Privacy Policy

This Privacy Policy ("Policy," "Privacy Policy," or "this document") defines the data handling practices for Skin Story ("Skin Story," "the Application," "we," "us," or "our"), a mobile application built to provide real, observable skin awareness insights based directly on the data you choose to provide. This document, along with our subsequent structured sections, outlines how your information is collected from users across all features, functionalities, and digital properties associated with the Application.

Skin Story is a mobile application designed, developed, and operated for the purpose of providing users with general wellness insights, real-time skin-related informational outputs, non-clinical guidance, personalized scoring, and other related informational content pertaining to the general condition, appearance, and observable characteristics of the user's skin. Our technology and algorithm system delivers personalized wellness goals, patterns, trend tracking, pattern assessments, and insights by collecting, receiving, analyzing, and processing certain categories of personal information voluntarily submitted by the user, including but not limited to photographic images and skin scans captured through the Application's technology, self-reported lifestyle data including sleep patterns, stress levels, dietary habits, and water intake, routine and product usage information logged through the Application's features, daily check-in responses submitted through questionnaire and logging functionalities, and any other data you choose to provide.

We do not offer any medical advice, dermatological diagnosis, or clinical treatment recommendations. All insights generated by the Application depend entirely on the accuracy and consistency of the data you submit; if the self-reported inputs or photos provided are inaccurate or incomplete, the resulting insights will likewise reflect those inaccuracies.

This Privacy Policy was last updated and became effective on September 16, 2026 ("Effective Date"), superseding all previous versions. Skin Story reserves the right to modify, update, or revise this Privacy Policy at any time. Any changes become effective immediately upon being posted within the Application or associated website, and your continued use of the Application signifies your agreement to the updated terms.

This Privacy Policy applies to and governs all users of the Skin Story Application worldwide, regardless of your location, nationality, or jurisdiction of access. Where local regulations provide specific protections, we adhere to applicable laws including the California Consumer Privacy Act ("CCPA/CPRA"), European General Data Protection Regulation ("GDPR"), United Kingdom GDPR ("UK GDPR"), and India's Digital Personal Data Protection Act ("DPDP Act"). Except where mandatory local laws apply to your personal data, this Policy is governed by the laws of India, and any disputes shall be subject to the exclusive jurisdiction of courts located in India.

The Skin Story Application is intended solely for individuals who meet the digital minimum age requirements of their country of residence. Depending on local privacy laws, the baseline minimum age to create an account or use our services without parental consent is 13 in the United States (COPPA), United Kingdom, and India (DPDP Act); 15 or 16 across member states of the European Economic Area (GDPR/EU Kids Act); and 16 in Australia, Brazil, Malaysia, and Indonesia. Minors below their local threshold require explicit parental or guardian supervision and consent where permitted by law.

We do not knowingly collect, solicit, or store personal information or skin photos from children under the applicable minimum age limit. If we discover that an ineligible minor has registered or submitted personal data, we will immediately take action to permanently delete all associated account information and stored scan data from our servers.

By downloading, installing, or using Skin Story, you confirm that you meet the minimum legal age requirement in your country or region. If you do not meet these eligibility rules, you are strictly prohibited from creating an account or submitting data through the Application.

Skin Story is designed to provide real, observable skin awareness insights derived directly from the information you choose to share with us. It is your responsibility to provide accurate inputs to ensure that your generated insights accurately reflect your personal skin habits, condition, and progress over time. When you register, we collect account details such as your display name, email address, age, skin profile concerns, and account authentication credentials required to create and secure your user profile on our sign-up and login pages.

We collect photographic images, facial scans, and skin texture data captured through your device's camera interface. We collect this data specifically to refine our underlying custom technology layers, run algorithmic pattern analysis, and continuously improve the accuracy of our models for your personalized experience. Camera access is strictly subject to your permission, which you can grant or revoke anytime in your device settings. You retain 100% ownership over your personal inputs and hold full rights to request the complete data deletion of all your stored photos, facial scan data, and account information at any time.

We also collect self-reported daily lifestyle logs, including sleep duration and quality, stress levels throughout your days, water intake, dietary habits, skincare product routines, and custom routines created or shared via invitation codes within the Application. This information is processed to build personalized algorithms tailored specifically to your daily habits and triggers. Automatically, we collect device and technical usage information, including your device model, operating system version, unique device identifiers, IP address, screen resolution, app interaction logs, and crash reports to maintain performance stability and optimize camera interface rendering across different screen sizes.

