Skin Care AI · Last updated 8 October 2026
This policy describes what the Skin Care AI iOS app actually does, not a summary of it. The app shows the same description on its own “Where your data goes” screen, and the two are kept in step: if the behaviour changes, both change with it.
The controller of the data described here, in the sense of Article 4(7) GDPR, is:
Adem İnce
Kınalıada Mah. Manastır Sk. No: 10/1, İç Kapı No: 15
Adalar / İstanbul
Türkiye
Privacy questions and requests: support@skincareai.beauty
Each skin scan sends a single front-facing photograph to our analysis service hosted on Google Cloud Run in Frankfurt. The service passes it through OpenRouter, Inc. to Google LLC’s Gemini 3.7 Flash AI model, which reads it and returns your score and notes. Those are the third parties; there are no others in this path. The head-turning ring shown during a scan is a guidance animation: it captures nothing, stores nothing and transmits nothing. Exactly one frame per scan leaves the device.
None of this happens until you say so. The first scan is behind a consent you give explicitly, and the page you are reading now is linked from it. You can revoke that permission later in the app, and scanning stops when you do.
Scanning a product barcode sends the frame it was read from the same way, except that it is read by Gemini 3.1 Pro, so the label can be identified rather than guessed at from the number.
Neither photograph is stored by our service or by us. Both are held only for as long as the request takes to answer, and neither is written to any log.
An identifier generated the first time the app runs. It counts scans against a daily limit so a single copy of the app cannot run up the bill. It is not your name, your device identifier or your Apple Account. It is stored in the iOS keychain, so it stays on that phone: it is never included in a backup and never moves to another device. It does survive deleting and reinstalling the app, which is deliberate — otherwise the daily limit could be reset by reinstalling.
Sent with each request so the report comes back in the language you read, and so product suggestions can name what is available where you are. The country is the two-letter region from your device settings. The app never asks for or uses your location.
Nothing is reported. The app was built able to tell our own service three things — that a scan failed, that the upgrade screen was shown, and that a purchase completed — so that failures could be noticed. That service does not accept them. The endpoint is not switched on, the attempts are refused, and no count of any kind is recorded about anyone.
We describe it here rather than staying silent because the ability is in the app and an attempt does leave the device, even though nothing at the other end listens. If it is ever switched on, this page changes before it does, and the design it would run under is already fixed: the three counts carry no identifier at all, not even the installation identifier, so two counts from one phone could not be told apart from two counts from two phones. There is a test that fails the build if an identifier is ever added to one.
When a suggested product is shown, the app asks Open Beauty Facts — a public, open database of cosmetics — for that product’s photograph. The query carries only the product’s name. To fill the product shelf, the app asks our service to search a public retailer catalogue; that query carries only category and skin-concern names from a fixed list, plus the same two-letter country region. Neither carries anything about you, your scan or your device.
Your scores, your history, the tasks you have checked off and your intake answers stay on the phone. Of the intake answers, only your skin type and your goal are sent with a routine request so the plan matches them; the safety answers are not sent — a request carries only whether the routine must avoid certain ingredients, never the reason.
Your latest scan photograph stays on the phone, is replaced by the next scan, and is deleted after 30 days without one. It is deliberately excluded from your device backup, so it never reaches iCloud. Photo history is a separate feature and is off by default.
No name, email address or phone number. No contacts, calendar, location or advertising identifier accompanies a photograph, skin score, routine request or intake answer. Meta never receives your photograph, scores, findings, concerns, routine, intake answers or the random installation identifier used for scan limits. What Meta and RevenueCat do receive — app and purchase events, device identifiers and your IP address — is described below, and none of it is skin data.
