Privacy policy

Last updated: 2026-09-28.

Who we are. GlowSkin is made by Allison Chuang ("we"). Contact: acrmsupport@gmail.com. This policy covers the GlowSkin iOS app.

What GlowSkin collects and why

Data	Where it lives	Why	Optional?
Mobile phone number	Supabase Auth (our auth provider). Twilio delivers the one-time sign-in code.	Sign-in	Required
Face and spot photos	On your device, inside the app's private storage. See Face photos below.	Scoring and your timeline	Required for check-ins
A copy of each photo, briefly	Sent to our server and forwarded to our AI analysis provider to produce the score. Not stored by our server; deleted by the provider within 30 days. See Face photos below.	Skin analysis	Only when you take a photo
Scores, tips, tags, notes, routine, products	On your device.	The app's features	Required for the features
Chat messages and attached photos	On your device; each message you send is forwarded to our server and our AI analysis provider to generate the reply.	The Ask assistant	Only when you use Ask
Your first name	On your device.	Greeting you	Optional
Location (approximate, only while using the app)	Used once per hour to fetch weather, UV and air quality from Open-Meteo. Coordinates are sent to Open-Meteo, not stored by us.	Conditions context	Optional, off by default
Apple Health: sleep and workouts	Read on your device only when you allow it; a small daily summary is attached to that day's check-in and sent with the photo as context. Never written back to Health. GlowSkin never reads or sends menstrual or reproductive health data, and a Period tag you log stays on your device.	Insights	Optional, off by default
Notifications	Local reminders scheduled on your device. No push server.	Reminders	Optional
Purchase status	RevenueCat and Apple manage subscriptions. We receive an anonymous entitlement status, never your payment details.	Premium	Only if you subscribe
Diagnostics	Event names (for example "onboarding completed"), error messages and stack traces, app version and iOS version. No photos, no message text, no email.	Fixing crashes and understanding funnels	Always on; sent only when a backend is configured

We do not sell data, show ads, or use your photos to train models. Before you can use GlowSkin you are asked to accept the Terms of Service and this policy, which includes your explicit consent to processing your face photos and skin and health information as described here.

Face photos

GlowSkin's daily check-ins are photos of your face, and Ask lets you add close-up photos of your skin. This section explains exactly what happens to them.

What we collect. Only the photos you take in the app or choose from your photo library. GlowSkin does not use Face ID, the TrueDepth camera's depth data, face tracking, face geometry or any other biometric data, and it never tries to recognise or identify who is in a photo.
How we use them. Only to score your skin, show your own timeline, before-and-after and recap, mark areas of a photo in Dive deeper, and answer your questions in Ask. Never for advertising, identification or training AI models.
Where they are stored. In the app's private storage on your iPhone. GlowSkin version 1.0 does not upload your photos to cloud storage.
Who receives them. When you take or choose a photo, a copy is sent over an encrypted connection to our server, which passes it to our AI analysis provider, a service provider that processes it only on our behalf, to produce the analysis. Our server holds the photo in memory only until the reply is returned and does not save or log it. The provider does not use this data to train its models and deletes it within 30 days under its data retention policy, unless it must keep it longer to enforce its usage policies or comply with the law. No one else receives your face photos, and we never sell them.
How long they are kept. On your device until you delete the photo, delete your account or delete the app. On our server: not kept. At our AI analysis provider: up to 30 days.
How to delete them. Open a check-in and tap Delete this photo to remove one photo and its analysis, or use Settings › Account › Delete account to remove all of them.

Text messages (sign-in codes)

GlowSkin signs you in with a one-time code sent by SMS. You opt in by entering your own mobile number in the app and tapping "Text me a code"; we send one message per sign-in and nothing else. Message and data rates may apply. Reply STOP to opt out (you will then need another way to sign in) or HELP for help. Your mobile number and your SMS opt-in are used only to send these codes. They are never sold, shared with third parties for marketing, or used for promotional messages.

Not medical advice

Scores and tips are general skincare guidance produced by an AI model. They are not a diagnosis. See a dermatologist for anything painful, spreading or persistent.

Where data is processed

Our backend runs on Fly.io (San Jose, United States). Our AI analysis provider processes photos and chat on our behalf under its commercial terms and does not train on them. Supabase hosts accounts in the United States (AWS us-west-2, Oregon). Open-Meteo receives approximate coordinates for weather.

Your choices

Export. Settings › Account › Export my data gives you a JSON file with everything except the photo bytes.
Delete. Delete this photo on a check-in removes that photo and its analysis. Settings › Account › Delete account removes all photos and data from your device and deletes your account. This cannot be undone.
Turn things off. Location, Apple Health and reminders are all switches in Settings.
Email us at acrmsupport@gmail.com for any request about your data.

Retention

Data stays on your device until you delete it or the app. Your account is deleted when you delete it in Settings. Diagnostics logs are kept for 30 days. Our server does not retain photos or chat after the model reply is returned; our AI analysis provider deletes them within 30 days.

Children

GlowSkin is not for people under 16.

Changes

We will update the date at the top and, for material changes, tell you in the app.