This page is a draft and is not yet in force.
DRAFT — needs legal review. Not yet valid. Everything in
[SQUARE BRACKETS]is a placeholder the owner must fill or decide. Email addressesprivacy@glowyoon.appandsupport@glowyoon.appare placeholders until the domain is bought and the mailboxes exist.
Glow Yoon Privacy Policy
Last updated: [DATE] · Version: 0.1 (draft)
Glow Yoon (“the app”, “we”, “us”) is an augmented-reality (AR) beauty coach: live makeup guidance on your own face, Glow Scan, skincare routines, guided face massage, a daily Plan, a Learn feed, and Ask Lina, our coach chat.
The short version:
- Your face never leaves your phone. The camera picture, the points we find on your face (landmarks) and every photo are processed on your phone only. We have no server, database or storage that can hold a picture of you.
- You can use the app without an account. We create an anonymous ID for your installation so that purchases and Ask Lina work.
- Usage analytics are off until you say yes.
- We never sell your data and never use it for advertising. The app shows no ads and does no tracking across other companies’ apps or websites.
1. Who is responsible
The controller of your personal data is [COMPANY LEGAL NAME], [LEGAL FORM], [REGISTERED ADDRESS], [REGISTRATION NUMBER].
- Privacy questions and requests: privacy@glowyoon.app (placeholder)
- Everything else: support@glowyoon.app (placeholder)
- [EU REPRESENTATIVE under GDPR Art. 27, name and address — required if the company is not established in the EU but offers the app to people in the EU. Owner to decide.]
- [DATA PROTECTION OFFICER, if appointed — optional for a company of this size; owner to decide.]
2. What stays on your phone (never sent to us)
| What | What happens |
|---|---|
| Camera picture (live video frames) | Read on the phone to find your face and draw makeup, guides or massage paths. Each frame is used for a moment and then discarded. Nothing is recorded unless you press Record. |
| Face landmarks and measurements | Worked out on the phone. Never uploaded. |
| Hand position (face massage) | Hand tracking runs on the phone to count strokes. Never uploaded. |
| Glow Scan results | Your face shape, undertone, colour season and skin scores (such as shine, redness, evenness, texture, under-eye, hydration) are kept on the phone as labels and numbers. |
| Glow Scan photo (optional) | Only if you tap “Keep this photo on my phone”: one photo and its face points are kept inside the app’s private folder so your results can be shown on your own face. It is not in your gallery and is never uploaded. Only the newest two are kept. |
| Before and after photos (optional) | With “Before and after photos” on, the makeup coach or face massage keeps one photo at the start and one at the end, inside the app on your phone only. |
| Videos you record | Kept on your phone until you save or share them. |
| Quiz answers, plan, routines, progress, favourites | Stored on the phone. Sent to us only if you turn on account backup (section 3.4) — and never photos. |
Saving and sharing. A photo or video leaves the app only when you tap Save (it goes to your phone’s gallery) or Share (it goes to the app you pick, under that app’s privacy policy). We never receive it.
Deleting. Settings → Privacy lets you delete all practice photos, delete your face profile, or delete all your data. Everything stored on the phone is also removed when you uninstall the app. Photos you already saved to your gallery stay in your gallery.
Face data and biometrics. We use the shape of your face only to place makeup and guides and to give cosmetic suggestions, on your phone. We do not use it to identify you or anyone else, and we do not collect or store it.
3. What we process, why, and on what legal basis
3.1 Anonymous installation ID (everyone)
When the app first connects, our server creates an anonymous user and a device record: a random user ID, a random device ID, platform (iOS/Android), app version and build number, language/locale, country code [OWNER: confirm whether the country comes from the phone’s region setting or from the network], and whether it is a beta build. The app then holds sign-in tokens (stored in the phone’s secure keychain/keystore). We use your IP address only briefly to limit abuse (rate limits); it is not stored with your data.
- Why: to make the service work (purchases, Ask Lina, content updates, backup) and to protect it from abuse.
- Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); legitimate interest in security (Art. 6(1)(f)).
3.2 Ask Lina (only when you use the chat)
When you send a message, we receive the text you typed (and the last messages of the conversation, up to 20) and, to make the answer fit you, an optional context of fixed values: skin type, skin concerns, skin scores and overall score, undertone, colour season, the kinds of steps in your routine, the look you have open, coverage (none, hijab, niqab), language, Lina’s tone, and your age band (under 18 / 18 or over). The context contains no picture, no face points and no free text; our server rejects any request that looks like image data.
- We send your text and this context to our AI provider, Anthropic (default) [or OpenAI, if the owner enables it], which generates Lina’s reply. [OWNER/LEGAL: confirm the provider terms — commercial API, no training on API data, provider retention period — and list them here.]
