Privacy Policy

Last updated: 16 September 2026

This policy explains what Skinify collects when you use the Skinify app, why, who else receives it, how long we keep it, and what you can do about it. If a translation differs from the English version, the English version applies.

1. Who we are

Skinify ("we", "us") runs the Skinify app, an AI skin-analysis and skincare-routine service. We are responsible for your personal data as described here. Contact: support@skinify.ai.

2. The short version

You take photos of your face. AI providers analyse them, and we keep the photos and results with your account.
We use your data to give you skin results and routines and, in Tunisia, to deliver the products you order.
We do not sell your personal data.
Analytics and advertising partners receive information about how you use the app. On iPhone, cross-app tracking only happens if you allow it.
You can delete your account, and everything in it, at any time in the app.

3. What we collect

Account

A sign-in identifier from Firebase. You can start as a guest, or sign in with Google or Apple.
Your email address and name from Google or Apple, or a generated guest name. Apple may give us a private relay address instead of your email.
A profile photo, if you upload one.

Profile

Your age and gender, if you give them, your skin type, your language, and your country, taken from your choice or your phone's region setting.
Your market: Tunisia, where we sell products, or international, where Skinify is a subscription.

Face photos and scan results

Each photo you take for a scan.
Its results: skin type, seven skin-condition scores, an overall score, a skin-age estimate, a confidence level, your main concerns, recommended ingredients and written explanations.
What the AI estimates from the photo: your apparent age, apparent gender and skin phototype (Fitzpatrick type).
Your feedback on a result.

Skin-condition scores describe how your skin looks and may count as health-related information in some countries. We only create them because you ask for a scan.

Face-matching profile

To check that new scans show the same person, the AI also estimates a few coarse traits from each photo: skin colour, eye colour, face shape and skin phototype. Once you have a few good-quality scans, Skinify keeps a summary of these traits. It is not a facial-recognition template, cannot identify you, and is only used to flag scans that may belong to someone else. It is stored with your scans and deleted with them.

Orders and delivery (Tunisia)

Your phone number, delivery address (governorate, municipality, street) and the name on the order.
What you ordered, prices, order status, and notes from the call we make to confirm the order.

Subscriptions (outside Tunisia)

Your subscription status, product, store, and renewal and expiry dates, which we receive from Apple or Google through RevenueCat. We never see your card details.

Routines and activity

Your routines and products, what you log each day, streaks, badges, reminders, product feedback and restock dates.

Messages, support and reports

What you send us: support requests, call-back requests, feedback, and reports about products or other users.
If you apply to our ambassador program: your application, its status and your contact phone number.

Device, usage and logs

App version, platform, device brand and push-notification token.
Server logs: IP address, account identifier, the request made and when.
How you use the app (screens and actions), crash reports and performance data.
In Tunisia only: recordings of how a small share of sessions move through the app, with all text and images masked. They are never made on the camera, results or checkout screens, and only over Wi-Fi.

Search

The words you type in product search. They are processed without your account identifier.

What we do not collect

Your precise location, your contacts or any audio. The UV index uses only the centre point of your country.

4. How we use it

To provide Skinify (to perform our agreement with you): your account, scans, results, routines, reminders, progress, friends and support.
To analyse your face photos (with your explicit consent, which you give by starting a scan): see section 5. You can withdraw it by deleting your account, or by asking us to delete specific scans.
To take and deliver orders in Tunisia (agreement): confirming orders by phone, preparing and delivering them.
To manage subscriptions (agreement).
To understand and improve the app (our legitimate interest): analytics, crash reports and performance data.
To measure our advertising (with your consent where the law or your device requires it): see section 7.
To send you messages (our legitimate interest, or your consent where required): reminders, order updates and news. We may choose which messages to send based on your profile and scan results. See section 9 to turn them off.
To keep Skinify safe and meet legal duties: preventing abuse, handling reports and answering lawful requests.

We do not make decisions about you that have legal or similarly significant effects based only on automated processing. Scan results are cosmetic suggestions.

5. How AI analyses your photo

Your photo is resized on your phone, sent to our servers over an encrypted connection, and passed to AI providers through OpenRouter. It is sent as image data, never as a public link.
Anthropic (Claude) reads the photo. If that fails, Google (Gemini) does. With the photo we send your age, gender, known skin type and your recent scores, so readings stay consistent.
Text-only steps (explanations, routine building, product descriptions) use models from Google and Mistral. They receive scores and profile details, not your photo. Product-search words are sent to OpenAI to find matching products.
These providers process the data to return a result, under their terms for business customers. We do not use your photos to train AI models, and we do not sell or license them.
We keep the photo in private cloud storage (Cloudflare R2), linked to its scan, so we can review an analysis if something looks wrong. It is never publicly accessible.
The "How Skinify works" page in the app explains how the analysis works.

