Privacy Policy

Last updated: September 17, 2026

SkinStreak ("the app", "we", "us") is an honest skincare coach. This policy explains what data the app handles, where it is processed, and how you stay in control. The short version: your data lives on your device by default, your face photos are analyzed on your device, nothing is uploaded without your explicit per-photo confirmation, and one tap deletes everything.

1. Information We Collect

SkinStreak is local-first. The following data is created and stored on your device (and in your personal iCloud, only if you enable sync — see Section 6):

• Routine data: products you add, ingredients, conflict findings, scheduled routine slots, check-ins, streaks, and Streak Freeze usage.
• Profile data: skin type, goal, and Fitzpatrick phototype you choose in onboarding or Settings.
• Progress photos: guided selfies and the on-device skin metrics computed from them (redness ratio, texture variance, spot count). These are stored locally and are not uploaded by default.
• Purchase state: your subscription or one-time purchase status, managed by Apple's StoreKit. We never see your payment details.

We do not collect or require: your name, email address, phone number, precise location, contacts, or advertising identifiers. There is no account to create. We do not sell your data, and we do not use it for advertising — ever.

2. Face Photos & Biometric Data (On-Device by Default)

• On-device processing: all face-photo analysis — alignment QC (LightGuard), face segmentation, and the computation of redness, texture, and spot metrics — runs on your device using Apple's on-device machine learning. No photo leaves your device during this process.
• Upload only with explicit confirmation: the only feature that can send a photo off your device is the optional weekly deep AI scan. Before any upload, SkinStreak shows a per-photo confirmation dialog ("upload this one photo?"). If you decline, nothing is sent and the on-device daily analysis still works.
• No identity linkage: we never link biometric data (face geometry or face-derived metrics) to your identity. We cannot reconstruct who you are from anything the app processes, and we never attempt to.
• No retention of uploads for identification: when you confirm a deep-scan upload, the image is transmitted solely to generate your requested analysis and is not used to identify you, not used for advertising, and not sold or shared for any other purpose.
• Quality gate: captures that fail the light-quality check are never saved at all.

3. Illinois Residents — Your BIPA Rights

If you are in Illinois, the Illinois Biometric Information Privacy Act (BIPA) gives you specific rights regarding biometric identifiers such as face geometry:

• No written-release trap: SkinStreak processes face photos on your device and does not build a biometric identifier database about you. It does not link biometric data to your identity.
• Deletion on demand: you can exercise deletion at any time via Settings → Delete all my data, which immediately and permanently removes all locally stored photos and biometric-derived records. You may also request deletion by emailing us.
• No disclosure or profit: we never disclose, sell, or profit from biometric data.

4. One-Tap Deletion

Settings → Delete all my data permanently deletes all app data on your device: products, conflict logs, routine schedules, check-ins, streak history, reports, coach notes, and all locally stored face photos and their derived metrics. Deleting the app also removes its local data.

5. Your API Key (BYO)

If you buy SkinStreak Forever (BYO) and supply your own GLM API key, that key is stored only on your device, in the iOS Keychain. It is never transmitted to us, never logged, and never included in backups we control. AI requests made with your key go directly from your device to your chosen provider (Z.ai / GLM) and are governed by that provider's terms and privacy policy.

6. iCloud Sync (Optional, Opt-In)

Pro users can enable iCloud sync. Sync uses your personal CloudKit private database and is end-to-end encrypted by Apple — we have no access to it. Only non-biometric records (routine data, profile settings, check-ins) sync. Progress photos stay on your device by default; uploading photos to your own iCloud is an opt-in choice made in the app.

7. Third-Party Services

• Apple: StoreKit (purchases), Apple Intelligence / Foundation Models (on-device AI copy on supported devices), CloudKit (optional sync), and App Store services. Apple's own privacy policy governs those interactions.
• Z.ai / GLM (only when you consent): the weekly deep AI scan — after your explicit per-photo confirmation — or your own BYO key sends the confirmed image and metrics to the GLM API to generate your deep report. Requests are never used to train models and are not shared further.
• Open Beauty Facts (OBF): barcode lookups fetch product and ingredient data from the Open Beauty Facts community database, licensed under the Open Database License (ODbL). Lookups contain the barcode only — not your identity.

We do not embed third-party advertising SDKs or general-purpose analytics trackers.

8. Crash & Diagnostic Data

If Apple collects crash/diagnostic data on our behalf through the standard App Store mechanism, it is processed by Apple and contains no biometric data. We use it only to fix bugs.

9. Children's Privacy

SkinStreak is not directed to children under 13 (and under 16 in the EEA/UK). We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will help you delete it.

10. Your Rights & Choices

• Access & portability: your data is already on your device; weekly reports and photos can be exported from the app.
• Deletion: one-tap "Delete all my data" (Section 4), or email us.
• Objection/opt-out: decline any photo upload prompt and disable iCloud sync at any time.
• Depending on your location (e.g., CCPA/CPRA, GDPR), you may have additional rights. Because we hold no server-side profile about you, contacting us by email is the fastest way to exercise them.

11. Changes to This Policy

If we change this policy, we will update the date above and, for material changes, display a notice in the app before the change takes effect.

12. Contact Us