Privacy Policy
Last updated: 22 October 2026
This policy explains what the Skincare by Neli app ("the App") collects, why it does so, who helps us process it, and how you can see or delete it. We collect only what the App needs to work.
1. Who is responsible
The data controller is Neli Mladenova, Sofia, Bulgaria. Contact: npmladenova@gmail.com.
2. What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Email address and password. The password is stored only as a bcrypt hash. Earlier versions of the App could also be used as a guest, with only a random identifier instead of an email. | To sign you in and keep your data together. |
| Skin profile | Skin type, concerns, sensitivity, age range, gender and ingredient preferences you choose during setup. | To build your routine and check products against your skin. |
| Routine and check-ins | Your routine steps, and your daily check-ins with any notes you write. | To show your routine and progress. |
| Daily tips | Which tips were scheduled for you and when you opened them. | To choose the next tip and not repeat ones you have seen. |
| Products | Products you save. | To check them against your routine and skin. |
| Scan results | The written observations from each skin scan. The photo is never stored (see section 3). | So you can compare scans over time. |
| Confirmations | With each skin scan, the time it arrived with your confirmation that you are 16 or older and that the photos are of your own face. | To show that a scan was sent with your confirmation. |
| Usage counters | How many scans and ingredient checks you used this month. | To apply usage limits. |
| Gift codes | If you redeem a gift code: which code, when you redeemed it and until when it gives you full access. If the person who gave it added their name and a message, we keep those with the code. | To give you the full access the gift pays for and show you who it is from. |
| Subscription status | Whether you have an active subscription, as reported by the app store. | To unlock paid features. |
| Session data | A hashed sign-in token and its expiry. | To keep you signed in securely. |
| Security data | A one-way hash of your IP address with a request count, deleted after at most 24 hours. | To limit abuse, such as repeated sign-in attempts. |
3. The skin scan
When you start a scan, the App sends your photo to our server, which forwards it to Anthropic, our AI provider, to produce the observations. We do not save the photo. On our server it exists only while the request is being handled and is then discarded. We keep only the resulting written observations, linked to your account.
Anthropic processes the photo as our processor under its commercial terms and data processing addendum. Anthropic does not use it to train its models, and deletes it automatically within 30 days. It may keep it longer only if the request is flagged for breaking its usage policy, or where the law requires it.
The scan gives general, educational observations only. It cannot diagnose skin conditions and must not be used to judge moles, spots or other changes. See the Medical Disclaimer.
Please scan only your own face. Before your first scan the App asks you to confirm this, and we record the time each scan arrived with that confirmation.
4. What stays on your phone
- Photo journal: photos you add to the journal are stored only on your device and are never uploaded.
- Location: if you allow it, your phone sends its coordinates directly to Open-Meteo to get the local UV index. Your location is not sent to our servers.
- Your routine log: the steps you complete or skip, and your streak.
- Product dates: when you opened a product and when it expires.
- Reminder settings and preferences, including the body weight you enter for the water goal.
Uninstalling the App removes this data.
5. How we use it
- To build and adjust your skincare routine.
- To check ingredients and products against your profile.
- To show your progress, streak and scan history.
- To send the reminders you switched on.
- To send account emails, such as password reset.
- To answer your support requests.
We do not sell, rent or share your personal data for advertising, and the App shows no ads. The legal bases are performing our agreement with you (providing the App), your consent (location, notifications and the skin scan) and our legitimate interest in keeping the App secure.
6. Services that help us
| Service | What it receives |
|---|---|
| Railway | Hosts our server and database, where the data in section 2 is stored. |
| Anthropic | Your scan photo, to produce the observations. Deleted by Anthropic within 30 days and not used for training (see section 3). |
| RevenueCat | Your app account identifier and purchase receipts, to manage subscriptions. Payments are handled by Apple or Google; we never see your card details. |
| Resend | Your email address, to deliver account emails. |
| Open-Meteo | Your approximate coordinates, sent directly from your phone, with no account information. |
| Open Beauty Facts | Only the barcode of a product you scan, sent by our server with nothing about you, to look up its ingredients. |
7. International transfers
Our server and database are in the United States, so the data in section 2 is stored there. Several of the other providers also process data in the United States. For these transfers we rely on the safeguards the GDPR requires, mainly the European Commission's Standard Contractual Clauses in each provider's data processing agreement.
8. How long we keep it
We keep your data while your account exists. When you delete your account in the App, your profile, routines, check-ins, products, scan results, usage counters and sessions are deleted immediately. A one-way hash of a former guest identifier is kept for up to 90 days so that old sign-in tokens cannot be reused. Scan photos are deleted by Anthropic within 30 days (see section 3). The security hash of your IP address is deleted within 24 hours. If you redeemed a gift code, the record of the code itself is kept for our accounts, but the link to you is removed.
9. Your rights
Under the GDPR you can:
- Access your data and receive a copy of it.
- Correct it. Most of it can be edited in the App.
- Delete it. See Delete your account.
- Take it with you in a machine-readable format. Data on your phone can be exported from Privacy Settings. For the data on our server, email us.
- Object to or restrict processing.
- Withdraw consent at any time, for example by turning off location or notifications. This does not affect processing that already took place.
Email npmladenova@gmail.com and we will reply within 30 days. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority where you live.
10. Children
The App is not intended for anyone under 16, and we do not knowingly collect their data. When you accept this policy in the App you confirm that you are 16 or older. If you believe a child has given us personal data, contact us and we will delete it.
11. Cookies and tracking
The App does not track your behavior for analytics or advertising. This website uses no cookies and no analytics, and loads its fonts from this site rather than from third parties. If we ever add product analytics, we will update this policy and add a setting to control it before any collection begins.
12. Changes and contact
If this policy changes in a meaningful way, we will tell you in the App. The date at the top shows the latest version. For any question, email npmladenova@gmail.com.