Privacy Policy

Version 2026-09-28 · Last updated and effective: September 28, 2026

Skinchii helps you organise your beauty products, routines and reminders. This policy explains what information the Skinchii mobile app, this website and related services collect, why, who processes it for us, how long we keep it and the choices you have.

1. Who we are

Skinchii (“Skinchii: Skincare Tracker” on Google Play) is provided by the Skinchii team (“we”, “us”). We are responsible for (the “controller” of) the personal information described here. For any privacy question or request, email Skinchii support or write to us in the app under Help.

2. Information we collect

Account information

• Email address, display name and a unique user ID created by Firebase Authentication.
• Whether your email address is verified, and how you sign in (email and password, or Google sign-in where available).
• Your password is handled by Firebase Authentication. We never see or store it. If you use Google sign-in, Google shares your name, email address and account identifier with us.

Profile and preferences

Skin type and skin concerns (if you choose to add them), time zone, language/region, currency, app theme and mascot accessory, accessibility settings (reduce motion, haptics), whether you agreed to marketing messages, onboarding status and when you last used the app.

Your beauty organiser content

• Products you add: name, brand, category, sub-category, shade, barcode, size, quantity, remaining amount, purchase date, price and currency, opened date, expiry date, period-after-opening, batch code, storage location, status, favourite flag, rating, notes, tags, custom categories, product photos and usage history.
• Routines: names, schedules, steps, timers, reminder times, completed/skipped/missed sessions and streaks.
• Wishlist items (name, brand, link, price, priority, notes, photo) and articles you save.
• Goals you set and their progress.

Journal and progress photos

Journal entries (date, mood, skin rating, skin conditions, notes, tags) and progress photos with their area, date and notes. These are private to your account: the Skinchii team cannot view them (see section 6).

Your skin type, skin concerns and journal notes about your skin can count as health information in some countries. We ask for your consent before you add your skin type and concerns, use all of this only for the features you add it to, never use it for ads, and you can delete it at any time.

Notifications

Your notification settings (categories, warning days, quiet hours), a push notification token for your device together with its platform, device name and app version, and the history of in-app notifications we sent you. Routine reminders can also be scheduled locally on your device.

Free Premium week

Every new account gets 7 days of Premium features free (the free Premium week). We store its start and end time, whether our team ended or extended it, and whether we sent you the "ends soon" reminder and the "has ended" message. To give each person one free week, we also keep a one-way keyed hash of your email address (not the address itself) for 12 months — including after you delete your account — so that a new account with the same address does not get a second free week.

Subscriptions and purchases

Premium is sold by our payment partner Dodo Payments (merchant of record). Dodo Payments runs the checkout: you give them your name, email address, billing address and card details, and they process the payment and any tax and send your receipts. Your card number never reaches us, and we never store card details (Dodo Payments' payment notices can name the card brand and last four digits; we discard them). Dodo Payments tells us your customer and subscription IDs, the product, status, billing period and key dates (start, renewal, trial end, cancellation, refunds), which we store with your account together with the payment events we receive. We also keep a record of each checkout we open for you (plan, how many free days it keeps, where it was opened: website or app, and the app platform). For purchases started in the Android app in the United States, Google Play gives us a transaction token that we must report back to Google; we store it with that checkout record. When you sign in to your Skinchii account in a web browser, the browser keeps you signed in using its local storage (not cookies) until you sign out.

Older accounts may still have a record of a subscription bought through the Apple App Store or Google Play before 2026-09-26; we keep such records only as history.

Support

Messages you send through in-app Help or by email, the topic you choose, and the app version and platform you were using.

Website waitlist

Before launch you can join the Skinchii waitlist on this website. If you do, we collect your email address, your consent to receive launch updates (and when you gave it) and, only if you choose to tell us, whether you use iPhone, Android or both. We also record the page you signed up from (including any campaign tags in the link) and your browser's language setting. To prevent spam and abuse, our server stores a one-way, salted hash of your IP address — not the address itself — and your browser's user-agent string.

• The form sends this information to our Firebase server function, which stores it in our Supabase database.
• We use it only to email you about the launch of Skinchii. We do not use it for other marketing, and we do not sell or share it.
• You can ask us to delete your waitlist entry at any time by emailing Skinchii support. See section 7 for how long we keep it.
• This website does not set cookies and does not use advertising or analytics trackers.

Device features and on-device processing

• The camera and photo library are used only when you scan a barcode or choose to add a photo. Photos are uploaded only when you save them.
• When you take a progress photo with the guided camera, it checks small preview pictures on your phone with Google ML Kit to find your face and help you line up the shot. These preview pictures are deleted right away and never leave your phone; only the photo you save is uploaded.
• Barcode scanning and reading text from a product label (where your device supports it) also happen on your phone with Google ML Kit; only what you save is stored. See section 4 for the usage metrics ML Kit sends to Google.
• The app keeps a cached copy of your data on your device so it works offline.

Advertising in the free app

The free version of the Skinchii Android app may show ads from Google AdMob to Free accounts and, fewer of them (never full-screen), during the free Premium week. A paid Premium subscription and Premium granted by the Skinchii team have no ads, and the ad software is not started for them. The iPhone app currently shows no ads.

When the app shows ads, Google's Mobile Ads SDK collects your device's advertising ID, app set ID, IP address (from which an approximate location is derived), information about the ads you see and tap, and diagnostic data, and uses them to show and measure ads and to prevent fraud. In the European Economic Area, the United Kingdom and Switzerland, Google's consent message asks for your choice first, and ads are personalised only with your consent. In US states with privacy laws, ads may be personalised unless you opt out of the “sale” or “sharing” of your information for targeted ads under Me → Settings → Privacy → Ad choices (see section 8). Learn more in How Google uses information from sites or apps that use its services.

