Privacy Policy

Skinreo ("we", "us", "our") is an AI-powered skin tracking application. We operate this service and are the data controller responsible for your personal data.

You can reach us at: hello@skinreo.com

This Privacy Policy applies to all users of the Skinreo web application and any related services. By using Skinreo, you agree to the collection and use of your data as described here.

We collect the following categories of personal data:

• →Account data: Your email address when you register or sign in.
• →Profile data: Optional information you provide — age, sex, skin type, skin concerns, and goals.
• →Daily scan photos: Every facial photograph you choose to submit for a daily or advanced scan is sent through Skinreo to OpenAI for appearance analysis. If your browser can store it, the journal copy is kept in IndexedDB on that device. Scan photos are not stored in Skinreo's database or synchronized between devices.
• →Comparison photos: The older and newer facial photographs you choose for Compare Photos. Both are sent together to OpenAI for temporary comparison analysis. Skinreo does not save the older comparison photo or either comparison photo in its database. If you choose “Add the newer result to Progress,” the newer photo is kept only in that browser when local storage succeeds.
• →Analysis results: Numerical appearance scores for overall appearance, blemishes, hydration/dewiness, redness, texture and fine lines, plus the comparison explanation you see on screen. If you choose to add the newer comparison result to Progress, its numerical scores are stored in your account.
• →Usage data: Pages visited, features used, timestamps, and general interaction patterns — used to improve the service.
• →Device data: Browser type, operating system, and device type — used for technical compatibility.
• →Push notification tokens: If you enable scan reminders, we store a push subscription endpoint to deliver notifications.
• →Questions: If you use Ask Skinreo, your question and relevant app context are sent to OpenAI to generate the response. The current contextual assistant does not save that conversation to your account.
• →Product shelf data: If you save or track skincare products, we store product names and associated data in your account.
• →Browser storage: We use IndexedDB for device-local journal photos and localStorage or sessionStorage for app state such as tutorial progress, pending routine changes and short-lived flow information. Clearing site data can remove this information and local photos.

We do not receive or store your full payment card information; Stripe handles payment details. We do not store ingredient scanner or comparison photos in our database. They are processed for the requested analysis and are not retained by Skinreo after the request finishes.

We use your data solely to provide, maintain, and improve the Skinreo service. Specifically:

• →To authenticate you and manage your account.
• →To send each daily or advanced scan photo to OpenAI and generate the appearance scores you requested.
• →To compare an older and newer photo when you explicitly choose Compare Photos, including assessing whether capture conditions make the comparison less reliable.
• →To store your scan history and display your progress over time.
• →To generate personalised routine recommendations based on your skin profile.
• →To send scan reminder notifications if you have enabled them. Notifications are dispatched by an automated background process (a scheduled cron job) that runs on our servers and sends push messages to your registered endpoint.
• →To answer contextual questions by sending your question and relevant context to OpenAI.
• →To search for relevant skincare products using Serper's API when you use the ingredient scanner or product features — using search terms only, never your photos or personal data.
• →To send product and feature updates if you have subscribed to our newsletter (you can unsubscribe at any time).
• →To diagnose technical problems and improve the app.

Lawful basis (GDPR): We process your data on the basis of your consent (Article 6(1)(a)) and, where applicable, the performance of a contract (Article 6(1)(b)). For biometric/facial data, we rely on your explicit consent (Article 9(2)(a)).

We do not use your data for advertising, profiling for third-party purposes, or automated decision-making that produces legal or similarly significant effects.

We do not sell your personal data to anyone. We share data only with the following trusted service providers who process data on our behalf:

We may disclose your data to law enforcement or regulatory authorities if required by law, or to protect the rights and safety of our users and ourselves.

Facial photographs can be sensitive personal data. Skinreo processes them only when you actively submit them for a scan or comparison and agree to the on-screen consent notice. Skinreo does not use facial recognition, create identity templates or try to identify you.

We take the following measures to protect this data:

• →Photos are transmitted through encrypted HTTPS connections to Skinreo and OpenAI for the analysis you request.
• →Skinreo stores journal photos only in IndexedDB in the browser where you saved them. They are not synchronized to your account.
• →Older comparison photos are not added to your journal. Comparison uploads are not stored in Skinreo's database.
• →Saving the newer comparison result is optional. When enabled, numerical scores are saved to your account and the newer photo is kept only in the current browser when possible.
• →You can delete a saved scan from the app, which removes its account scores and attempts to remove its local photo from the current browser.

Before a scan or comparison begins, Skinreo asks you to consent to sending the selected photo or photos to OpenAI. You can decline and use the routine and product features without submitting facial photos. You may withdraw consent for future processing by no longer submitting photos and can delete previously saved numerical scans from Progress.

We retain your data for as long as you maintain an active account with Skinreo.

• →Journal photos: Kept only in the current browser's IndexedDB until you delete the scan, clear site data or remove the browser/app data.
• →Comparison photos: Not retained in Skinreo's database. The page keeps selected photos only for the current comparison session. If you save the newer scan, its photo follows the device-local journal rule above.
• →Analysis results and skin scores: Saved until you delete the associated scan or your account. A comparison explanation is displayed for the current session; only the newer numerical scores are saved when you select that option.
• →Product shelf data: Retained until you remove the product from your shelf or delete your account.
• →Account data: Retained until you request account deletion.
• →Notification tokens: Deleted when you disable notifications or delete your account.
• →Browser storage: Stored locally and removable through app controls or browser settings. Clearing it can permanently remove journal photos from that device.

To request full account deletion and erasure of all associated data, contact us at hello@skinreo.com. We will complete deletion within 30 days.

Depending on your location, you may have the following rights regarding your personal data:

• →Right of access: Request a copy of the personal data we hold about you.
• →Right to rectification: Request correction of inaccurate or incomplete data.
• →Right to erasure: Request deletion of your personal data ("right to be forgotten").
• →Right to restriction: Request that we limit how we process your data.
• →Right to data portability: Receive your data in a structured, machine-readable format.
• →Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• →Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@skinreo.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Skinreo is operated from Lithuania (EU). Some of our third-party providers — including Supabase, OpenAI, Serper, and Vercel — are based in the United States. When your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

By using Skinreo, you acknowledge that your data may be transferred to and processed in countries outside your own, including the United States, in accordance with this policy.

Skinreo uses a minimal approach to cookies and local storage:

• →Authentication cookies: Set by Supabase to maintain your login session. These are strictly necessary and cannot be disabled without breaking the service.
• →Local storage: We may store non-sensitive preferences (such as skin type selection during onboarding) in your browser's local storage.

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that track you across other websites.

Skinreo is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 years of age. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at hello@skinreo.com and we will delete the data promptly.

Users in the EU must be at least 16 years old to consent to data processing under Article 8 of the GDPR.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify you by email (if we have your address) or by a prominent notice within the app.

Your continued use of Skinreo after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: