Skinloa Privacy Policy
This text describes what the app actually does: what stays on your device, what leaves it, and where it goes. The Turkish original is the reference version; where the two differ, the Turkish text governs.
What is processed
Skinloa does not ask you to create an account. The product names, brands, routines, completed steps, opening and recommended-use dates, skin condition selections, free-text notes and product trial records you enter are held in the app's own local storage on your device.
Depending on the features you use, the same place also holds: your skin photos (front, left and right), the face zones you mark in a skin record, your products' ingredient lists and the ingredients you avoid, the prices and purchases you enter, your wishlist and shopping list, your patch tests and their checkpoint results, the procedures you log (laser, peel, waxing and the like) and the break you give your actives, your gentle-start plans, your trips and packing list, your routine sets, your tool and device sessions and your care chores. If you track a treatment course, its name (as you typed it, which may be the name of a prescribed medicine), the days you ticked and your check-up appointments are here too. All of these are optional; the app works without any of them.
Storage and transfer
The care records listed above — your product names, routines, completions, dates, skin notes and photos — do not leave your device. They are not sent to a server belonging to the publisher, not passed to any third party, and not synchronised between devices.
There are four occasions on which the app reaches the internet by itself, and none of them carries a care record: verifying a purchase, usage analytics, a barcode lookup (if you switched it on) and a UV and weather forecast (if you chose a city). Beyond those, two things leave the device only when you switch them on or start them: the encrypted automatic backup written to your own iCloud or to a folder you choose, and files you share yourself (a routine card, a report, a video, a backup file). Each is described separately below. Device backup features managed by the operating system, and by you, may be subject to Apple's or Google's separate terms.
Purchases and subscription
The app has a full version, opened by a subscription or by a one-time purchase. Payment is handled entirely by the Apple App Store or Google Play. The app never sees, stores or asks for your card number, your name or your billing details.
Purchase state is managed with RevenueCat (RevenueCat, Inc., USA). What reaches RevenueCat is an anonymous user identifier generated by the app, together with the receipt issued by the store; these establish what was bought and whether it is still valid. Your product names, routines, skin records, notes and photos are not sent. RevenueCat also sees the IP address the request came from and technical details such as the device and app version. How RevenueCat handles this on its own side is subject to its own privacy terms.
You can cancel a subscription at any time from your Apple or Google account settings; cancelling deletes none of the records you have entered.
Usage analytics and crash reports
To see which parts of the app are used, and to be able to repair a screen that crashes, the app uses Google's Firebase Analytics and Firebase Crashlytics.
What is sent: an anonymous installation identifier generated by the app, the device model, the operating system and app version, the language and country setting, screen names, event names and the numbers that accompany them (for example how many products are on your shelf), and, if the app crashes, the crash stack.
No advertising identifier is collected. The Android permission Firebase Analytics declares in order to read the advertising ID is removed from the app's manifest, and collection is switched off at the SDK as well. The app contains no advertising network and does no cross-app tracking.
What is not sent: your product names, brands, routine names, skin notes, free text, photos, opening dates, the encrypted archive, and your name or email address. None of these fields is placed in an analytics event; only numbers go into events.
Consent: in the European Union, the European Economic Area and the United Kingdom the app collects nothing until you have answered the question. In other countries collection starts on and can be turned off at any time under Settings > Privacy. The region is read from your device's own language and country setting; no server is contacted to ask where you are.
Your answer is stored on your device and is not erased by "Delete care data". If it were erased the question would be asked again, and asking repeatedly until the answer is yes is the thing consent rules exist to prevent. Use the switch in Settings whenever you want to change your answer.
Notifications
Morning and evening routine, product date, product trial checkpoint, skin note, weekly photo, weekly summary, running-low, patch test checkpoint, sunscreen reapply, procedure session, treatment course and check-up appointment notifications are off by default. Notification permission is requested only when you turn one of these on: setup ends by offering a routine reminder, and the permission is asked for only if you accept that offer; afterwards the switches in Settings do the same job. Declining the offer restricts nothing. Scheduling happens on the device. Lock screen text of a reminder never shows a product name, a medicine name, a symptom or a skin note. The timer shown while you do your routine (an ongoing notification on Android, the Lock Screen and Dynamic Island on iPhone) shows the step count, the time and the kind of product (for example "Serum"); the product's own name appears on iPhone only if you turn on "Show product names on lock screen" in Settings. The timer is produced on the device and passes through no server. You can turn notifications off inside the app, or withdraw the permission in your operating system settings.
Filling in details from a label photo
When adding a product you can photograph the packaging or choose an existing image. The text in the photo is read by your device's own text recognition, on the device; the photo is not sent over the internet.
The photo is also not saved into the app's storage: it is used only for as long as it takes to read the text, then released. The name, brand, category and PAO that were read are shown to you, and no field is filled in until you accept them.
Photo measurement
When you compare two skin photos, the app measures the difference in redness and evenness between them. That measurement happens entirely on your device, as arithmetic over pixels: no model, no server, no upload. Neither the photographs nor the resulting numbers leave your device, and they are never placed in an analytics event.
