1. Information We Collect
AiSkin collects the following types of information to provide and improve our services:
- Device Information: A randomly generated device identifier (UUID), device platform (iOS/Android), and app version. We do not collect your name, email, or phone number.
- Selfie Photos: When you use Skin Analysis or a daily check-in, your selfie is sent over HTTPS to AiSkin's own servers and measured by our own skin-analysis engine, which runs on our servers in the European Union (Germany). Your photo and the generated analysis images (face-map overlays) are kept on our servers so the app can display your results and are automatically deleted within 7 days — unless you choose to help improve the analysis (see Section 3, "Optional: help improve the analysis").
- Ingredient Photos: When you scan a product label, the photo is processed on-device using optical character recognition (OCR) and only the extracted text is sent for AI analysis if you request it. If on-device recognition finds no text, the label photo itself may be sent to our AI text provider (Section 2) to read the ingredient list.
- Skin Profile Data: Your skin type, concerns, age range, and preferences — provided voluntarily through the skin quiz. This data is stored locally on your device and sent with analysis requests to personalize results.
- Usage Data: Anonymous analytics including feature usage frequency, session duration, and crash reports via Firebase Analytics and Crashlytics.
2. AI Data Processing
Skin measurement — our own engine, no third party. Since October 2026 your selfie is analyzed by AiSkin's own computer-vision engine on our own servers. Your face photo is not sent to any third-party AI or analysis provider. The engine measures visible skin characteristics (for example blemishes, redness, shine, texture, fine lines, dark spots, under-eye darkness) and returns numeric scores and overlay images. It does not identify you.
Text generation — OpenAI language models, accessed through OpenRouter (a third-party API gateway):
- Numeric skin scores and your skin profile (skin type, concerns, age range) — used to write a short, personalized summary of your results in your language. Your photo is never sent to OpenAI or OpenRouter.
- Ingredient lists — text extracted from product labels (or, if on-device recognition fails, the label photo), sent when you request AI ingredient analysis or compatibility checks
- Chat messages — sent when you use the AI dermatologist chat
How your data is protected:
- All data is transmitted via encrypted HTTPS connections through our backend servers
- Per OpenAI's API data usage policy, API inputs are not used to train OpenAI's models by default, and are retained by OpenAI for up to 30 days solely for abuse and security monitoring
- OpenRouter acts as a stateless API gateway; per its privacy policy, it does not use customer prompts or inputs to train models
- Photos and analysis images are stored on AiSkin servers for a maximum of 7 days, then automatically and permanently deleted (unless you opt in as described in Section 3)
- You can delete locally stored images and any photos kept for model improvement via Settings → "Delete My Data"
3. Face Data
This section addresses, point by point, the six face-data disclosure requirements under App Store Review Guideline 5.1.1(i):
(1) Whether face data is retained. Selfies and the generated face-map analysis images are stored on our servers for a maximum of 7 days, solely so the app can display your results, and are then automatically and permanently deleted. If — and only if — you turn on the optional "Help improve analysis" setting, the photos from your scans are additionally kept to train our own skin-analysis model (see below). We do not create, derive, or store facial recognition templates, face embeddings, or any biometric identifier, and face data is never used to identify you. (Our engine locates facial landmarks inside a single photo only to find skin areas such as the forehead and cheeks; these are discarded after the analysis and never used to recognize anyone.)
(2) Reasons for storing face data. The 7-day server-side copy exists to serve your analysis result back to your device (your photo and the overlay images that visualize detected skin concerns). With your explicit opt-in, scan photos are also kept to train and evaluate our own skin-analysis model so that results become more accurate for everyone. Face data is never used for advertising, identification, or profiling.
(3) Length of time face data is stored, and why. On our servers: up to 7 days (automatic deletion sweep), only to display your results. Opt-in model-improvement copies: until you turn the setting off or use "Delete My Data" — they are then deleted immediately — and in any case no longer than 3 years. Technical request logs contain no image content. On your device, a local copy is kept inside the app so you can view your own scan history, and can be erased at any time via Settings → Delete My Data.
(4) Third parties we share face data with. None. Face images are processed only on AiSkin's own servers by our own engine. OpenAI and OpenRouter receive only numeric scores and skin-profile text — never face images.
(5) Reasons for sharing face data with third parties. Not applicable — we do not share face data with third parties.
(6) Third-party retention practices. Not applicable — no third party receives face data. (Our servers are hosted by Hetzner Online GmbH in Germany, which provides the infrastructure only and does not access or process the content of your photos.)
Optional: help improve the analysis
The app may ask whether you want to help make the skin analysis more accurate. This is off unless you turn it on, and you can turn it off at any time in Settings. If you turn it on:
- The photos from your skin scans and check-ins, together with the numeric results and your skin profile (skin type, concerns, age range, climate, routine level — not your allergies), are kept on AiSkin's servers in the EU.
- They are used only by AiSkin to train, test, and improve our own skin-analysis model. Our team may view and annotate them (for example, marking blemishes) for this purpose.
- They are never sold, never shared with third parties, never published, and never used for advertising or to identify you.
- When you turn the setting off, or use "Delete My Data", all photos kept for this purpose are deleted from our servers immediately. A model already trained does not contain your photos.
4. How We Use Your Information
- To provide skin analysis and personalized skincare recommendations (our own computer-vision engine for measurement; OpenAI for text summaries)
- To analyze ingredient safety against our dermatological database
- To manage your subscription and free tier quota
- To improve service reliability (using anonymized, aggregated measurements — e.g. how often photos are too dark — never individual profiles)
- Only if you opt in: to train and evaluate our own skin-analysis model (Section 3)
- To send you skincare tips and routine reminders (only if you opt in to notifications)
5. Photo Processing and Storage
Your privacy regarding facial images is our highest priority:
- Selfie photos are transmitted via encrypted HTTPS connection to our own servers (EU)
- Photos and generated analysis images are stored on AiSkin servers for a maximum of 7 days and are then automatically and permanently deleted — unless you opt in to help improve the analysis (Section 3)
- Your original selfie is not publicly accessible; result images are served only through unguessable links to your app
- We do not create facial recognition profiles, face embeddings, or any biometric identifier from your photos
- Photos are never sold, used for advertising, or shared with third parties
- Ingredient label photos are processed on-device via OCR and are not uploaded unless you request AI analysis and on-device recognition fails
6. Data Sharing
We do not sell your personal information. We share data only with:
- AI Text Processing (OpenAI via OpenRouter): Your numeric skin scores, skin profile data, ingredient lists (and, if needed, a product-label photo), and chat messages are sent to OpenAI language models, accessed via OpenRouter, to generate text. No face photos are sent to these providers. Data is not used for model training; OpenAI may retain API inputs for up to 30 days for abuse and safety monitoring, after which they are deleted.
- Subscription Management: RevenueCat processes subscription transactions. They receive only your anonymous device ID and purchase data.
- Analytics: Firebase Analytics and Crashlytics (Google) receive anonymized usage data and crash reports. No face images or other personal data are shared with analytics providers.
- Hosting: Our servers are operated on infrastructure of Hetzner Online GmbH (Germany), which does not access the content of your data.
7. Data Retention
- Face images / selfie photos: Stored on AiSkin servers for up to 7 days (photo + analysis images, deleted automatically), with no backups.
- Opt-in model-improvement photos: Until you turn the setting off or use "Delete My Data" (then deleted immediately), at most 3 years.
- Analysis results: Stored locally on your device. Our servers keep only the latest check-in score per device (to show your progress) and, if you opted in, the results stored with your model-improvement photos.
- Device tokens: Access tokens expire after 1 hour; refresh tokens after 90 days of inactivity
- Usage logs: Retained for 90 days for service monitoring, then deleted. Logs do not contain face images or raw photo data.
8. Your Rights
You have the right to:
- Delete your data: Use "Delete My Data" in Settings to erase the data stored on your device and any photos kept on our servers for model improvement
- Withdraw consent: Turn off "Help improve analysis" in Settings at any time — the photos kept for that purpose are deleted immediately
- Access your data: Your skin profile and analysis history are stored locally on your device and visible in the app at all times
- Opt out of analytics: You can disable analytics collection in your device settings
- Contact us at [email protected] for any request regarding your data
9. Security
We protect your data using:
- TLS/HTTPS encryption for all data in transit
- JWT-based authentication with short-lived tokens
- Sensitive data (tokens) stored in platform-specific secure storage (iOS Keychain / Android Keystore)
- Server infrastructure hosted in secure data centers with access controls
10. Children's Privacy
AiSkin is not intended for children under 13 years of age. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted within the app and on this page with an updated "Last updated" date. Continued use of AiSkin after changes constitutes acceptance of the updated policy.
12. Contact
If you have questions about this Privacy Policy or your data, contact us:
Email: [email protected]
Company: VAST FLOW