- What we keep: the text of your questions and Lina’s answers, for at most 30 days [OWNER: current setting is 30 days; it can be lowered to 7 or to 0 = not kept], to investigate abuse and to include it in your data export; then it is deleted automatically. We also keep daily usage counts (number of messages, tokens used, cost) without any text, for up to 400 days, to enforce daily limits and for accounting.
- Please do not type sensitive information (health conditions, ID numbers, contact details of others) into the chat.
- Legal basis: performance of our contract (to answer you); legitimate interest (abuse prevention, limits).
3.3 Optional account
You can create an account with an email magic link (sent through our email provider, Resend), Sign in with Apple, or Google sign-in. We keep your email address (or the private relay address Apple gives) and the sign-in provider’s account ID. We do not keep your profile picture from Apple or Google. Your anonymous ID becomes your account, so purchases and progress carry over.
- Legal basis: performance of our contract.
3.4 Optional backup and sync (only if you turn it on while signed in)
We store a copy of: your profile answers (language, skill level, coverage, hijab style, country, age band, quiz answers including the first name you typed if you typed one, looks you liked or passed, skin type and concerns, Lina’s tone, reminder time), the numbers and labels from your Glow Scans (skin scores, overall score, undertone, season — never the photo or face points), your plan and routine settings, and your progress (what you completed and when, minutes, ratings, diary mood). Never photos, videos, scan images or face points.
- Legal basis: performance of our contract (the backup you asked for).
3.5 Purchases
Subscriptions and passes are bought through the Apple App Store or Google Play. We never see your card or bank details. Our subscription service, RevenueCat, receives the store receipt and your anonymous user ID so we know whether Premium is active. We keep subscription status and a record of each purchase event (product, price, currency, country, date) for 7 years for accounting and tax; if you delete your account, those records are unlinked from you.
- Legal basis: contract; legal obligation (accounting, Art. 6(1)(c)).
3.6 Usage analytics (only with your consent)
On first launch we ask whether you allow anonymous usage analytics. If you say yes, the app sends events such as “onboarding completed”, “routine started” or “paywall viewed”, with labels and counts only, to PostHog (EU servers), linked to your anonymous ID. Never images, face data, your name, your chat text or anything you type. Session replay and screenshots are off. You can change your choice any time in Settings → Privacy → “Share anonymous usage”.
- [OWNER: decide whether analytics stay off for users who chose “Under 18”. Recommended: yes, off.]
- Legal basis: consent (Art. 6(1)(a)); you can withdraw it at any time.
3.7 Crash reports
If the app crashes, a crash report (error, app version, device model and OS version, a scrubbed trail of recent app events, your anonymous ID) is sent to Sentry (EU region). Screenshots, attachments and the view hierarchy are switched off; web addresses and console logs are removed.
- Legal basis: legitimate interest in a working, safe app. [OWNER/LEGAL: decide whether crash reports also need consent in your markets; if so, put them behind the same switch as analytics.]
3.8 Voice commands (optional, off by default)
If you turn on voice commands in the coach, the app listens for “next”, “back” and “repeat” only while a coach session runs. Nothing you say is recorded or sent to us. Where your phone can understand your language by itself, recognition happens on the phone. If it cannot, the app asks you first, and then your phone’s own speech service (Apple or Google) processes what the microphone hears, under Apple’s or Google’s privacy terms.
3.9 Reminders
Reminders (skincare morning/evening, massage, quiz) are scheduled on your phone. We use no push service and hold no notification token.
3.10 Waitlist (only if you join)
If Ask Lina is not open yet and you ask to be told when it opens, we keep your email, language and country, send you one confirmation email through Resend, and delete it if you do not confirm within 30 days, or when you unsubscribe.
- Legal basis: consent.
3.11 Support emails
If you write to us, we keep your message and email address for as long as needed to help you, then [RETENTION, e.g. 2 years].
3.12 Early access list (website, only if you join)
If you join the beta list on our website, we keep your email, your language, which consent wording you agreed to and when, and how you found us: the tags of the link you followed (for example that it was the link in our Instagram bio) or the name of the website that sent you (such as instagram.com), never the full address of that page. We store it with Cloudflare, in the EU. We send no confirmation email: we write to you when the beta opens, with a few launch notes, and every email has an unsubscribe link. To stop people flooding the form, we count tries per network address for one hour; the address is kept only as a one-way hash and deleted after that hour.
- Legal basis: consent (the box you tick). You can withdraw it at any time with the unsubscribe link or by writing to us.
3.13 Website visits
Our website counts visits with Cloudflare Web Analytics: which pages are seen, the referring site, browser and country, as totals. It sets no cookies, keeps nothing on your device and does not identify you.
- Legal basis: legitimate interest (knowing whether the website works for visitors).
