinnyrd.com
Operator: Skinny R&D

End of Skinny-MAID Privacy Policy, version dated 2026-06-18.