It measures the photographs, not your skin. When the two photos were lit very differently the app shows no number and says so — the measurement would be of the light rather than of the skin.
Barcode catalogue lookup (off by default)
The app can look up a barcode you scan in an open product catalogue. This feature is off by default; while it is off the app opens no internet connection at all.
If you turn it on under Settings > Privacy, then when you scan a barcode that is not already on your shelf, only that barcode number is sent to a community catalogue called Open Beauty Facts (openbeautyfacts.org). Your product names, routines, skin records, notes, photos, identity and device details are not sent. The name, brand and category that come back are used only to fill in the add form, and are applied only with your confirmation. You can turn the feature off at any time.
As with any internet request, the receiving side sees the IP address the connection came from; that is how a network connection works rather than something the app sends. The request also carries a fixed string identifying the app, which is the same for every user and distinguishes no one. How Open Beauty Facts handles that request at their end is subject to their own privacy terms.
Daily UV note (off by default)
The app can show a short note on Today with the day's UV level and how dry the air is. The feature is off by default; while it is off no connection is opened. The app never reads your device's location and does not ask for location permission.
If you choose a city under Settings > Care > Daily UV note, the city name you type while searching, and then at most once a day only the latitude and longitude of the city you chose, are sent to an open weather service called Open-Meteo (open-meteo.com). Your products, routines, skin records, photos, identity and device details are not sent. The chosen city and that day's answer are stored only on your device, and both are deleted when you turn the note off. As with any internet request, Open-Meteo sees the IP address the connection came from; how it handles the request at its end is subject to its own privacy terms.
If you also turn on sunscreen reapply suggestions and mark a day as spent outdoors, the app asks Open-Meteo once more that day for the same chosen city's hourly UV index and sunset time, to know when the sun is strong enough to suggest reapplying. No other location is sent, the device's position is still never read, and the answer is kept only on your device for that day. Without a chosen city nothing is asked for and the suggestions follow a fixed two-hour rhythm instead. The suggestions are general guidance, not a promise of protection.
If you plan a trip and choose a destination city for it, the city name you type while searching, and then on the days of that trip at most once a day only the latitude and longitude of that destination, are sent to Open-Meteo in the same way, so Today's UV note is about where you are; on an outdoor day of that trip, the hourly UV and sunset for sunscreen reapply suggestions are asked for that destination too, instead of the chosen city. This happens only when you chose a destination yourself; the device's position is still never read. The destination is stored only on your device with the trip, and is deleted with it.
If a summer or winter routine set you made yourself is waiting unused, the app asks Open-Meteo at most once a day for only the chosen city's highest UV index and mean humidity for the next 7 days, so it can suggest switching to that set when the season has clearly turned. This happens only when you chose a city for the Daily UV note; a trip destination or the device's position is never used for it. The answer is kept only on your device for that day, and your answer to the suggestion is kept only on your device too. The suggestion never changes anything on its own.
Automatic iCloud backup (off by default, iPhone only)
If you turn on the automatic iCloud backup on the backup screen, once a week the app encrypts all your care records (and your photos, if you choose) on your device with AES-256-GCM and writes the file to the Skinloa folder in your own iCloud Drive; the four newest backups are kept and older ones are deleted. The files never go to a server of ours and we have no access to them; their storage in iCloud is subject to Apple's own terms. The encryption key is generated at random and exists only in this device's Keychain and in the recovery code shown to you once when you turn the backup on. We do not keep the code; if it is lost, the backups cannot be opened. Turning the feature off stops new backups; you can delete the files in iCloud from the Files app. Deleting all data removes the key and the setting from this device and leaves the files in iCloud untouched.
Automatic backup to a folder you choose (off by default, Android only)
If you turn on the automatic backup on the backup screen of an Android phone, the app asks you to pick a folder in Android's own folder picker: a folder on the phone itself, or a folder of another app that offers its folders to that picker. Which cloud apps do so is up to those apps; Skinloa does not promise any particular one. Once a week it encrypts all your care records (and your photos, if you choose) on your device with AES-256-GCM and writes the file to that folder; the four newest backups are kept and older ones are deleted. The app is given access to that one folder only, asks for no storage permission and has no account or server of its own. If the folder is on the phone itself, the backups stay on the phone and are lost together with it; the app says so on the backup screen. If the folder belongs to a cloud service's app, that service's own app uploads the already-encrypted file, under that service's terms; we never receive it and cannot open it. The encryption key is generated at random and exists only in this device's secure storage (Android Keystore) and in the recovery code shown to you once when you turn the backup on. We do not keep the code; if it is lost, the backups cannot be opened. Turning the feature off stops new backups; you can delete the files from the folder yourself. Deleting all data removes the key, the setting and the app's access to the folder from this device and leaves the files in the folder untouched. Android's own app backup stays disabled for Skinloa (`allowBackup` is off).
