Privacy Policy

1. Overview

This Privacy Policy applies to the Skintel iOS application, skintel.app, and related services (together, the “Service”). Skintel is operated by CodesWhat (“Skintel,” “we,” “us,” or “our”). CodesWhat is the controller of personal data processed under this policy unless another party is identified at the point of collection.

You must be at least 18 years old to use the Service. By using Skintel, you acknowledge the practices described here. Where consent is required—particularly for sensitive data, facial-image analysis, HealthKit access, or model training—we will request it separately in the app before that processing begins.

2. Data we collect

Depending on the features you choose, Skintel may collect the following:

Purchases are processed by Apple. We receive transaction and entitlement information but do not receive your complete payment-card details.

The website does not currently use advertising trackers. If you choose “Get early access,” your device opens an email addressed to us; we receive only what you choose to send.

3. How we use data

We use personal data to:

• Create and secure your account and remember your preferences.
• Store your photo history and calculate longitudinal skin measurements.
• Connect changes in your skin with products, routines, weather, sleep, activity, cycle information, and other context you choose to provide.
• Generate general, community-level, and personal insights and experiments.
• Provide safety-oriented ingredient flags based on states or allergies you declare.
• Process purchases, provide paid features, and manage support.
• Detect fraud, abuse, security incidents, and technical failures.
• Comply with law, enforce our terms, and protect users and the Service.

Where applicable, our legal bases include performing our contract with you, your consent, our legitimate interests in operating and securing the Service, and compliance with legal obligations. We rely on explicit consent when required for sensitive personal data.

Community insights and improvement

We may use de-identified or aggregated skin-metric vectors and product outcomes to improve Skintel and create community insights. We take reasonable measures designed to prevent re-identification and do not use HealthKit data or identifiable facial photos for this purpose. Where the app provides a cohort-contribution setting, your selection controls future eligible contributions.

4. AI and automated processing

Skintel uses automated systems and third-party analysis providers to evaluate photos, extract product information, calculate skin metrics, and generate explanations or recommendations. Relevant photos and contextual data may be sent to providers acting on our behalf under contractual privacy and security obligations.

Automated outputs may be incomplete, inconsistent, or wrong. They are designed to help you notice personal patterns, not to diagnose, treat, cure, or prevent any condition. Do not use Skintel for urgent or high-risk health decisions. You may contact us if you want information about an automated result or believe it is incorrect.

Model training

We will not use identifiable facial photos or other personal data to train a proprietary or third-party model unless you separately and affirmatively opt in. Model-training consent is not a condition of using Skintel. You may withdraw that consent for future training and request deletion of retained source material. Because trained models learn statistical relationships rather than keeping a direct copy of each record, it may not be technically possible to remove an individual record’s prior influence from a model already trained.

5. Facial images and biometric-data notice

Skintel analyzes facial images to measure cosmetic skin characteristics and changes over time. Skintel does not use facial recognition to identify you or compare your identity against other people. Even so, facial images and measurements may be treated as biometric information under some laws.

Collection and use

We collect and use facial images and derived measurements to provide your baseline, daily score, progress history, personal insights, capture-quality checks, and optional reanalysis with improved models. We do not sell, lease, trade, or otherwise profit from biometric information itself.

Disclosure

We disclose facial images or derived measurements only to service providers that need them to host, secure, or perform the analysis; when you direct us to; or when disclosure is required by law. Providers must protect the data at least as carefully as this policy requires and may not use it for their own advertising.

Public retention and destruction schedule

We retain facial images and derived biometric information only while reasonably needed for the purposes above. We permanently delete them when the purpose has been satisfied or within three years of your last interaction with Skintel, whichever occurs first, unless a valid warrant, subpoena, or other law requires preservation. An authenticated account deletion request triggers deletion from active systems within 30 days; encrypted backup copies may persist for up to 90 additional days before automatic expiration. We apply this schedule to our service providers as well.

