Privacy Policy

AI Skin Tracker is operated by Nav Star Software Studios Inc., a British Columbia, Canada corporation (Incorporation No. BC1590924). The designated Privacy Officer is Naveed Iqbal, Director, Nav Star Software Studios Inc.

For privacy questions, access or correction requests, deletion requests, or complaints, contact: support@aiskintracker.com or through the Help & Support section in the app. We aim to respond within 30 days.

Almost all of your personal data — including your profile, skin analysis results, metric history, scan photos, routine snapshots, streaks, and milestones — is stored locally on your device. We do not maintain user accounts on our servers. During an active analysis, its result is held in server memory for no more than 10 minutes so it can be delivered to your device, then it is deleted from memory.

We store limited pseudonymous, device-linked data on our servers to operate the app. This data does not include your name, facial photos, skin scores, scan images, or skincare history:

• Trial and reward records — a device-generated identifier, trial status, and reward claim records, used solely to prevent abuse and enforce one free trial per device. On iOS, this identifier may remain in the Keychain after an app reinstall for that purpose.
• Product ratings — your device-linked identifier, the product ID, and your star rating. Optional written feedback if provided. No name, photo, or skin data included.
• Usage events — named action events such as "app_open" and "scan_completed", your device platform, and a timestamp. No photos, skin scores, or personal information are included.

Facial photos, skin-related inferences, estimated skin age, and cosmetic skin metrics may be considered sensitive personal information in some jurisdictions. We process this information only to provide the app's cosmetic scan and routine features, and only with your explicit consent.

We collect facial photos only when you initiate a scan. We use facial photos solely to generate cosmetic skin analysis, visible skin metrics, estimated cosmetic skin age, and personalised routine suggestions.

Each skin analysis captures up to three photos (front-facing, right profile, and left profile) to give the AI a more accurate view of your facial skin. When you complete a scan, your photos are:

• Resized and re-encoded on your device before upload, removing EXIF, GPS, camera, and device metadata
• Saved locally in a backup-excluded app cache; iOS and Android may reclaim cached photos if storage is needed, while scan history and metrics remain on your device
• Transmitted securely to OpenAI over an encrypted HTTPS connection for cosmetic analysis only
• Processed by OpenAI as our service provider under applicable API and data processing terms — AI Skin Tracker does not store your photos on its own servers
• Not used by OpenAI to train or improve its AI models under the current API terms — OpenAI processes images as a processor under our instructions
• Held with the resulting analysis in our server's working memory for up to 10 minutes only while your device retrieves the result, then removed from memory; not stored in our database
• Never shared with third parties, advertisers, or data brokers by AI Skin Tracker
• Automatically managed on your device: the app keeps photos for up to your 30 most recent scans when cache space remains; older or OS-reclaimed photos are unavailable. All scan results and metric scores are retained locally regardless of photo availability.

AI Skin Tracker analyses your photos to produce cosmetic skin metrics, concern identification, and an Estimated Skin Age range based on visible facial characteristics.

• After processing, all analysis results and metric scores are stored on your device
• The Estimated Skin Age is a cosmetic estimate only — it is not a medical or biological assessment and does not indicate your actual age, health, or wellbeing
• We do not assess, diagnose, or treat medical skin conditions — always consult a dermatologist for professional advice
• Analysis data is never sold or shared with insurance companies, employers, or any other third parties

AI Skin Tracker uses OpenAI's vision-capable models to analyse your facial photos and produce cosmetic appearance scores, visible observations, and routine recommendations. This constitutes automated processing of your facial images.

• Purpose: Cosmetic appearance tracking only. The AI does not diagnose, detect, or predict medical conditions.
• Human review: No human reviews your photos or analysis results. Processing is fully automated.
• Photo retention: Your photos are transmitted to OpenAI solely to generate your results and are not retained by AI Skin Tracker on our servers. OpenAI's data handling is governed by its API data processing terms.
• Consequential decisions: AI Skin Tracker output should not be used as the sole basis for any medical, health, or treatment decision. Always consult a qualified dermatologist or healthcare professional for medical advice.
• Accuracy: AI cosmetic analysis is inherently approximate. Results may vary based on lighting, camera quality, and facial positioning. Scores are cosmetic estimates, not medical measurements.

AI Skin Tracker requests only the permissions it needs:

• Camera: Required for skin scanning — used only when you initiate a scan
• Photo Library: Optional — used only to let you set a profile photo
• Notifications: Optional — used for scan reminders, routine alerts, trial expiry notices, and re-engagement prompts
• Android notification scheduling: Android uses boot-restart and exact-alarm permissions only to restore and deliver the local reminders you choose; no microphone or shared-storage permission is requested

You can revoke any permission at any time through your device settings. Revoking camera access will prevent new scans until access is restored.