| Who | What they process | Where |
|---|---|---|
| Google Cloud (Cloud Run, Firestore) | Hosts our analysis service. Handles the photograph in transit only; stores the installation identifier with a daily scan count. | europe-west3 (Frankfurt, Germany) |
| OpenRouter, Inc. | Routes the analysis request to the AI model named below. States that it does not use inputs or outputs for model training. | United States |
| Google LLC — Gemini 3.7 Flash (skin scans) and Gemini 3.1 Pro (barcode reads, routines), reached through OpenRouter | Reads the photograph and returns the analysis. Every request we send carries a requirement that it be routed only to a provider that does not retain or train on what it receives; if none qualifies, the request fails rather than being routed to one that would. | United States and other Google processing regions selected through OpenRouter |
| Meta Platforms, Inc. (Facebook SDK and Conversions API) | Receives app-install, app-open, first-completed-scan (the fact only, never its result), subscription and purchase events for advertising measurement and optimisation, whether or not you allow tracking — from the app directly, and from RevenueCat for purchases and renewals. With them come Meta’s own anonymous app identifier, the device’s vendor identifier and your IP address. A purchase event includes its amount and currency. The advertising identifier (IDFA) is shared only if you allow tracking. Meta never receives a photograph, skin result, routine or intake answer. | Per Meta’s own terms and privacy policy |
| RevenueCat, Inc. | Our subscription provider. Receives the App Store record of your subscription purchases and renewals, the device’s vendor identifier, your IP address, Meta’s anonymous app identifier and, if you allow tracking, the advertising identifier; forwards purchase and renewal events to Meta as described above. It never receives a photograph, skin result, routine or intake answer. | United States |
| TikTok (TikTok App Events SDK) | Receives app-install, app-open, first-completed-scan (the fact only, never its result) and purchase events for advertising measurement and optimisation, whether or not you allow tracking, directly from the app. With them come TikTok’s own anonymous app identifier, device information and your IP address; a purchase event includes its amount, currency and the subscription plan bought. The advertising identifier (IDFA) is shared only if you allow tracking. TikTok never receives a photograph, skin result, routine or intake answer. | Per TikTok’s own terms and privacy policy |
| Apple | Handles the subscription. We never see your payment details — only whether a subscription is active. | Per Apple’s own terms |
The analysis service itself runs in Frankfurt, Germany. Google LLC’s Gemini models, reached through OpenRouter, may operate outside the EEA, so a photograph may be transferred outside the EEA for the seconds the request takes. OpenRouter’s privacy policy states that where information is transferred outside the EEA or UK it relies on adequacy decisions of the European Commission and on Standard Contractual Clauses approved by the Commission; that is the basis this transfer rests on.
A facial photograph processed for cosmetic analysis is processed on the basis of your explicit consent (GDPR Article 6(1)(a)). The app asks for that consent before the first photograph leaves the device and tells you what will happen; you can withdraw it at any time in Settings, after which no further photograph is sent.
The installation identifier and the daily count are processed on the basis of our legitimate interest in preventing abuse of a paid service (Article 6(1)(f)).
Not yet settled: advertising measurement. App, purchase and renewal events, device identifiers and the IP address reach Meta and RevenueCat whether or not tracking is allowed. The legal basis for that processing, and whether it needs consent in the EEA, is with legal review.
Whether this is biometric data under Article 9. It is not, and the reason is the distinction Article 4(14) turns on: biometric data is personal data processed for the purpose of uniquely identifying a natural person. This app performs cosmetic analysis and identifies nobody. It does not match a face against any record, does not recognise a returning face, and does not link a face to a person — there is no template, no gallery and no identity to link to. That position was put to a lawyer and confirmed.
Two things follow, and neither is softened by the above. The photograph is still sensitive in the ordinary sense and is treated that way throughout this policy. And in the United States the definitions are broader than Article 4(14): several state laws call a facial image biometric whether or not anyone is identified, so the US section below applies in full regardless of how the question is answered here.
Photographs are not retained: they exist only for the duration of the request, and are never written to a log.
Our service keeps, per installation identifier, the current day, a count of requests made that day, and the time it was last seen. That record is not linked to a person. It is deleted automatically 90 days after the last request from that installation — the database removes it on its own, without anyone having to run anything.
The app is not intended for anyone under 16, and asks you to confirm you are 16 or older before the first photograph is sent.
We do not knowingly collect anything from a child. Sixteen is the default age in Art. 8 GDPR at which a person can consent to an information-society service on their own; we apply it everywhere rather than lowering it per country, because the app does not know where its user is and would rather ask too much than too little. The declaration is a statement you make, not a verification we perform — we have no way to check it and do not attempt one, which is itself a reason we keep so little.
