Privacy Policy

1. Overview

This Privacy Policy applies to the Skintel iOS application, skintel.app, and related services (together, the “Service”). Skintel is operated by CodesWhat (“Skintel,” “we,” “us,” or “our”). CodesWhat is the controller of personal data processed under this policy unless another party is identified at the point of collection.

You must be at least 18 years old to use the Service. By using Skintel, you acknowledge the practices described here. Where consent is required—particularly for sensitive data, facial-image analysis, HealthKit access, or future model training—we will request it specifically in the app before that processing begins.

2. Data we collect

Depending on the features you choose, Skintel may collect the following:

The website does not currently use advertising trackers. If you choose “Get early access,” your device opens an email addressed to us; we receive only what you choose to send.

3. How we use data

We use personal data to:

• Create and secure your account and remember your preferences.
• Store your photo history and calculate longitudinal skin measurements.
• Connect changes in your skin with products, routines, weather, sleep, activity, cycle information, and other context you choose to provide.
• Show your own persisted scores and directional cosmetic trends over time.
• Provide attributable product-catalog facts without making safety conclusions.
• Manage support and respond to privacy or account requests.
• Detect fraud, abuse, security incidents, and technical failures.
• Comply with law, enforce our terms, and protect users and the Service.

Where applicable, our legal bases include performing our contract with you, your consent, our legitimate interests in operating and securing the Service, and compliance with legal obligations. We rely on explicit consent when required for sensitive personal data.

Free-tier metric contribution

The first onboarding screen specifically identifies contribution of deidentified, server-produced metric vectors as included with Free scoring. Your explicit data-use agreement records that contribution as its own versioned purpose. It excludes raw selfies, account identifiers, HealthKit context, and the city/state or ZIP used for weather. A Free user may withdraw, but new photo upload and scoring then stop; a Pro user may withdraw and continue scoring. Phase 0 does not run an active cohort job, so no separate metric-vector copy is currently created for this purpose.

4. AI and automated processing

Skintel uses automated systems and third-party analysis providers to evaluate a normalized copy of the selfie you submit and return bounded cosmetic appearance metrics. The image and cosmetic scoring instructions may be sent to providers acting on our behalf. HealthKit values, weather context, account identifiers, and product routines are not included in that scoring request.

Automated outputs may be incomplete, inconsistent, or wrong. They are designed to help you notice personal patterns, not to diagnose, treat, cure, or prevent any condition. Do not use Skintel for urgent or high-risk health decisions. You may contact us if you want information about an automated result or believe it is incorrect.

Model training

Phase 0 does not ask for or grant permission to train or fine-tune a model on user photos, metrics, or HealthKit data, and no such training occurs. A future use of identifiable facial photos for model training or evaluation would require a separate just-in-time affirmative opt-in and would not be a condition of Free scoring. You could withdraw that permission before future eligible use and request deletion of retained source material.

5. Facial images and biometric-data notice

Skintel analyzes facial images to measure cosmetic skin characteristics and changes over time. Skintel does not use facial recognition to identify you or compare your identity against other people. Even so, facial images and measurements may be treated as biometric information under some laws.

Collection and use

We collect and use facial images and derived measurements to provide your baseline, daily score, progress history, and capture-quality checks. We do not sell, lease, trade, or otherwise profit from biometric information itself.

Disclosure

We disclose facial images or derived measurements only to service providers that need them to host, secure, or perform the analysis; when you direct us to; or when disclosure is required by law. Providers must protect the data at least as carefully as this policy requires and may not use it for their own advertising.

Public retention and destruction schedule

We retain facial images and derived biometric information only while reasonably needed for the purposes above. We permanently delete them when the purpose has been satisfied or within three years of your last interaction with Skintel, whichever occurs first, unless a valid warrant, subpoena, or other law requires preservation. An authenticated account deletion request triggers deletion from active systems within 30 days; encrypted backup copies may persist for up to 90 additional days before automatic expiration. We apply this schedule to our service providers as well.

6. HealthKit and weather

Apple HealthKit

HealthKit access is optional and controlled through Apple’s permission settings. If you connect it, Skintel uses only the specific data types you authorize to provide skin-related context and insights directly to you. We do not use HealthKit data for advertising, marketing, cross-context tracking, data-broker services, or model training. We do not sell HealthKit data or disclose it to a third party unless that party provides a health or fitness service to you and you expressly permit the disclosure.