We use the following service providers to operate AI Skin Tracker. These providers process data only as needed to provide their services to us, subject to applicable contractual and legal obligations:

• OpenAI: Receives your facial photos and scan request data solely to generate your cosmetic skin analysis and routine suggestions. OpenAI acts as our service provider under applicable API and data processing terms. OpenAI does not use your images to train its AI models under current API terms. Photos may be processed on servers outside Canada, including in the United States. See openai.com/privacy.
• RevenueCat: Manages in-app subscriptions and purchase verification. RevenueCat receives pseudonymous device identifiers and purchase event data — no photos, skin scores, or skin analysis data are ever shared. See revenuecat.com/privacy.
• Hosting and database provider: Limited pseudonymous device-linked records (trial status, reward records, product ratings, usage events) are stored on our servers. No photos, skin scores, or personal identity information are stored.

Your device's region setting (country code) is sent with scan and routine requests so we can generate country-appropriate Google Shopping links. We do not collect precise location data or retain the country code in our database. To generate a routine, we transiently receive limited derived scan context — such as skin type, selected cosmetic concerns, and estimated cosmetic age range — only to return product suggestions; it is not stored in our database. Product links open a country-specific Google Shopping search; final price and availability are shown by participating merchants. AI Skin Tracker does not use affiliate tracking and receives no commission from product purchases.

The following pseudonymous, device-linked data is stored on our servers. None of it contains your name, photo, skin scores, or any content from your scans:

• Trial and reward records — a device-generated identifier, a record of any reward claimed and when, and a flag indicating whether this device has previously used a free trial
• Product ratings — your device-linked identifier, the ID of the product you rated, and your star rating (1–5). Optionally, any written feedback you provide.
• Usage events — named action events such as "app_open" and "scan_completed". These include your device platform (iOS) and a timestamp. No photos, skin scores, or personal information are ever included.

This data is used solely to operate app features, prevent abuse, and improve the product. It is never used for advertising or sold to third parties.

You can erase eligible server records directly from the app using Profile → Privacy & Data → Delete Server Records. The request is bound to device-held identifiers and returns a deletion receipt and request ID. It removes device-linked scan, rating, achievement, consent, and product-assignment records when present. The separate Clear Local Data option erases local data only. We retain a non-identifying receipt and the minimum device trial marker needed for fraud prevention; records required by legal obligations may also be retained. Privacy & Data also provides access/correction and grievance contact controls. If an in-app request cannot be completed, contact support@aiskintracker.com.

If you contact us through the website support form or submit a testimonial, we may collect your name (optional), email address, category, message, star rating, and submitted experience. This information is used solely to respond to your support request or, in the case of approved testimonials, to display your experience on the website.

• Support requests: name, email address, category, and message — used to respond and resolve your issue
• Testimonial submissions: optional display name, message, and star rating — reviewed before any public display; unapproved submissions are not shown

You may request deletion of any support or testimonial submission by emailing support@aiskintracker.com. We will process your request and confirm deletion within 30 days.

Facial photos are stored in a backup-excluded app cache. The app aims to retain photos from your 30 most recent scans for local history and before/after comparisons, but your device may reclaim cached photos when storage is needed. Scan results and metrics remain on your device unless you clear local data or uninstall the app.

Analysis requests and results are kept only in working memory for up to 10 minutes so the app can retrieve its result, then removed. Limited server-side device-linked records are retained only as long as needed to operate trials, rewards, verify purchases, prevent fraud, support product ratings, respond to support requests, fulfil legal obligations, and maintain security. You can use Profile → Delete Server Records to delete eligible records and receive a verifiable receipt. A non-identifying receipt, the minimum trial-abuse marker, and records required by law may remain. We periodically delete or de-identify records that are no longer needed.

New scan photos are excluded from iCloud and Android Auto Backup by using the operating system's cache storage. Managed Expo does not provide a per-file backup-exclusion flag for durable document storage, so cached photos may be reclaimed by the operating system. Photos created by older app versions may remain in a pre-existing device backup until that backup expires or is deleted under your device and account settings.

AI Skin Tracker lets you share your scan results and skin journey as branded image cards. These are generated entirely on your device from your locally stored skin data and shared via your device's standard share sheet. AI Skin Tracker does not transmit your share card images to our servers at any point.

• All photo transmissions to our AI service use HTTPS encryption
• No user accounts or passwords — there is nothing to compromise on our end
• Local data is protected by your device's built-in security (passcode, Face ID, Touch ID)
• Device-linked data stored on our servers is held in an encrypted database, access-controlled and not exposed publicly
• Subscription data is managed by the applicable app store (Apple App Store or Google Play) and RevenueCat — we do not handle or store payment information

• Use "Clear Local Data" in Profile → Privacy & Data to erase local photos, scan history, metric data, routine snapshots, profile information, consent, and saved deletion receipts from your device immediately
• Use "Delete Server Records" in Profile → Privacy & Data to securely delete eligible device-linked server records and receive a deletion receipt. A minimum fraud-prevention trial marker, a non-identifying receipt, and records required by law may remain.
• Use "Withdraw AI Photo-Processing Consent" in Profile → Privacy & Data to block future scans until you affirmatively accept the current consent again. This does not delete existing data.
• Uninstalling the app removes its locally stored data from your device; it does not delete eligible server-held records, which require the separate Delete Server Records control

Local deletion does not delete server-held records, and server deletion does not remove local files. Use both controls if you want to clear both locations.

For device-linked records stored on our servers, use "Delete Server Records" in Profile → Privacy & Data. The app shows a deletion receipt and request ID. A minimum fraud-prevention trial marker, a non-identifying receipt, and records required by law may remain. Use the Privacy & Data controls to request access or correction, or to contact the Privacy Officer with a grievance. If an in-app request cannot be completed, contact us at support@aiskintracker.com.

AI Skin Tracker is intended for users aged 18 and above. The app is not directed to anyone under 18 and is rated 18+ on the App Store. We do not knowingly collect personal information from anyone under 18 years of age. If you are under 18, you may not use AI Skin Tracker.

The app is also not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA), and we do not knowingly collect personal information from children under 13. If we learn that a person under 13 has provided personal information through the app, we will delete that information promptly, unless retention is legally required.

Do not scan anyone under 18. If you scan another adult, you must have their valid consent and authority to do so. In all cases, the AI analysis is a cosmetic assessment only and is not a medical evaluation.

If you believe a user under 18 has independently used the app, please contact us at support@aiskintracker.com so we can assist with deletion of any associated records.

AI Skin Tracker is operated from British Columbia, Canada. We use service providers that may process data in Canada, the United States, or other locations. Facial photos transmitted to OpenAI for analysis may be processed on servers located outside Canada, including in the United States, where they may be subject to foreign laws.

By using AI Skin Tracker, you acknowledge and consent to this cross-border transfer of your data for cosmetic analysis purposes. We take reasonable steps to ensure that your data is handled securely regardless of where it is processed.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), AI Skin Tracker remains accountable for the protection of personal information that it transfers to third-party service providers for processing. We use contractual and other reasonable means to provide a comparable level of protection to such information while it is being processed outside Canada by a service provider.

AI Skin Tracker is currently available in the United States, Canada, India, and Australia. Availability may vary by App Store territory, device, language, and applicable law.

We do not sell personal information and do not share it for cross-context behavioural advertising purposes.

U.S. State Privacy Rights. If you are located in the United States, additional privacy rights may apply depending on your state of residence. Regardless of whether applicable law formally requires it, we make the following commitments to all U.S. users:

• Access: You may request a summary of the personal information we hold about you (device-linked records on our servers).
• Correction: You may request correction of inaccurate personal information we hold.
• Deletion: You may request deletion of device-linked records held on our servers. We will confirm deletion within 30 days.
• No sale: We do not sell your personal information to third parties.
• No sharing for advertising: We do not share personal information for cross-context behavioural advertising.
• Sensitive data: We collect facial photos and skin-related inferences only with your explicit consent at first launch. You may withdraw future photo-processing consent immediately through Profile → Privacy & Data without deleting other data.
• Appeal: If we deny a request, you may appeal by contacting us at support@aiskintracker.com.

California residents may have additional rights under the California Consumer Privacy Act (CCPA/CPRA). Washington state residents may have additional rights under the My Health MY Data Act regarding consumer health data. To exercise any of these rights, contact us at support@aiskintracker.com.

If you are accessing AI Skin Tracker from India, the following applies in addition to the rest of this Privacy Policy, and is provided in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000.

Data Fiduciary. AI Skin Tracker (operated by Nav Star Software Studios Inc., British Columbia, Canada) acts as the Data Fiduciary for personal data processed in connection with your use of the app.

Consent. We process facial photos only with your explicit consent, which you provide through the in-app consent screen. You may withdraw future photo-processing consent at any time through Profile → Privacy & Data; future scans remain blocked until you accept the current consent again.

Cross-Border Transfer. Your facial photos are transmitted to OpenAI, a service provider located in the United States, solely to generate your cosmetic skin analysis. This constitutes a cross-border transfer of personal data. By using the app and providing consent, you acknowledge and agree to this transfer for the purpose of cosmetic analysis only. We take reasonable steps to ensure your data is handled securely regardless of where it is processed.

