Privacy Policy

Last updated: June 22, 2026

Skinmaxx ("we", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights — especially if you are a minor.

1. Data We Collect

• Profile info: Age (date of birth for age verification), gender, skin type, skin concerns, sun sensitivity (entered by you).
• Photos: Face photos taken for skin analysis, food photos for diet tracking, product photos for scanning.
• Health data: Sleep hours (entered manually or from Apple Health, read-only), water intake, SPF usage.
• Usage data: Scan history, routine completion, diet logs, streak data.
• Device info: Language/locale, device model, iOS version, app version, and anonymous device identifiers used by our analytics and advertising SDKs.
• Analytics & advertising data: App events (e.g., app install, onboarding progress, paywall views, scan completion, trial starts, subscription purchases), ad click and campaign identifiers, and limited event details (e.g., source, plan, price/currency, and scan score) used for product analytics, measurement, ad attribution, and campaign optimization. Your Identifier for Advertisers (IDFA) is only collected if you grant permission via the iOS tracking prompt.

2. How We Use Your Data

• Face photos are sent to a third-party AI service (Google Gemini API) via our secure server for skin analysis. Photos are processed in real-time and are NOT stored on our servers. Google's API processes the image and returns a text analysis — refer to Google's AI Terms of Service for their data handling.
• Your profile, scan history, routines, photos, and logs are stored locally on your device. Pseudonymous analytics, subscription, and attribution records are processed by the services described below.
• We do not sell or rent your personal information.
• We use Mixpanel to understand how people move through the App, where users drop off, and which features are used. Mixpanel receives app event names, limited event details, and device/app metadata through an anonymous device identifier. We do not send photos to Mixpanel.
• We use the Meta (Facebook) SDK and TikTok Business SDK to measure ad performance — for example, to understand which ads brought users to the App and whether those users subscribed. This may involve cross-app and cross-website tracking, which is why iOS will ask for your permission via the App Tracking Transparency prompt. If you decline, we can still count anonymous app events but cannot link them to specific ad campaigns. You can change this choice any time in iOS Settings > Privacy & Security > Tracking.
• Some ads open a Skinmaxx redirect page before the App Store. The page records the ad click identifier and campaign labels and sends a web conversion event to TikTok before redirecting to the App Store. As part of that web request, TikTok may receive standard network metadata such as the IP address and browser user agent for its own attribution and security purposes. Skinmaxx does not store that metadata or use IP addresses, screen dimensions, browser configuration, or other device signals to fingerprint or probabilistically match the web click to a later App install. Post-install attribution is handled by Apple and the advertising SDKs under their own privacy controls.
• Your face photos, food photos, health data, full scan history, and profile answers are NEVER shared with Mixpanel, Meta, TikTok, or any advertising network. Only lightweight event names, limited event details (e.g., "paywall_viewed", "trial_started", "subscription_purchased", plan, price/currency, source, and scan score), device/app metadata, and, if permitted for ad attribution, your IDFA are transmitted.

3. Face Photo Processing — Important

When you use the skin scanner, a photo of your face is captured and transmitted to Google's Gemini AI API through our proxy server for analysis. By using the scan feature, you consent to this processing. Specifically:

• The photo is transmitted securely (HTTPS) to our server, which forwards it to Google's Gemini API.
• Our server does NOT store your photos — it acts only as a pass-through.
• Google processes the image to generate a text-based skin analysis and does not retain it beyond processing (per Google's API terms for paid tier usage).
• No facial recognition, face templates, or biometric identifiers are created or stored by Skinmaxx. The AI analyzes visible skin characteristics (pimples, redness, texture) — not facial geometry or identity.
• You can use the App without the scan feature. All other features work without submitting photos.

4. Minors' Privacy

Skinmaxx is designed for users aged 13 and up. We take additional care with teen users:

• We do not collect more data than necessary for the App to function.
• We do not knowingly sell personal information of users under 16.
• We default to the highest privacy settings for all users.
• We do not send marketing communications to users under 16 without opt-in consent.
• Parents or guardians may contact us at any time to review, modify, or delete their child's data.
• Users under 13 are blocked from using the App.

5. Apple Health

If you connect Apple Health, we only read sleep analysis data to display in the App. We do not write to, modify, or share your Apple Health data. This connection is optional and can be revoked at any time in your device's Health app settings.

6. Your Rights

• Access: You can view all your data within the App.
• Deletion: You can use "Delete All Data" in Profile to erase local data including scan history, photos, routines, and personal information. You may contact us for help with other privacy requests.
• Opt-out: You can use the App without the AI scan feature, without diet tracking, and without connecting Apple Health.
• Do Not Sell: We do not sell your personal information. If this changes, we will provide a clear opt-out mechanism.
• Data portability: Your profile, routines, logs, and scan history are stored locally and accessible within the App.

7. Data Security

We use industry-standard security measures including HTTPS encryption for data transmission. Local data is stored in your device's sandboxed app storage. Our web redirect records contain ad click and campaign identifiers, not a device fingerprint or a matched App installation.

8. Data Retention

• Local data: Stored on your device until you delete it or remove the App.
• AI proxy: Our proxy server does not retain submitted photos — requests are forwarded for processing and discarded.
• Web attribution data: Ad redirect click identifiers and campaign labels are retained for no more than 180 days. They are not linked by Skinmaxx to a device fingerprint or a specific App installation.
• Analytics and advertising data: Retained according to the policies and settings of Mixpanel, Meta, and TikTok.
• Subscription data: Managed by Apple and RevenueCat. See their respective privacy policies.

9. Third-Party Services

• Google Gemini API: Processes face and food photos for AI analysis. See Google's AI Terms.
• Apple StoreKit / RevenueCat: Handles subscription payments and tracks subscription status via an anonymous user ID. See Apple's and RevenueCat's privacy policies.
• Netlify and Supabase: Netlify hosts the brief ad redirect page that opens the App Store. Supabase receives the redirect's ad click identifiers and campaign labels, sends the web conversion event to TikTok, and hosts our secure AI proxy, aggregate subscription webhook records, and campaign reporting functions. Neither service receives face photos for storage.
• Apple HealthKit: Optional sleep data sync. See Apple's Health privacy policy.
• Mixpanel: Receives app event data (e.g., onboarding progress, paywall views, scan completion, trial starts, purchases) and limited event details for product analytics through an anonymous device identifier. We do not send photos, health data, full scan history, or profile answers to Mixpanel. See Mixpanel's Privacy Policy at mixpanel.com/legal/privacy-policy.
• Meta (Facebook) SDK: Receives app event data (e.g., installs, onboarding milestones, purchases) and — only with your consent via the iOS tracking prompt — your IDFA, used for ad attribution and analytics. See Meta's Privacy Policy at facebook.com/privacy/policy.
• TikTok Business SDK: Receives app event data (e.g., installs, onboarding completion, paywall views, trial starts, purchases) and — only with your consent via the iOS tracking prompt — your IDFA, used for ad attribution, analytics, and campaign optimization. See TikTok's Privacy Policy at tiktok.com/legal/page/global/privacy-policy.

10. Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes through the App. Continued use after changes constitutes acceptance.

11. Contact

For privacy questions, data requests, or parental inquiries: skinmaxx.app@gmail.com

If you believe we have collected data from a child under 13, contact us immediately and we will delete it.