You can stop future HealthKit access in iOS Settings. Revoking permission does not automatically delete data already imported into Skintel; you can delete that data by deleting your account or contacting us.

Weather

Skintel does not request device-location permission. If you choose to add weather context, you enter a city/state or ZIP. That query stays in local app storage and is resolved on the device through Apple services. Skintel stores only bounded derived weather values, such as temperature, humidity, precipitation, and UV index, with a daily entry; it does not send the query or coordinates to the Skintel backend or product analytics. You can remove the local weather configuration in the app.

7. How we disclose data

We may disclose data to the following categories of recipients:

• Infrastructure providers for authentication, databases, encrypted storage, networking, backups, and security, including Supabase and its subprocessors.
• Analysis providers that process images or text to return a result to Skintel under our instructions.
• Platform providers such as Apple and Google for sign-in and Apple geocoding and WeatherKit services for optional environmental context.
• Operational providers for diagnostics, customer support, fraud prevention, and constrained anonymous product analytics. Skintel sends PostHog only a random app-generated identifier and allowlisted coarse events while analytics is enabled; it does not send photos, scores, metrics, HealthKit values, weather queries, account identifiers, prompts, or model responses.
• Legal or safety recipients when reasonably necessary to comply with law or protect the rights, safety, and integrity of users, Skintel, or others.
• Transaction recipients in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality and notice.

We require service providers that access user data to provide protections equivalent to those described in this policy and to process the data only for the contracted service.

No sale or behavioral advertising

Skintel does not sell personal information or share it for cross-context behavioral advertising. We have not sold or shared personal information for those purposes in the preceding 12 months. We do not knowingly sell or share information about anyone under 18.

8. Retention and deletion

Our standard retention schedule is:

You may initiate account deletion in the app’s account settings. You may also email hi@codeswhat.com for help with a data request. We may retain limited information when required by law, needed to complete a transaction, prevent fraud or abuse, resolve disputes, or enforce agreements. De-identified information that can no longer reasonably be linked to you may be retained for research, statistics, and service improvement.

9. Your choices and privacy rights

Depending on where you live, you may have the right to access, know, correct, export, delete, or restrict use of personal data; withdraw consent; object to certain processing; opt out of sale or sharing; limit use of sensitive personal information; and appeal a denied request. We will not discriminate against you for exercising a privacy right.

Submit a request through the app’s settings or email hi@codeswhat.com. Please use the email associated with your account. We may need to verify your identity before completing a request and may deny or limit a request where permitted by law. An authorized agent may submit a request when local law allows and appropriate authorization is provided.

You may decline optional HealthKit access, weather configuration, and product analytics. You may also withdraw photo-processing or metric-contribution consent. Withdrawing metric contribution on Free stops new upload and scoring; a Pro entitlement permits continued scoring after withdrawal. Any future raw-selfie contributor program would require a new, separate affirmative choice.

California residents

California residents may exercise rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service. Because Skintel does not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing to opt out of. We use sensitive information only to provide, secure, and improve the services you request or with your consent.

EEA, United Kingdom, and Switzerland

You may also have rights to data portability, restriction, objection, withdrawal of consent, and complaint to your local data-protection authority. Withdrawal does not affect processing that was lawful before withdrawal. Where we rely on legitimate interests, you may request information about our balancing assessment.

10. Security and incident notice

We use safeguards designed for sensitive information, including encrypted transport, encrypted storage, private photo buckets, account-scoped access controls, protected credentials, logging, and vendor controls. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur.

If we discover a breach involving covered health or other personal information, we will investigate and notify affected users and regulators as required by applicable law, including the FTC Health Breach Notification Rule where it applies.

International transfers

Skintel and its providers may process information in the United States and other countries whose data-protection rules differ from those where you live. Where required, we use an approved transfer mechanism and appropriate safeguards.

Children

Skintel is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided data, contact us and we will take appropriate steps to delete it.

11. Changes and contact

We may update this policy as Skintel changes. If an update materially affects how we use sensitive data, we will provide prominent notice and request new consent where required. The effective date above identifies the current version.

Questions, privacy requests, or complaints can be sent to CodesWhat, operator of Skintel, at hi@codeswhat.com. Please include “Skintel Privacy” in the subject line.