If you believe a child under 16 has used the app and sent a photograph, write to support@skincareai.beauty. Photographs are not retained by the service, so there is usually nothing to delete beyond the installation record — and that we will delete on request.
The controller is established in Türkiye, outside the EU. That means there is no single "lead" supervisory authority for this app in the sense of Article 56 GDPR — the one-stop-shop applies to controllers established in the Union, and we are not one.
What that gives you is simpler, not weaker: under Article 77 you complain to the authority of the country you live or work in, and it is competent. For the languages this app ships in, that is:
| Country | Authority |
|---|---|
| Germany | Your own Land's authority, or the BfDI — bfdi.bund.de |
| Spain | Agencia Española de Protección de Datos (AEPD) — aepd.es |
| France | Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr |
| Italy | Garante per la protezione dei dati personali — garanteprivacy.it |
| Portugal | Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt |
| Netherlands | Autoriteit Persoonsgegevens (AP) — autoriteitpersoonsgegevens.nl |
| Any other EEA country | Your national authority; the full list is at edpb.europa.eu |
If you are in the United States, the state routes are in the US section below. Complaining costs you nothing and does not affect your use of the app.
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we rely on your consent you may withdraw or revoke that consent at any time (Art. 7(3)), and doing so does not affect the lawfulness of what was processed before you did.
Because almost everything the app holds is on your own device, most of these you can exercise yourself and immediately: Settings → Data → Delete all removes every report, routine and photograph from the phone. In the same place you can revoke permission for photographs to leave the phone; after that no scan is sent, because there is nothing to send it to.
What that does not reach is the installation record on our service. To have that erased, or to exercise any of the rights above, write to support@skincareai.beauty. We answer within one month, as Art. 12(3) requires.
A scan that has already been answered cannot be recalled.
You also have the right to complain to a data protection supervisory authority in your country.
You are under no statutory or contractual obligation to provide any of it. Giving a photograph is voluntary and it is the only way the analysis can work; if you decline, the consequence is simply that scanning does not run. Nothing else in the app is withheld for it.
The reading is produced automatically, by a model, from one photograph. It scores cosmetic qualities and proposes a skincare routine. It makes no decision that produces legal effects for you or that similarly significantly affects you, in the sense of Art. 22 GDPR — it does not decide about credit, employment, insurance, health or access to any service, and nothing you are entitled to depends on what it says. You can ignore it, scan again, or delete it.
We have not appointed one. The thresholds in Art. 37 GDPR are not met: the controller is an individual working alone, not a company, and the core activity is not the large-scale monitoring of people. Data protection questions go to support@skincareai.beauty, which reaches the controller directly.
The sections above describe what happens to everyone. US state law adds rights on top of them, and a photograph of a face is treated as biometric and as sensitive under most of those laws — so this app sits inside the strictest part of each. Nothing here takes anything away from what is written above.
We have never sold personal information. The app includes the Facebook SDK and the TikTok App Events SDK, and uses RevenueCat, to measure and optimise advertisements. TikTok receives the same kinds of app events as Meta, directly from the app, under the same rule for the advertising identifier. Meta receives app-install, app-open, first-completed-scan (that it happened, never what it found), subscription and purchase events, Meta’s anonymous app identifier, the device’s vendor identifier and your IP address whether or not you allow tracking; a purchase event includes its amount and currency. Only if you allow tracking through Apple’s App Tracking Transparency prompt on the upgrade screen does Meta also receive the advertising identifier, and you can withdraw that permission later in iOS Settings. Refusing tracking does not change your scan allowance, subscription access, product shelf or routines. Neither Meta nor TikTok ever receives skin or health data.
Not yet settled: “sharing” under the CCPA. Sending these events to Meta and TikTok for advertising may be “sharing” for cross-context behavioural advertising, which carries an opt-out duty. With legal review.
