Privacy Policy

Last updated: 26 August 2026

Dermaa is a skincare tracking app. This policy explains what the app collects, why it collects it, who it is shared with, how long it is kept, and how you can delete it.

The short version: your data is used only to run the features you see in the app. It is never sold, never shared with advertisers, and never used to train AI models. Dermaa contains no advertising, no analytics SDK, and no third-party tracking of any kind.

Who we are

Dermaa is an independently developed app. For anything in this policy, including data access and deletion requests, contact reckad007@gmail.com.

What we collect, and why

• Account details — your email address and a password stored only as a secure hash. Used to create your account and sign you in. We never see your password.
• Photos you choose to take — face photos for skin analysis, meal photos for nutrition analysis, and an optional profile picture. Used only to produce your own results and to show you your own history. Photos are stored in access-controlled cloud storage tied to your account.
• Skin and lifestyle profile — the answers you give during onboarding and can edit later: skin type, skin tone, concerns, sensitivities, allergies, goals, environment, diet, budget, age and gender. Used to personalise your routine, your analyses, and the coach's answers.
• Health-related daily logs — check-ins (mood, symptoms, triggers, notes), skin scores, routine completion, meals, water intake and sleep. This is the core of the product: it builds your dashboard, your trends, and the context the AI coach uses.
• Coach conversations — the messages you exchange with the AI coach, kept so a conversation continues across sessions and so you can search your own history.
• Feedback you submit — the rating, category and description you send through the in-app feedback form.
• App version and platform — which build of the app you are running, so we can reproduce bugs and support you.

We do not collect your location, your contacts, your device identifiers for advertising, or your browsing activity. The app requests no location permission at all.

Device permissions

• Camera and photos — only when you choose to take or pick a photo for a skin scan, a meal scan, or your profile picture.
• Notifications — for your routine and check-in reminders. These are scheduled on your device; no reminder content is sent through a push server.
• Alarms and battery exemption — used only so reminders fire at the time you set, even when the app is closed.

Every one of these is optional. Declining them disables the related feature and nothing else.

How the AI features work

Skin analysis, meal analysis, routine generation and the coach are produced by OpenAI models. When you use one of these features, the relevant data — your photo, or a summary of your recent logs and profile — is sent from our server to OpenAI purely to generate that one result, which is then stored in your account.

These requests are made server-side. API keys are never present in the app, and your data does not pass through any AI provider from your device directly. Under OpenAI's API terms, data sent through the API is not used to train their models.

AI output is general wellness guidance. It is not a medical diagnosis and does not replace a dermatologist or other qualified professional. Never disregard professional medical advice because of something the app said.

Who your data is shared with

We do not sell data and we do not share it for advertising. Data is shared only with the service providers needed to run the app:

• Supabase — database, authentication and file storage. This is where your account and all your logs live.
• OpenAI — processes the specific content of an AI request, as described above.
• RevenueCat and Google Play Billing — handle subscriptions. We never receive or store your card details; we only learn whether a subscription is active.

We may also disclose data if legally required to do so, or to protect the rights and safety of our users.

Where your data is stored

Your data is stored on Supabase infrastructure in the Asia-Pacific (Seoul) region. AI processing takes place on OpenAI infrastructure, which may be located in the United States. By using the app you understand that your data may be processed outside your country of residence.

How your data is protected

All traffic between the app and our servers is encrypted in transit. Every table is protected by row-level security, meaning each record is bound to the account that created it and cannot be read by another user. Photos are held in access-controlled storage. Administrative access is limited to what operating and supporting the service requires.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach ever affects your data, we will notify you.

How long we keep it

Your data is kept for as long as your account exists, because the product is a longitudinal record — trends and progress comparisons depend on old entries remaining available. You can delete individual items (photos, check-ins, conversations) inside the app at any time, and deleting your account removes everything.

Deleting your data

You can delete your entire account and all associated data from inside the app: Profile → Delete account. This is immediate and permanent. It removes your profile, all check-ins and skin analyses, your routine and logs, your diet records, your coach conversations, and every photo you have uploaded.

If you can no longer access the app, email reckad007@gmail.com from the address you registered with and we will delete your account within 30 days. Full instructions are on our data deletion page.

Deletion is not reversible and we do not retain a backup copy of deleted accounts for recovery.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. Most of this is available directly in the app — your profile is editable, your history is visible, and deletion is one screen away. For anything else, email us and we will respond within 30 days.

Children

Dermaa is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If this policy changes materially, we will update the date at the top of this page and, where the change affects how your data is used, notify you in the app. Continuing to use Dermaa after a change means you accept the updated policy.

Contact

Questions, requests, or complaints: reckad007@gmail.com