Health context (off by default)
If you turn it on under Settings > Health context, the app reads exactly two things from your phone's health app (Apple Health on iPhone, Health Connect on Android): your recorded period days and the total time asleep each night. Each has its own switch and both stay off until you turn them on; the operating system also shows its own permission screen. The app writes nothing to your health app and asks for no other health data. What is read (the day, whether it was a period day, minutes asleep) is stored only in the database on this device, to be shown as context beside your skin notes; it is never sent to a server of ours, to usage analytics, to crash reports, or anywhere for advertising or marketing. Usage analytics receives only which switch is on (two yes/no values), never any value that was read. This data enters only the encrypted backup file you save yourself with a password, and only if you turn on "Include in backups" on the same screen (off by default); automatic backups (iCloud or the folder you chose) never contain it. Turning a switch off deletes what that kind brought in from the device; "Remove synced data" deletes all of it and turns both switches off; deleting all data removes it and your choices too. You can withdraw the permission at any time in your phone's health settings. This information is not used for diagnosis or medical assessment.
Routine card and QR code
Sharing a routine as a card is something only you start. The card is drawn on your device as an image and handed, through your phone's own share sheet, only to the app you pick; it does not go to us or to any other server.
The card and (if you choose to add it) the QR code on it contain only the steps visible on the card: the product's category, its name, its brand and barcode if it has them, and the days of the week the step runs. A step you hide before sharing is not merely painted over on the card; it is never written into the QR code either. The QR code holds no identifier, date, note, price, photo, skin record or usage history; it is not a web address and reading it connects to nothing.
When you scan the QR code on someone else's card, it is decoded on your device and matched against your shelf on your device; nothing is sent, and no routine is created until you confirm. The same holds for the dermatologist report (PDF), the timelapse video and the "On this day" images: they are produced on your device and go only where you send them.
Aisle check in the store
When you scan a product's barcode in a store, the app looks that product up in your own records on your device: whether you used it before, finished it, what you noted, whether your shelf holds something similar. The comparison happens on the device. The barcode is sent to Open Beauty Facts only if you switched the catalogue lookup above on and the product is not in your records; with it off, no connection is opened.
Sharing and sale
The app does not sell user data to third parties, does not share it for advertising, and contains no advertising network. Apart from the four services named above — RevenueCat, Firebase, and (only if you switch them on) Open Beauty Facts and Open-Meteo — no data goes anywhere, and what goes to each of them is listed one item at a time in its own section.
If another service, cloud sync or an advertising SDK is ever added to the app, this policy and the store privacy declarations will be updated before that version is published.
Retention and deletion
Records may remain in local storage until you delete them, or until the app's data or the app itself is removed from the device. "Delete care data" in Settings clears product, routine, completion, skin record and trial data and, with them, photos, price and purchase records, patch tests, procedures, gentle-start plans, trips, treatment courses, routine sets, care chores, the health context that was read, and preferences such as the avoid list and the chosen city, from the app's local storage, and cancels scheduled notifications. It does not touch encrypted backup files already written to your own iCloud or to the folder you chose, or files you shared yourself; you delete those where they are. Device backups created earlier by the operating system may be subject to the platform's own retention and deletion rules.
Asking for data that left the device to be deleted
Analytics, crash and purchase records are tied to anonymous IDs, not to your name: Google Analytics uses an app instance ID and RevenueCat an anonymous customer ID. If you want these records deleted, Settings > How is your data stored? > Ask for your data to be deleted opens a prepared email containing both IDs. You can also write to lunaydestek@gmail.com directly, but without the IDs there is no way to tell which records are yours.
Requests are carried out within 30 days at the latest: analytics data is deleted from Google Analytics and the purchase record from RevenueCat. Google removes analytics data from reports within 72 hours and from its servers within two months. Crash reports cannot be deleted per person; Crashlytics deletes them automatically after 90 days. Deleting the purchase record does not cancel a subscription or change the purchase history in your Apple or Google account; you can cancel a subscription in the store's subscription settings. Your email address is used only to answer your request.
Children's privacy
The app is designed for people aged 18 and over and is not directed at children; its store listings declare an audience of 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has used the app, write to lunaydestek@gmail.com and the data that left their device will be deleted as described under "Asking for data that left the device to be deleted".
Security
Data is held in the local area the operating system reserves for the app. The local SQLite database is opened in the secure-delete mode that zeroes the content of deleted rows, and on a full data deletion the database file is vacuumed. Android application backup is disabled. On iOS the default Data Protection level keeps files encrypted and unreachable until the first user unlock after the device restarts. Backup behaviour managed by the operating system, and by you, is subject to its own terms. No technical method guarantees absolute security; using a device lock and an up-to-date operating system is recommended.
Medical boundary
Skinloa is not a medical device; it is not intended to diagnose, treat, cure or prevent any health condition. The app organises your own cosmetic care routine and your personal observations. For a skin problem that persists, gets worse or worries you, consult a qualified health professional.
Changes and contact
This policy may be updated when the app's features or legal requirements change; the date at the top of the page tells you which version you are reading.
For any question about this policy or about your own data: lunaydestek@gmail.com