Privacy Policy

Skincare AI is developed and operated by Rockers, an individual developer ("we", "us"). Skincare AI is a cosmetic and wellness app: it helps you understand the visible condition of your skin, build a personal skincare routine, and track your progress over time with photos. It is not a medical device and does not provide medical advice, diagnosis, or treatment. If you have a question about this policy or how your data is handled, you can reach us at privacy@rockers.dev (this address is provisional while the app is in early release, and we will update it here if it changes).

Skincare AI works from photographs of your face, so this section sets out in one place exactly what face data we collect, why, who receives it, where it lives, how long we keep it, and how you delete it. It applies in addition to the rest of this policy.

What we collect. Photographs of your face, and nothing more. During onboarding the app asks for one front facing photo, and optionally a left profile and a right profile photo. After onboarding you can take weekly progress photos whenever you choose to. These are ordinary photographs. We do not collect fingerprints, voiceprints, iris or retina scans, hand or body geometry, or any other biometric identifier.

How we collect it.Through the camera inside the app, on iOS only after you have granted camera permission. Before the camera opens, the app shows a consent screen that explains what the photo will be used for and offers a "Continue without photo" option. No photo is captured or sent for analysis unless you choose to continue from that screen, and you can retake or discard a photo before it is saved. Skincare AI can be used without providing any photo at all.

What we use it for. Your face photos are used only to: produce your cosmetic skin reading (an overall score, per area ratings such as texture, redness, oiliness, and under eye shadow, and the written observations that go with them); build the personalized AM and PM routine and product suggestions that follow from that reading; and let you compare your own photos over time so you can see how your skin changes. Face photos are never used for advertising, never used to train AI models, never sold, rented, or shared with data brokers, and never shared with Meta or any other advertising network.

On device face detection.While the camera is open, the app runs Google's ML Kit face detection locally on your device to help you frame the shot. It measures only how much of the frame your face fills, how far your head is turned and tilted, whether your eyes are open, and whether your face is fully inside the frame. This runs entirely on your device, produces only those few numbers, is used only to draw the on screen framing guidance, and is discarded when you leave the capture screen. It is never uploaded, not to us and not to anyone else.

No biometric identification.Skincare AI does not create a faceprint, a face template, a face signature, or a face embedding. It does not perform face recognition or face matching, it does not attempt to determine or verify who you are, and it never compares your face against another person's face or against any database of faces. The only comparison the app makes is between your own photos over time, and it is a visual, cosmetic comparison that you asked for. Skincare AI is a cosmetic and wellness product: it is not a medical device, it does not diagnose skin disease, and it is not used for identification, authentication, surveillance, or security.

Who receives it. Two processors receive your face photos, and only for the purposes above:

• Google (Firebase and Google Cloud). Our backend runs as Firebase Cloud Functions in the us-central1 region of the United States, and account backups of your photos are held in Firebase Cloud Storage, also in the United States. Google acts as our infrastructure processor and may use the data only to provide those services to us.
• OpenRouter, Inc.Our backend sends the photo to OpenRouter, which routes it to the vision model provider that generates the cosmetic reading, and returns that reading to us. The app never contacts OpenRouter directly. OpenRouter's privacy policy is at openrouter.ai/privacy. See Third-party AI processing for the full detail.

Before a photo leaves your device for analysis it is downscaled so that its longest side is at most 1024 pixels and re-encoded as a JPEG. The full resolution original stays on your device. Alongside the photo we send the instructions our backend writes and your onboarding quiz answers. We do not send your name, your email address, your account identifier, your device identifier, or your advertising identifier to OpenRouter or to the model provider.

Where it is stored. The original photos are stored on your device. If you create an account (Sign in with Apple or Sign in with Google) so your data can be restored on a new device, your photos are also backed up to Firebase Cloud Storage in the United States, in a private folder that only your own account can read. If you use Skincare AI anonymously, without creating an account, your photos are never uploaded for storage: the only moment a photo leaves your device is while it is being analyzed.