Finally, we collect customer support messages and feedback to directly respond to and resolve your inquiries or grievances. For paid subscriptions and transactions, payment details are processed through third-party billing software providers, including the Apple App Store, Google Play Store, and independent payment infrastructure like Stripe and Razorpay, with whom relevant transaction data is securely shared to process your purchases without storing your raw credit card numbers on our servers.

We collect information directly when you voluntarily type, upload, or record data within the Skinstory application. This includes submitting your account details during sign-up, entering daily lifestyle logs (such as sleep, diet, and routines), snapping or uploading photos via your device's camera interface, and sending messages to our customer support team. You may request complete data deletion of all such collected information at any time.

We also collect technical information automatically as you interact with the app. Every time you open or use Skinstory, your device silently transmits essential diagnostic details—including your device model, operating system, IP address, interaction logs, and crash reports—to ensure stable performance and UI formatting. Lastly, we receive relevant operational data when you subscribe or complete transactions through the Apple App Store, Google Play Store, or independent payment infrastructure such as Stripe and Razorpay.

We use the information we collect primarily for service provision—delivering personalized skin health scores, zone-specific facial assessments, daily trigger insights, and routine tracking reports through the Skinstory application. Your self-reported lifestyle logs and uploaded photo scans are processed to tailor recommendations specifically to your unique skin profile and habits.

All data collected is used exclusively to train and refine our internal custom technology and proprietary AI models. We do not use your personal information, facial scans, or photos to train external or third-party AI models. We never sell, rent, trade, or monetize your personal data, photos, or biometric information to any third party for marketing, advertising, or commercial purposes under any circumstances. You retain full data deletion rights over all data processed for these purposes.

Additionally, we use technical data and device diagnostics to maintain app stability, optimize camera UI rendering across different screen sizes, resolve software bugs, send critical account communications (such as password resets), and enforce robust platform security.

Because Skinstory analyzes facial photos and skin texture maps to deliver personalized scores, your facial scan data is treated with heightened privacy protections as biometric information under global privacy regulations (including BIPA, CCPA, and GDPR). Facial scan processing occurs strictly with your prior explicit consent, which you provide when using the camera feature for the first time. You can grant or revoke this permission at any time through your device or account settings.

We process your facial photos and derived texture maps solely to generate your personalized skin health scores, zone assessments (forehead, nose, chin), and progress timeline reports. Your facial data is stored in encrypted format on secure servers and is processed exclusively by our internal proprietary technology and custom AI models. We never sell, rent, trade, or share your facial scans or biometric data with third parties or advertisers under any circumstances.

You retain 100% control and ownership over your facial data and enjoy full data deletion rights. If you delete a photo, revoke your consent, or request account deletion, all stored facial photos, scan results, and derived biometric maps are permanently and irreversibly wiped from our servers in compliance with applicable law.

We store your data securely on encrypted cloud servers. While your account remains active, we keep your profile details, daily lifestyle logs, skin scores, and facial photos so you can track your skin progress over time. You have 100% control to execute data deletion for any individual photo or daily log at any time, which removes it from your timeline immediately and permanently wipes it from our active databases.

Closing or deleting your account is completely free. When you request account deletion, all your personal profile details, facial photos, scan scores, and lifestyle logs are permanently deleted from our servers within 30 days. The only items retained are basic payment transaction receipts (such as App Store, Google Play Store, Stripe, or Razorpay order IDs) solely to comply with government tax and auditing laws.

Skinstory enforces a strict zero-selling data policy. We do not sell, rent, trade, lease, or commercialize your personal information, facial photos, biometric scan data, daily logs, or account credentials to any third party, data broker, or advertiser under any circumstances for monetary gain or targeted marketing.

Your data is shared under only two strictly limited circumstances. First, with necessary technical service infrastructure providers (such as encrypted cloud storage facilities, app store billing processors, and independent payment gateways like Stripe and Razorpay) acting strictly on our direct instructions. For these operations, we only transmit securely encrypted database entries. None of your raw personal data—including your facial images, biometric scan maps, daily lifestyle logs, or algorithms—is ever exposed, leaked, or handed over for external commercial use. Second, we may disclose information only if required by mandatory law, court order, or valid legal process to fulfill legal compliance duties. User data deletion requests are honored across all downstream infrastructure systems.