In the last twelve months we collected these categories, for the purposes already described and for no others:
| Category | What it is here | Kept for |
|---|---|---|
| Biometric information (sensitive personal information) | One facial photograph per scan | Not stored by us at all — the length of the request. Your own copy: replaced by the next scan, deleted after 30 days. |
| Identifiers | A random installation identifier — not your name, device id or Apple Account | 90 days after the last request, deleted automatically |
| Internet or network activity | A daily scan counter kept against that identifier; Meta and TikTok receive app-install, app-open and first-completed-scan events with their own anonymous app identifiers, device identifiers and the IP address, and the advertising identifier only if tracking is allowed | Scan counter: 90 days with the identifier. Meta and TikTok events: according to their privacy policies. |
| Commercial information | A verified purchase amount and currency, and subscription and renewal events, are sent to Meta — by the app and through RevenueCat — and to TikTok by the app, for advertising measurement | According to Meta’s, TikTok’s and RevenueCat’s privacy policies |
| Geolocation | None. The two-letter region from your device settings is not location and is never resolved to a place. | Not kept |
You have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing (there is no sale; advertising sharing can be disabled through iOS tracking permission), to limit the use of sensitive personal information, and to be free from discrimination for exercising any of them — we do not offer a worse price or a lesser app to anyone who does.
On limiting sensitive personal information: the only sensitive category here is the photograph, it is used solely to perform the service you asked for, and it is never used to infer characteristics about you. You can limit it completely and at any moment by withdrawing photo permission in the app, which stops scans being sent at all.
An authorised agent may make a request on your behalf; we will ask for proof of that authority. We answer within 45 days and will say so if we need the further 45 days the law allows.
Illinois requires a publicly available written retention schedule for biometric identifiers and biometric information, and a rule for destroying them. This is it, and it is deliberately shorter than the law's outer limit:
Those states treat a facial photograph and a cosmetic skin score as consumer health data and require their own separate notice. It is here: Consumer Health Data Privacy Policy, and it is linked from our home page as the My Health My Data Act requires.
You have the right to confirm and access what we hold, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects — none of which we do. Where consent is required before processing sensitive data, including biometric data, we ask for it before the first photograph and not after.
Some of those states give you a right to appeal a refused request. Reply to our answer and we will reconsider it, tell you the outcome in writing, and give you your Attorney General's complaint address if we still say no.
The app is not directed to children and we do not knowingly collect anything from anyone under 16, which is stricter than the 13 that US federal law sets. See the age section above.
Write to support@skincareai.beauty. Most of it you can also do yourself in seconds: delete everything on the profile screen, and the photo-permission switch beside it.
The controller is established in Türkiye, so Law No. 6698 on the Protection of Personal Data (KVKK) applies to this processing, and this section is the disclosure Article 10 asks for. Everything above is also true; this names it in KVKK's own terms.
| KVKK | Here |
|---|---|
| Data controller | Adem İnce, at the address above |
| What is processed | A facial photograph per scan; a random installation identifier and its daily count; your language and country region; your skin type, goal and a yes-or-no ingredient-exclusion flag |
| Purpose | To produce a cosmetic reading of the skin and build a skincare routine from it, and to stop one copy of the app running up the bill |
| Legal ground | Your explicit consent (açık rıza) for the photograph, given in the popup shown before upload through a separate “Agree & Send My Photo” action; legitimate interest for the installation counter |
| Method of collection | Electronically, from the app on your own device, and from nowhere else |
Transfer abroad. The photograph is sent to servers in Germany and read by an AI model in the United States, so every scan is a transfer abroad within the meaning of Article 9 KVKK. You may withdraw the consent that permits it at any time in the app, and scanning then stops.
One line not yet settled. Since the 2024 reform, explicit consent is the exception rather than the ordinary route for a transfer abroad, and the ordinary routes are an adequacy decision — the Board has issued none for the United States — or a standard contract notified to the Authority within five business days of signature. Which of those this app runs on is being settled, and this paragraph will say which.
Your rights under Article 11 — to learn whether your data is processed, to ask what was done with it, to have it corrected or erased, and to object — reach us at support@skincareai.beauty. You may also apply to the Personal Data Protection Board (KVKK) at kvkk.gov.tr.
This page changes when the app’s behaviour changes, and the date at the top records when. The app’s own “Where your data goes” screen is kept in step with it.