How long we keep it. Photos backed up to your account are kept until you delete them or delete your account. There is no fixed expiry, because the purpose of the archive is a long running progress timeline that you control. Photos sent for analysis are not stored on our servers at all: our backend holds the image in memory only for the length of the request, writes it to no disk and to no database, and records only how many images a request contained, never the images themselves. The full table is in Retention and account deletion.

How you delete it. Individual progress photos can be deleted from the Progress screen. To delete everything, open Profile, then Privacy, then Delete data. That permanently deletes your account, your profile, your quiz answers, your report, your routine, and every photo held under your account in Cloud Storage, including the baseline photo, the profile photos, and the full weekly history. Deletion is immediate and cannot be undone. Deleting the app from your device removes the local copies. If you would rather we did it for you, write to privacy@rockers.dev and we will.

We collect the following categories of information:

• Account information. You can use the app anonymously without creating an account. If you choose to sign in with Apple or Google to save your data and sync it across devices, we receive the name and email address associated with that sign in method (Apple lets you hide your real email with a private relay address, which we support).
• Face photos. A baseline photo taken during onboarding (front facing, plus optional left and right profiles) and any weekly progress photos you choose to take, used to generate your skin report and track change over time. This is face data and it is covered in full in Face data above.
• Onboarding answers. Your responses to the skincare quiz: skin type, concerns, goals, habits, and similar self reported context used to personalize your report and routine.
• Your report and routine plan. The generated skin analysis report and the AM/PM routine plan built from it, stored so it can be restored on a new device.
• Purchase information. Subscription status, product identifiers, and transaction identifiers needed to unlock paid features. We do not receive your full payment card details; these are handled by Apple and our subscription infrastructure provider.
• Device identifiers. A device or installation identifier and an anonymous user identifier used to keep your data attached to your account and to protect the app from abuse.
• Advertising identifiers. If you allow tracking when the app asks you (the iOS App Tracking Transparency prompt), we collect your device advertising identifier (IDFA) and share it with Meta so a subscription or install can be matched to the ad you saw. If you decline, we do not collect the advertising identifier. Separately, for the same measurement purpose, an anonymous Meta identifier generated on your device and your IP address may be sent to Meta with subscription events. See Advertising and measurement below.
• Usage analytics. Aggregate, non-identifying information about how the app is used, such as which screens are opened and which features are used, so we can improve the product.
• Crash and diagnostic data. Automatically generated crash reports and error logs used to find and fix bugs.

We use the data described above to:

• generate your skin analysis report and build your personalized skincare routine and recommendations;
• personalize the app experience to your skin type, concerns, and goals;
• operate core app functionality, such as syncing your report and photos across your devices and restoring your data after a reinstall;
• protect the security of the app and its users, detect fraud, and prevent abuse of our services;
• understand, in aggregate, how the app is used so we can improve it;
• measure how our advertising performs, and attribute app installs and subscriptions to the ads that led to them, so we know which campaigns are worth running; and
• diagnose and fix crashes and technical problems.

Skincare AI does not run its own AI models. To produce your skin reading and your routine we use OpenRouter, Inc., a US company that routes model requests to the vision model provider that generates the result. Its privacy policy is at openrouter.ai/privacy.

How the request travels. The app sends your photos to a backend we operate on Google Cloud (Firebase Cloud Functions, in the us-central1 region of the United States). That backend attaches our own API credentials and forwards the request to OpenRouter, which passes it to the model provider and returns the generated reading. The app never talks to OpenRouter directly, and our API key is never present in the app.

What is sent. Up to three downscaled JPEG copies of your face photos (longest side at most 1024 pixels), your onboarding quiz answers, the instructions our backend writes, and your app language. For a weekly comparison, your baseline photo and the new weekly photo are sent the same way. Product names, and only product names, are sent to Open Beauty Facts to look up ingredient information; no photo and no personal data goes there.

What is not sent. No name, no email address, no account identifier, no device identifier, no advertising identifier, and no location. The AI request carries your photos and your answers and nothing that identifies you as a person.