To operate Skinstory smoothly and securely, we partner with a small group of trusted third-party technology infrastructure providers. These include cloud data storage platforms to host encrypted database records, mobile system analytics and crash-monitoring tools to fix software bugs, official app store billing gateways (Apple App Store and Google Play Store), and independent payment infrastructure like Stripe and Razorpay to process subscription payments without storing raw credit card numbers on our servers.

We strictly prohibit any third-party provider from accessing, using, sharing, or analyzing your data for their own independent purposes. All third-party service providers are bound by strict legal data processing contracts and confidentiality obligations. They are strictly forbidden from viewing or processing your specific personal details—including your facial scans, biometric texture maps, daily lifestyle logs, email address, IP address, or account passwords. Access is granted solely to perform required system infrastructure tasks under strict encryption, and all providers must honor user data deletion requests.

When you visit our website or use digital features connected to Skin Story, we use essential session cookies, local storage tokens, and performance analytics tools to maintain secure user authentication, remember your preferences (such as dark mode), and deliver a seamless, high-performance experience across your devices.

We also utilize operational analytics technologies to monitor traffic sources, referral URLs, device details, and application usage patterns. We collect these technical analytics strictly to troubleshoot software bugs, optimize camera UI rendering, and continuously improve your overall experience on the Application and getskinstory.com. We do not use third-party advertising cookies, cross-site tracking pixels, or data broker tools to target ads or sell your personal information. For a comprehensive breakdown of our technical analytics tracking and management settings, please visit our Cookie Policy.

Skinstory is not directed to or intended for children under the legal digital minimum age limit (under 13 in the United States, UK, and India, and under 15-16 across Europe). We do not knowingly collect, solicit, or store personal information or facial photos from children below these regional thresholds without verified parental consent.

If we learn that we have inadvertently collected personal data from a child below the legal minimum age, we will take immediate steps to execute complete data deletion, permanently wiping all associated account records, facial scans, and lifestyle data from our servers. Parents or guardians who believe their child has provided data to us may contact support to request immediate account removal.

Under the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), California residents enjoy specific privacy rights regarding their personal and sensitive information. Skinstory does not sell or share your personal information or biometric data for cross-context behavioral advertising.

California users have the right to know what personal information we collect, the right to request full data deletion of their personal and sensitive data, the right to correct inaccurate records, and the right to opt-out of automated profiling. We guarantee zero discrimination or degraded service quality for California users who exercise their privacy rights.

If you are located in the European Economic Area (EEA), the processing of your personal data is governed by the General Data Protection Regulation (GDPR). We process your personal data based on explicit consent for facial scan processing, contractual necessity for account management, and legitimate interest for maintaining platform security.

EEA residents hold comprehensive statutory rights under the GDPR, including the right to access, rectify, port, or restrict processing of their personal data, as well as the right to erasure ("Right to be Forgotten") to execute permanent data deletion. You also have the right to withdraw your consent at any time and lodge a complaint with your local Data Protection Authority.

For users residing in the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018. Skinstory adheres strictly to the core principles of data minimization, purpose limitation, and strong encryption safeguards.

UK residents have rights identical to EU GDPR protections, including full rights to data deletion, access, data portability, and restriction of processing. If you have concerns regarding our UK data practices, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

For users residing in India, the handling of your personal data is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act). Skinstory acts as a Data Fiduciary and processes your personal data solely for lawful purposes based on your clear, affirmative consent.

As a Data Principal under the DPDP Act, you have the right to obtain a summary of your personal data being processed, the right to request data deletion and correction of inaccurate records, the right to nominate another individual in the event of incapacity, and the right to seek grievance redressal through our designated Grievance Officer.

We implement robust technical and organizational security measures to protect your personal information, facial photos, and biometric data against unauthorized access, loss, alteration, or disclosure. All data transmissions occur over encrypted SSL/TLS channels, and stored database files are protected using strong AES encryption.

While no electronic transmission or cloud storage system is 100% immune to vulnerabilities, we continuously audit our infrastructure security controls and restrict internal system access strictly to authorized personnel on a need-to-know basis.

We may update this Privacy Policy from time to time to reflect changes in our technology, legal obligations, or service features. Any updates will be posted on this page with a revised Effective Date. For significant material changes, we will notify you via an in-app notice or email prior to the changes taking effect.