6. Who we share it with

We share only what each of these needs:

Hosting and infrastructure: Fly.io (servers in the United Kingdom), MongoDB Atlas (database), Cloudflare (photo storage), and Google Firebase (sign-in, push notifications, crash reports, performance, remote configuration and app-integrity checks). Crash reports include your account identifier and email.
AI providers: OpenRouter, Anthropic, Google, Mistral and OpenAI, as described in section 5.
Analytics: Mixpanel (app events, your account identifier, and your name and email on your analytics profile) and Google Analytics for Firebase (app events, including the skin type and score of your first scan).
Advertising and attribution: AppsFlyer, Meta, TikTok and Google. See section 7.
Purchases: Apple and Google take subscription payments, and RevenueCat manages subscription status.
Sign-in: Google and Apple, if you sign in with them.
Email: our email provider (Titan), which keeps copies of emails we send, such as order confirmations.
Orders in Tunisia: our order team, the partner sellers whose products are in your order, and the people who deliver it receive your name, phone number, email and delivery address.
Other Skinify users: friends you add see your display name. Any signed-in user who has your account link (for example from an invite you shared) can see your name, profile photo and public routines.
Legal and safety: authorities or others, when the law requires it or to protect our users, our rights or the public.
Business changes: a buyer or successor if Skinify is merged, sold or reorganised, who must respect this policy.

7. Tracking and advertising

AppsFlyer, Meta, TikTok and Google help us understand which ads bring people to Skinify. They receive app events such as sign-up, checkout and purchase (with the amount), plus your Skinify account identifier and name.
On iPhone, Skinify asks for permission to track after your first results. If you allow it, these partners may also receive your device's advertising identifier, TikTok may receive your phone number and email, and Google your email, to match ads. If you decline, none of these are shared. You can change your choice at any time in Settings → Privacy & Security → Tracking.
On Android, the same partners may receive your device's advertising ID, phone number and email. You can reset or delete the advertising ID in your phone's settings.
Your face photos are never shared with advertising partners.

8. How long we keep it

Your account and everything in it (profile, scans, photos, routines and orders) is kept for as long as the account exists. Nothing expires automatically, including guest accounts, so delete your account if you stop using Skinify.
Deleting a scan (for example one flagged as someone else's, or at your request) deletes its results and its photo.
Deleting your account deletes your data straight away. The "Delete Account & Data" page in the app lists exactly what is removed.
What can remain after deletion: server logs and database backups, for a limited period until they are overwritten; copies of order emails held by our email provider, our order team and partner sellers; records of messages we sent you and of reports other users made about you; and data already held by the analytics and advertising partners above, under their own retention rules. Email us and we will ask them to delete it.
We may keep aggregated statistics that cannot identify you.

9. Your rights and choices

Depending on where you live (for example under the GDPR in the European Union or the United Kingdom, Tunisian data-protection law, or US state laws), you can:

access the data we hold about you and receive a copy in a portable format;
correct it (most of it directly in Settings);
delete it (in the app, or by email);
object to or restrict some uses, including analytics and marketing;
withdraw your consent at any time, without affecting what was done before;
complain to your data-protection authority.

To use these rights, email support@skinify.ai from the address linked to your account, or tell us how to find your account. We answer within 30 days and may need to confirm your identity.

Your controls in practice:

Delete your account in Settings → Delete Account & Data. A scan flagged as someone else's can be removed from its result screen, and we delete any other scan on request.
Push notifications: turn them off in your phone's settings. The switches in Skinify's Settings control the reminders scheduled on your phone.
Marketing emails: use the unsubscribe link in any of them.
Tracking on iPhone: Settings → Privacy & Security → Tracking.
Subscriptions: manage or cancel them in your App Store or Google Play account. Deleting your account does not cancel them.

10. Security

The app talks to our servers over encrypted connections (HTTPS), using short-lived sign-in tokens.
Data Skinify stores on your phone is encrypted.
Photos are kept in private storage with no public links.
Only people who need access to personal data for their work have it.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

11. Children

Skinify is not meant for children under 13, or under the age of digital consent where you live (up to 16 in some European countries). We do not knowingly collect their data. If you think a child has used Skinify, email us and we will delete the account.

12. International transfers

Our servers are in the United Kingdom, and our providers process data in other countries, including the United States and the European Union. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

13. Changes to this policy

When our practices change, we update this page and its date. For significant changes, we will also tell you in the app.

14. Contact

Skinify, support@skinify.ai