6. HealthKit and location

Apple HealthKit

HealthKit access is optional and controlled through Apple’s permission settings. If you connect it, Skintel uses only the specific data types you authorize to provide skin-related context and insights directly to you. We do not use HealthKit data for advertising, marketing, cross-context tracking, data-broker services, or model training. We do not sell HealthKit data or disclose it to a third party unless that party provides a health or fitness service to you and you expressly permit the disclosure.

You can stop future HealthKit access in iOS Settings. Revoking permission does not automatically delete data already imported into Skintel; you can delete that data by deleting your account or contacting us.

Location

Location access is optional. Skintel uses it to obtain local weather and UV context. We store the resulting environmental measurements with your daily entry and do not need to retain a continuous location history. You can revoke location access in iOS Settings.

7. How we disclose data

We may disclose data to the following categories of recipients:

• Infrastructure providers for authentication, databases, encrypted storage, networking, backups, and security, including Supabase and its subprocessors.
• Analysis providers that process images or text to return a result to Skintel under our instructions.
• Platform providers such as Apple and Google for sign-in, Apple for subscriptions, and weather-data providers for environmental context.
• Operational providers for diagnostics, customer support, fraud prevention, and privacy-preserving product analytics.
• Legal or safety recipients when reasonably necessary to comply with law or protect the rights, safety, and integrity of users, Skintel, or others.
• Transaction recipients in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality and notice.

We require service providers that access user data to provide protections equivalent to those described in this policy and to process the data only for the contracted service.

No sale or behavioral advertising

Skintel does not sell personal information or share it for cross-context behavioral advertising. We have not sold or shared personal information for those purposes in the preceding 12 months. We do not knowingly sell or share information about anyone under 18.

8. Retention and deletion

Our standard retention schedule is:

You may initiate account deletion in the app’s account settings. You may also email hi@codeswhat.com for help with a data request. We may retain limited information when required by law, needed to complete a transaction, prevent fraud or abuse, resolve disputes, or enforce agreements. De-identified information that can no longer reasonably be linked to you may be retained for research, statistics, and service improvement.

Deleting your Skintel account does not automatically cancel an App Store subscription. You can manage subscriptions through your Apple account settings.

9. Your choices and privacy rights

Depending on where you live, you may have the right to access, know, correct, export, delete, or restrict use of personal data; withdraw consent; object to certain processing; opt out of sale or sharing; limit use of sensitive personal information; and appeal a denied request. We will not discriminate against you for exercising a privacy right.

Submit a request through the app’s settings or email hi@codeswhat.com. Please use the email associated with your account. We may need to verify your identity before completing a request and may deny or limit a request where permitted by law. An authorized agent may submit a request when local law allows and appropriate authorization is provided.

California residents

California residents may exercise rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service. Because Skintel does not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing to opt out of. We use sensitive information only to provide, secure, and improve the services you request or with your consent.

EEA, United Kingdom, and Switzerland

You may also have rights to data portability, restriction, objection, withdrawal of consent, and complaint to your local data-protection authority. Withdrawal does not affect processing that was lawful before withdrawal. Where we rely on legitimate interests, you may request information about our balancing assessment.

10. Security and incident notice

We use safeguards designed for sensitive information, including encrypted transport, encrypted storage, private photo buckets, account-scoped access controls, protected credentials, logging, and vendor controls. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur.

If we discover a breach involving covered health or other personal information, we will investigate and notify affected users and regulators as required by applicable law, including the FTC Health Breach Notification Rule where it applies.

International transfers

Skintel and its providers may process information in the United States and other countries whose data-protection rules differ from those where you live. Where required, we use an approved transfer mechanism and appropriate safeguards.

Children

Skintel is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided data, contact us and we will take appropriate steps to delete it.

11. Changes and contact

We may update this policy as Skintel changes. If an update materially affects how we use sensitive data, we will provide prominent notice and request new consent where required. The effective date above identifies the current version.

Questions, privacy requests, or complaints can be sent to CodesWhat, operator of Skintel, at hi@codeswhat.com. Please include “Skintel Privacy” in the subject line.