Privacy Policy

This Privacy Policy explains how Teddy App Labs (“we”, “us”, “our”) collects, uses, and protects information when you use GlowKit (the “App”). GlowKit is a private AI skin routine and progress tracker for cosmetic, non-medical self-care. We designed it so that trust comes first — especially around your scan photos.

1. Information we collect

We aim to collect as little as possible. Depending on how you use the App, this may include:

• Photos you scan. Selfies or images you choose to analyze. The photo may be saved locally on your device for scan history. Full cloud analysis can also store a prepared scan photo privately for your account history — see Section 2.
• Scan results. Your GlowScore, signal breakdown, product guide, routine, locked reveal state, and progress history, stored locally and, for cloud-backed account progress, in Supabase.
• Account identifiers. GlowKit starts with a private Supabase account for sync. Apple Sign In can link that account if you choose to make it recoverable across installs and devices.
• Purchase information. Your subscription, trial, restore, and Pro entitlement status, managed through Apple and RevenueCat. We do not receive or store your full payment card details.
• Local personalization. Bounded Glow Profile choices, seven-day program state, daily check-ins, routine edits, and reminder preferences stay on your device.
• My Shelf products. The product name you type plus the category, routine placement, and fragrance label you pick. These are stored on your device and mirrored to your own Supabase account so your shelf survives a reinstall and appears on any device signed in to that account. Only you can read them; GlowKit does not look them up in any barcode, retailer, price, or ingredient database, does not send them to AI providers or advertisers, and never uses product names as analytics properties.
• Optional UV context. After you ask for current-area context, a location — or a city you enter — is sent to Apple services to fulfill the request. GlowKit does not cache raw coordinates. It keeps the returned place label, UV snapshot, provider attribution, and expiry locally for about 90 minutes.
• Glow Coach. Text you type is first checked on-device: anything reading as a symptom, reaction, or other medical question is refused there and never sent. Other questions are sent as written, with the recent turns of that conversation, through GlowKit's Worker with no-store handling, alongside coarse enum/count context. When you ask why your radiance changed, the request also includes your own already-revealed scan results from about the last three months — the glow score, program day, and calendar date of each — so the answer can cite your real readings; the other two questions do not include them. Images, scan IDs, product names, and clock times are not included. Glow Coach can propose a change to your own plan — a routine step, a reminder time, or a My Shelf entry — but it never makes one: the proposal appears as a card in the conversation and is written, on your device only, if you tap Apply.
• Product interaction analytics. Coarse app events such as v2 step ID, plan/baseline funnel state, bounded source/count buckets, paywall source, purchase or restore outcome bucket, check-in/weekly-loop state, and delete-data outcome. These events do not include photos, profile or check-in answer values, product names, typed Coach text, raw GlowScore, signal values, scan IDs, Supabase IDs, Apple identity, email, free-form text, or ad identifiers.
• Website analytics. Public website page views, approximate region, browser/device category, referrer information, and privacy-safe App Store or product-page click events from glowkit.org, collected through Google Analytics in consent mode. Analytics cookies remain denied by default; the website writes them only if you choose Allow analytics. The tag does not send photos, scan results, GlowScore, scan IDs, account identifiers, emails, support text, or app identifiers.
• Diagnostic data. Crash, performance, and error information used to keep the App reliable and separate test/debug traffic from production usage.
• Support communications. If you email us, we keep your message and contact details to respond.

2. How we handle your photos

GlowKit has two scan paths:

• Free locked preview. Free users can complete one guided scan. The preview is generated on device and saved locally as a locked result unless you unlock Pro.
• Full cloud analysis. When full analysis runs, your selected photo is transmitted securely to GlowKit's cloud service and may be shared with OpenRouter and OpenAI as AI vision providers solely to generate your GlowScore, five visible signals, product guide, routine, and progress record.
• Private account history. For full cloud analysis, the prepared scan photo can be stored privately in Cloudflare R2 under your Supabase account so progress can sync.
• Optional account recovery. Apple Sign In can link your Supabase account so synced history can follow your account across installs and devices.

We never sell your photos, share them with advertisers, or use them to train machine-learning models. Saved scan photos are private to your device or account and can be deleted through the local or account data flow.

3. Face data and AI providers

GlowKit does not collect Face ID templates, biometric identifiers, faceprints, or identity verification data. The only face data GlowKit collects is the selfie or face photo you choose for a scan and the cosmetic visual signals derived from that photo, such as GlowScore, clarity, hydration, texture, even tone, radiance, product guidance, and routine suggestions.

We use this face data only to provide the scan you request, improve scan-quality feedback, create cosmetic and non-medical results, save your private progress history, and support account recovery or sync if you link Apple Sign In.

For full Pro cloud analysis, your selected photo is sent to GlowKit's Cloudflare Worker and may be shared with OpenRouter and OpenAI as AI vision providers. They receive the image and prompt needed to return the cosmetic analysis and act as service providers for this purpose. OpenRouter requests are configured to prefer zero-data-retention routes where available. OpenAI API inputs and outputs are not used to train OpenAI models by default and may be retained by OpenAI for a limited abuse-monitoring period under OpenAI's API terms. GlowKit does not authorize any AI provider to use scan photos for advertising or model training.

Synced scan photos are stored privately in Cloudflare R2; scan metadata and derived results are stored in Supabase. Local scan photos and results remain on your device until you delete them in the App or remove the App. Cloud-synced photos, metadata, and results remain until you request account data deletion.

4. How we use information

We use information only to operate and improve GlowKit, specifically to:

• Run scan-quality checks and create your locked scan preview or full Pro result.
• Generate your GlowScore, 5-signal breakdown, product guide, and explainable routine.
• Show your progress trend, scan history, and before/after comparisons.
• Build your local seven-day plan, save one editable daily check-in, keep your reminder choices, and keep your manual shelf available across your own devices.
• Provide optional UV context and bounded Pro cosmetic Coach guidance when you request them.
• Manage your subscription, free trial, and restore-purchase requests.
• Understand activation, scan reliability, paywall conversion, and privacy-control usage through coarse product analytics.
• Understand which public website pages are useful through consent-mode website analytics.
• Maintain reliability, prevent abuse, separate debug/test traffic, and fix problems.
• Respond to your support requests.

5. Sharing & service providers

We do not sell your personal information. We share data only with service providers who help us run the App, and only as needed to provide the service. These may include:

• OpenRouter and OpenAI, which may perform the AI vision analysis described above for full Pro cloud scans and may answer a no-store Glow Coach request containing a bounded intent, coarse context, and — for the radiance question only — your own scan scores from about the last three months with their program days and calendar dates.
• Supabase and Cloudflare, which provide account sync, database storage, Worker hosting, and private R2 scan photo storage.
• Apple, which processes payments, manages App Store subscriptions, may provide OS-level diagnostics, and fulfills optional WeatherKit/location or city-geocoding requests.
• RevenueCat, which manages Pro entitlements, restore status, and subscription access.
• PostHog Cloud US, which provides product interaction analytics dashboards for coarse app events.
• Google Analytics, which provides website traffic analytics for glowkit.org in consent mode. Ad storage, ad user data, ad personalization, and analytics storage are denied by default.
• Diagnostics providers, which help us understand crashes, performance, and errors.

These providers are bound by contractual obligations to protect your information and use it only for the services they provide to us. We may also disclose information if required by law or to protect rights and safety.

6. Data retention

Local scan photos, scan results, routines, Glow Profile, seven-day programs, check-ins, reminder choices, and history remain on your device until you delete them in the App or remove the App. My Shelf is kept both on your device and under your account until you delete the product, choose Delete All Data, or request account data deletion; a deleted product leaves a removal marker with its name cleared for up to 60 days so your other devices stop showing it. GlowKit does not cache raw UV coordinates; the returned snapshot and place label expire after about 90 minutes. Coach conversations are kept on your device until you delete them or choose Delete All Data, and GlowKit retains no server-side conversation; to keep per-account Coach request limits enforceable we do keep a server-side record of each request's time, its bounded intent category, and a one-way hash of your account reference — never your wording, the answer, or your raw account id — and only about a day of that history is used before older entries are removed. Cloud-synced scan photos, scan metadata, and account history remain available until you request account data deletion. AI providers process scan photos to return the requested result; GlowKit does not authorize them to use scan photos for advertising or model training. Purchase records are retained by Apple and RevenueCat under their policies. Product interaction analytics, website analytics, support emails, and diagnostics are kept only as long as needed for the purposes described above, then deleted or aggregated.

7. Your choices & rights

• Delete your data. Settings → Privacy & data → Delete All Data clears local scans/photos and results, routine edits/checks, Glow Profile, programs, daily check-ins, My Shelf, GlowKit reminder schedules/preferences, cached UV context, app preferences, the Free preview marker, and anonymous analytics/funnel state. It also deletes the cloud copy of your shelf. It does not erase an App Store purchase or cancel a subscription. You can request cloud account data deletion by contacting us.
• Access & correction. You may request a copy of, or correction to, the personal information we hold about you.
• Website analytics choice. You can allow analytics cookies, keep measurement cookieless with Only necessary, or change the choice later from the Analytics choices control on the website. Advertising storage, ad user data, and ad personalization remain denied in either case.
• Withdraw consent. You can stop scanning at any time; without photos, no new analysis takes place. Optional location and notification permissions can be withdrawn in iOS Settings without blocking independent GlowKit features.
• Regional rights. Depending on where you live (for example under GDPR or the CCPA), you may have additional rights, including to erasure or to object to certain processing.

To exercise any of these rights, contact us at turhan@teddyapplabs.com.

Related pages

If you want the practical version of how GlowKit works alongside this policy, start with these pages:

Browse the full GlowKit guides library for more cosmetic, non-medical reading on product decisions and steadier progress tracking.

8. Security

We use industry-standard safeguards, including encryption in transit, to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and limit what we collect in the first place.

9. Children

GlowKit is not directed to children under 13 (or the minimum age required in your region). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can remove it.

10. International users

We may process and store information in countries other than your own. Where we transfer data internationally, we take steps to ensure it receives an appropriate level of protection consistent with this policy and applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the App. Continued use of GlowKit after an update means you accept the revised policy.

12. Contact us

Questions about privacy? Reach our team at turhan@teddyapplabs.com. For general help, see our Support page.

Teddy App Labs · GlowKit (bundle ID com.teddyapplabs.glowkit) · glowkit.org