• Skinchii never shares your journal, progress photos, goals, face-care activity, skin details, product list or account details (such as your email address or user ID) with ad networks, and never uses them to choose ads.
• Ads never appear on private, camera, checkout or settings screens (your journal, progress photos, goals, face-care sessions, scanning, Premium and settings).
• Ads are clearly labelled and are not directed at children. We never allow ads rated for mature audiences (by default we limit them to Google's parental guidance (PG) rating) and block sensitive categories such as dating, weight loss, cosmetic procedures, gambling and alcohol.
• If you report an ad (“Why ads?” → “Report this ad”), we keep the ad's advertiser name, headline and response ID, the reason you chose and the app version — not your account ID. We keep only anonymous daily totals of ad activity (for example how many ads were shown or hidden on a screen), without any user or device ID. To prevent abuse we briefly record (for 2 days) that your account sent a report or a batch of these totals, without their content.

Technical and security information

Our infrastructure providers record technical logs such as IP address, request time and error details when the app talks to our servers. We keep an audit log of actions taken by Skinchii team members in our admin tools.

App error reports. When the app runs into an error (including when it closes unexpectedly), it sends us a short report linked to your account ID: the error type, a shortened message with email addresses, tokens, long IDs and phone numbers removed, the screen (never the content you were viewing), the app version and release channel, the platform, your device's Android version and memory size, the time, and a code made from the error's technical trace. We use these reports only to find and fix problems, and keep them for 90 days.

We do not sell your personal information for money. The free app may show ads through Google AdMob (see Advertising in the free app). In some US states this can count as “selling” or “sharing” personal information for targeted advertising — you can opt out under Ad choices in the app (see section 8). We don't use third-party analytics or crash-reporting services: the app's own error reports and Google ML Kit's usage metrics are described in this policy.

3. How we use information

4. Service providers

We use these providers to run Skinchii. They process information on our behalf and only for the purposes described.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition (with notice to you).

Product catalog credits

Product catalog data includes information from Open Beauty Facts (https://world.openbeautyfacts.org), made available under the Open Database License (ODbL); product images under Creative Commons BY-SA.

5. Where data is processed

App data is stored in our Supabase project hosted in Tokyo, Japan (AWS ap-northeast-1). Our Firebase server functions run in the Google Cloud region asia-south1 (Mumbai, India). Firebase Authentication, Expo, Dodo Payments, Google AdMob, Google ML Kit, Apple and Google may process data in other countries, including the United States.

When information is transferred to another country, we rely on our providers' data protection terms, including the European Commission's standard contractual clauses where they apply.

6. Access by the Skinchii team

A small number of team members use an admin console with role-based access (support, billing, content, analytics). Depending on their role they can see account basics (email, display name, status, plan, time zone), usage counts, subscription records and your support conversations. They cannot view your journal entries, progress photos or goals. Every admin action — including viewing an account — is recorded in an audit log.

Team members with the content or analytics role can view the website waitlist so that we can send the launch email; exporting or deleting waitlist entries is also recorded in the audit log.

7. How long we keep data

• Account and organiser data: while your account is active, until you delete it or ask us to.
• In-app notifications: read or dismissed notifications are deleted after 180 days, and all notifications after 365 days.
• Push delivery logs: 30 days. Push tokens that stop working are deleted 90 days after they become invalid.
• Website waitlist: until Skinchii launches. After we have sent the launch announcement, the waitlist is deleted. You can ask us to delete your entry sooner at any time. Rate-limiting records (hashed only) are deleted after 2 days.
• App error reports: 90 days. Security event records: 1 year.
• After you delete your account we keep only what is described on the account deletion page: the record of your deletion request for 3 years, subscription and payment event records for 8 years (accounting and tax records), and audit logs of actions by Skinchii team members for 2 years. App error reports lose the link to your account straight away and are deleted within 90 days.
• Backups kept by our database provider expire within 7 days.
• Data cached on your device stays there until you clear the app's data or uninstall the app.

8. Your rights and choices

• Access and export: in the app, go to Me → Settings → Data & Backup to download a copy of your data.
• Correction: edit your profile, products and other content in the app at any time.
• Deletion: delete your account in the app or follow the steps on the account deletion page.
• Waitlist: withdraw your consent or ask us to delete your waitlist entry by emailing Skinchii support.
• Notifications: change categories and quiet hours in Me → Settings → Notification settings, or turn notifications off in your device settings.
• Permissions: camera, photos and notifications can be turned off in your device settings at any time.
• Ads: where the law requires it, open Me → Settings → Privacy → Ad choices to review or change your choices for Google's ads, including the opt-out of “sale” or “sharing” for targeted ads in US states with privacy laws. On Android you can also reset or delete your advertising ID in your device settings (Settings → Privacy → Ads, or Google → Ads). Your choices never change how many ads you see or which features you get. A Premium subscription removes ads.
• Marketing: opt out in the app or by contacting us.
• Depending on where you live you may also have the right to object to or restrict processing, to data portability and to complain to your data protection authority. Contact Skinchii support to exercise any right; we will respond within 30 days.

9. Security

Data is encrypted in transit (TLS). Database rules make sure each account can read and change only its own data, private photos are stored in private storage and shown through short-lived links, and admin access is limited by role and logged. No system is perfectly secure, so please use a strong, unique password and tell us about any concern at Skinchii support.

10. Children

Skinchii is not intended for children under 16. Ads in the app are not directed at children. If you believe a child has created an account or joined the waitlist, contact us and we will delete it.

11. Changes to this policy

We will post any update on this page and change the date above. If a change is significant we will also let you know in the app before it takes effect.

12. Contact us

Skinchii
Email: Skinchii support
In the app: Help