Purpose limits. This data is sent for one purpose only: to generate your cosmetic skin reading and the routine and product suggestions that follow from it. It is not used to train, fine tune, or evaluate AI models, by us or by our providers. It is not sold, rented, or licensed. It is not used for advertising, ad targeting, or ad measurement. It is not used to build a profile of you for any purpose beyond producing your own report inside this app. We do not enable any model training or data sharing option offered by our AI providers.

Protection downstream. We only use AI providers whose terms require them to process this data solely on our instructions, for the purpose we sent it, and to protect it with safeguards equal to or greater than those described in this policy, including encryption in transit and restricted access. If a provider can no longer meet that standard, we stop using it.

We rely on a small number of service providers to run Skincare AI. We do not sell your data to any of them. Most of them act as processors and may only use your data to provide their service to us. Meta is the exception: it receives advertising and conversion data from the app and from our subscription provider, and it uses that data to measure our campaigns and to optimize how ads are delivered on its own platforms. The section on advertising and measurement explains exactly what Meta gets and what it never gets.

• Firebase (Google). Authentication, database storage (Firestore), photo storage (Cloud Storage), app integrity checks (App Check), and the Cloud Functions that run our backend logic.
• OpenRouter, Inc. Your face photos and quiz answers are sent, through our own Cloud Functions proxy (the app never calls OpenRouter directly), to OpenRouter, which routes them to the vision model provider that generates your skin analysis report and routine recommendations. That is the only purpose. Neither we nor our providers use your photos to train AI models, and we do not sell them. See Third-party AI processing.
• RevenueCat. Manages subscription status and entitlements across platforms so paid features unlock correctly. On our behalf, RevenueCat also forwards subscription events (trial started, subscription purchased, renewal) from its servers to Meta, so a subscription can be attributed to the ad that led to it.
• Meta (Facebook, Instagram). We advertise Skincare AI on Meta platforms. The app sends Meta a limited set of events: app install, app open, and a signal that onboarding was completed. RevenueCat sends Meta subscription events as described above. Alongside those events Meta may receive device identifiers: your advertising identifier if you allowed tracking, an anonymous Meta identifier generated on your device, a device vendor identifier, and your IP address. Meta uses this to measure our ad campaigns and to optimize ad delivery on its platforms. Your photos, your quiz answers, your skin report, and your routine are never sent to Meta.
• Open Beauty Facts. An open cosmetics database we query for ingredient information. It receives product names only, never your photos, your answers, your report, or any identifier.
• Apple. Processes in-app purchases and subscription payments, and provides Sign In with Apple. If you use an iPhone or iPad, Apple also provides App Store services used to distribute the app.

We may also disclose information if required to do so by law, or to protect the rights, property, or safety of our users or the public.

You are asked before any photo is sent.Skincare AI asks for your explicit consent in the app before a face photo is captured or sent for AI analysis. Before the camera can open, a consent screen explains what the photo will be used for, that the reading is cosmetic and not a medical diagnosis, and that the photo is processed by our AI provider. From that screen you can either continue to the camera or choose "Continue without photo". If you choose to continue without a photo, no photo is ever captured and nothing is sent for analysis. iOS also asks separately for camera permission, which you can refuse.

Photos are optional. Only the front facing photo is part of the main flow, the two profile photos are an optional extra step, and weekly progress photos are taken only when you decide to take one. You can use the app, including your quiz based context and your routine, without giving a photo.

Withdrawing your consent. You can withdraw at any time, in the app, without contacting us:

• Stop taking photos. Nothing is sent for analysis unless you start a new analysis or a weekly check in yourself.
• Delete individual progress photos from the Progress screen.
• Sign out from the Profile screen. Cloud backup of photos happens only for signed in accounts, so signing out stops any further upload.
• Delete everything: Profile, then Privacy, then Delete data. This removes your account, your photos, your report, your routine, and your answers from our systems.
• Revoke camera access entirely in iOS Settings, Privacy and Security, Camera.

Withdrawing consent does not undo an analysis that already ran, since the reading has already been generated and returned, but it stops all further processing and lets you delete the stored result and the photos behind it. Advertising tracking is a separate choice, described in Advertising and measurement.