4. Who receives data (processors)
We use these service providers, under data processing agreements, only to run the app. None of them may use your data for their own purposes. [LEGAL: confirm each DPA.]
| Provider | Purpose | Location |
|---|---|---|
| Fly.io | Hosting of our API | EU (Paris) |
| Neon | Database | EU (Frankfurt) |
| Upstash | Rate limits and counters | EU (Ireland) |
| Cloudflare R2 | App content (looks, routines) — no user data | EU jurisdiction |
| Cloudflare Pages, D1 and Web Analytics | Hosting of our website; the early access list; visit counts without cookies | EU jurisdiction (list); website served worldwide |
| Anthropic (default) / OpenAI (if enabled) | Generating Ask Lina’s replies | USA |
| RevenueCat | Subscription status | USA |
| Apple, Google | App stores, payment, Sign in with Apple / Google | Worldwide |
| Resend | Sign-in and waitlist emails | [USA/EU — verify] |
| PostHog | Usage analytics, only with consent | EU |
| Sentry | Crash reports | EU |
Transfers outside the EU/EEA (for example to Anthropic, OpenAI, RevenueCat) rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. [LEGAL: verify per provider.]
We do not sell or rent personal data, and we do not share it for advertising. We may disclose data if the law requires it.
5. How long we keep data
| Data | Kept |
|---|---|
| Ask Lina messages (text) | at most 30 days, then deleted automatically |
| Ask Lina usage counts (no text) | 400 days |
| Anonymous user and device | until you delete your data; anonymous users with no app activity for 400 days and no active subscription are deleted automatically |
| Revoked devices | 90 days after sign-out |
| Account, backup (profile, plan, progress) | until you delete them |
| Purchase records | 7 years (accounting), unlinked from you after account deletion |
| Promo code redemptions | 3 years |
| Waitlist | unconfirmed: 30 days; confirmed: until you unsubscribe |
| Early access list (website) | until you unsubscribe, and at most [OWNER: e.g. 12 months] after the app launches |
| Website form tries (hashed address) | 1 hour |
| Security/audit log (IDs and counts only) | 365 days |
| Analytics events (PostHog) | [PostHog retention setting — owner to set] |
| Crash reports (Sentry) | [Sentry retention, e.g. 90 days — owner to set] |
| Data on your phone | until you delete it in the app or uninstall the app |
6. Your rights
Depending on where you live (for example the EU/EEA and UK under the GDPR, Algeria under Law 18-07, Morocco under Law 09-08, Malaysia under the PDPA 2010, Indonesia under Law 27/2022), you have the right to:
- access your data and get a copy — Settings → Privacy → Export my data (on the phone; once backup exists, the export also includes what our server holds);
- delete your data — Settings → Privacy → Delete all my data (removes everything on the phone and, if you have an account or anonymous server record, deletes it on our server immediately);
- correct your data (edit your answers in the app);
- withdraw consent (analytics switch in Settings) without affecting earlier processing;
- object to processing based on legitimate interest, and restrict processing;
- data portability (the export is a machine-readable JSON file);
- complain to a data protection authority, for example the CNIL (France), the ANPDP (Algeria), the CNDP (Morocco), or your local authority.
Deleting your data in the app does not cancel a store subscription: cancel it in your App Store or Google Play settings. You can also ask us by email at privacy@glowyoon.app (placeholder); we answer within one month. [OWNER: provide a public web page for deletion requests — Google Play requires one.]
7. Children and teenagers
Glow Yoon is not for children under [13 / 16 — owner and legal to decide per region; e.g. 15 in France for consent-based processing]. If you are under 18, the app asks your age band once (only “Under 18” or “18 or over” is stored, never a birth date) and then:
- shows no Premium offer during onboarding;
- tells Lina that you are under 18, so she keeps to gentle basics, suggests no strong actives (no retinoids, strong acids or peels) and suggests checking new products with a parent or guardian;
- [OWNER: analytics off for under-18 — recommended.]
If you are under the age of digital consent in your country, please use the app with a parent or guardian’s permission. If we learn that we hold data of a child under the minimum age, we delete it. Parents can contact privacy@glowyoon.app (placeholder).
8. Security
Connections between the app and our server are encrypted (HTTPS/TLS). Sign-in tokens are stored in the phone’s secure storage and rotated. Our server rejects any upload that looks like an image or face data, and our logs do not contain message text, emails or request bodies. Data on your phone is protected by your phone’s own security; keep your phone locked.
9. AI and cosmetic guidance
Lina’s answers are generated by an AI model and can be wrong. They are cosmetic tips, not medical advice. Glow Scan scores are cosmetic estimates from the camera picture, not a diagnosis. For any skin problem, see a dermatologist or doctor. See the Terms of Use.
10. Changes
We will update this policy when the app changes. If a change is important, we will tell you in the app before it takes effect. The date at the top shows the latest version.
11. Contact
[COMPANY LEGAL NAME], [ADDRESS] — privacy@glowyoon.app (placeholder)