Your Rights under the DPDP Act. As a Data Principal, you have the right to:

• Access a summary of personal data we hold about you
• Correct or update inaccurate personal data
• Request erasure of your personal data where it is no longer necessary for the purpose for which it was collected
• Withdraw consent at any time — withdrawal does not affect the lawfulness of processing before the withdrawal
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity

Grievance Officer. For any grievance, data rights request, or complaint under the DPDP Act, contact our Grievance Officer: Naveed Iqbal, Director, Nav Star Software Studios Inc., support@aiskintracker.com (subject line: "India Grievance"). We will acknowledge your request within 48 hours and resolve it within 30 days.

If you are located in Australia, this section applies to you. Where applicable, AI Skin Tracker handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We may collect and process your facial photo, skin-analysis results, app usage information, device information, subscription status, and support communications. Facial photos and related analysis information may be treated as sensitive personal information under applicable law. We collect this information only with your consent and for the purpose of providing cosmetic skin-analysis features, skincare routine suggestions, app functionality, support, security, analytics, and legal compliance.

Facial photos are transmitted securely to OpenAI in the United States for cosmetic analysis under APP 8 of the Australian Privacy Principles. We take reasonable steps to ensure OpenAI, as our service provider, handles your information consistently with the APPs. We do not use the app for face recognition, identity verification, or creation of a biometric faceprint. AI Skin Tracker does not store facial photos on its own servers. Photos are stored locally on your device according to your app settings.

Your rights under the Privacy Act. If you are an Australian user, you have the right to:

• Request access to personal information we hold about you (device-linked records on our servers)
• Request correction of inaccurate or out-of-date personal information
• Request deletion of personal information we hold where it is no longer required
• Make a privacy complaint about how we handle your personal information

To exercise any of these rights, contact our Privacy Officer at support@aiskintracker.com. We will aim to respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

By using AI Skin Tracker, you consent to the collection, use, disclosure, and overseas processing of your personal information as described in this Privacy Policy.

AI Skin Tracker processes facial images and generates cosmetic appearance scores relating to visible skin characteristics. In certain U.S. states (including Washington under the My Health MY Data Act), this may constitute "consumer health data."

• What we collect: Facial photos (transmitted for analysis then discarded from our servers), and locally stored cosmetic appearance scores and metrics.
• Why we collect it: Solely to provide you with personalised cosmetic appearance analysis, skincare routines, and progress tracking features.
• Who we share it with: OpenAI (for analysis, under API terms), and no other parties. We do not sell consumer health data.
• Your rights: You may request access, correction, or deletion of any data we hold through Profile → Privacy & Data or support. You may withdraw future photo-processing consent there at any time.
• Not medical data: AI Skin Tracker's output is cosmetic appearance information only. It is not a health record, medical diagnosis, or clinical measurement.

To exercise your consumer health data rights, contact our Privacy Officer at support@aiskintracker.com.

AI Skin Tracker does not use facial photos for face recognition, identity verification, authentication, face matching, surveillance, or the creation of a persistent faceprint or biometric template. We do not attempt to identify you from your photos.

To the extent any facial photo processing in AI Skin Tracker is considered a biometric identifier or biometric information under Illinois law or any similar law, we provide the following notice:

• Purpose of Processing. Facial photos are collected only when you initiate a scan and are used solely to generate cosmetic skin analysis, visible skin metrics, estimated cosmetic skin age, routine suggestions, and progress tracking.
• Disclosure to Service Provider. Facial photos are transmitted securely to OpenAI, our service provider, solely to process the scan and return cosmetic analysis. AI Skin Tracker does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
• Retention. AI Skin Tracker does not store facial photos on its own servers. New facial photos are stored locally in a backup-excluded app cache, while scan history remains on your device. The app aims to retain photos from your 30 most recent scans until cache space is reclaimed. You may delete local scan data at any time using Clear Local Data or by uninstalling the app.
• Consent. By using the scan feature and providing the required in-app consent, you authorise AI Skin Tracker to collect, process, transmit, and use your facial photos for the purposes described above.
• Security. Facial photos are transmitted using HTTPS encryption and are handled as sensitive information.

To exercise any rights relating to facial or biometric data, contact our Privacy Officer at support@aiskintracker.com.

Our website at aiskintracker.com currently uses only essential hosting and security technologies and does not use advertising cookies or tracking pixels. If we add analytics, advertising, or non-essential cookies in the future, we will update this policy and provide any required consent choices.

We may update this privacy policy from time to time to reflect changes in the app or applicable law. Any changes will be reflected here with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the revised policy.