Your baseline onboarding photos and any weekly progress photos you take are used to generate your skin report and to show you how your skin changes over time. They stay on your device unless you create an account; with an account they are also backed up to Firebase Cloud Storage in a private folder that only your account can read, so they can be restored on a new device. You can delete individual progress photos, or delete your entire account (which removes every photo), at any time from within the app. Full detail, including the AI processing path, is in Face data.

We advertise Skincare AI on Meta platforms (Facebook and Instagram). To keep doing that without wasting money, we need to know which ads actually lead to installs and subscriptions, so the app shares a limited amount of data with Meta for measurement and ad delivery. Under Apple's definition this counts as tracking, so we want to be direct about it.

Your choice.After you see your skin report, we show you a short explanation and then iOS asks whether you allow us to track you across other companies' apps and websites. You can say no. Declining changes nothing about how the app works: every feature, including your report, routine, progress photos, and your subscription, behaves exactly the same. If you allow it, your device advertising identifier (IDFA) is shared with Meta. If you decline, it is not, and Meta receives only limited or aggregated measurement through Apple's and Meta's own systems.

What we share with Meta. App install, app open, and a signal that you finished onboarding. Subscription events (trial started, subscription purchased, renewal), which our subscription provider RevenueCat sends to Meta from its servers. Alongside those events, device identifiers where permitted: your advertising identifier if you allowed tracking, an anonymous Meta identifier generated on your device, a device vendor identifier, and your IP address.

What we never share with Meta. Your skin photos, your onboarding quiz answers, your skin analysis report, and your routine plan are never sent to Meta or to any other advertising network. Photos leave the app only to reach our AI analysis proxy, for the sole purpose of generating your report.

Skincare AI shows no third-party ads inside the app, and we do not sell, rent, or share your personal data with data brokers.

Changing your mind. You can change your answer at any time on your device, in Settings, Privacy and Security, Tracking, where you can turn tracking off for Skincare AI or for all apps at once.

We keep your account data, including your report, routine, and photos, for as long as you have an account with us, so the app can continue to work for you. You can delete your account at any time from the Profile screen in the app (Profile, then Privacy, then Delete data). Account deletion removes your profile, answers, report, routine, and every photo held under your account, immediately and irreversibly.

Retention period by category:

The last row is the only thing that survives account deletion. It is a single anonymous statistics row with no back link to you, kept so we can understand in aggregate how the app performs. Everything else listed as "until you delete your account" is removed at that point.

We use Firebase App Check to help ensure that requests to our backend come from genuine copies of the app rather than automated or tampered clients, and all data sent between the app and our backend is encrypted in transit. Access to production data is restricted to what is necessary to operate the service. No method of transmission or storage is perfectly secure, but we work to protect your information using industry standard practices.

Skincare AI is developed and operated from Türkiye, and your data is processed on US-based cloud infrastructure operated by our service providers (Firebase and related Google Cloud services). By using the app, you understand that your information may be transferred to, stored, and processed in the United States and other countries where our processors operate, which may have data protection laws different from those in your country.

Specifically, our backend runs in the us-central1 region of the United States, your Firestore data is held in a multi region United States database, and photo backups are held in a United States Cloud Storage bucket. OpenRouter, Inc. is a United States company; the model provider it routes a request to may process that request in another country, under terms that require protection equal to or greater than the safeguards described in this policy.

Skincare AI is not directed to children and is not intended for use by anyone under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at privacy@rockers.dev so we can delete it.

Depending on where you live, you may have rights to access, export, correct, or delete the personal data we hold about you. You can exercise most of these rights directly in the app: the Profile screen lets you review your report, export or delete your progress photos, and delete your account. For any request you cannot complete in the app, or if you have questions about your rights, contact us at privacy@rockers.dev.

We may update this privacy policy from time to time as the app changes or as required by law. If we make material changes, we will update the date shown at the top of this page and, where appropriate, notify you in the app. We encourage you to review this page periodically.

Questions about this privacy policy or how your data is handled can be sent to privacy@rockers.dev. This address is provisional while the app is in early release; if it changes, we will update it on this page.