Privacy Policy

Cilt Rota does not save raw skin check-in photos to your history. Your device keeps derived scores, goals, routine completions, daily context, journal notes, and ingredient favorites.

What we process

When you choose a photo, the app writes a compressed temporary copy into its own cache on your device so it can be analysed. That temporary file is deleted as soon as the result is saved, or when you replace or remove the photo. If you pick a photo but do not analyse it, it stays on your device as a pending check-in until you remove it or choose another one; it is never uploaded on its own. In local demo mode it never leaves your device. When the secure AI backend is configured and you start a live analysis, the photo is sent over an encrypted connection to our Supabase Edge Function and the configured AI processor solely to generate the requested result, and it is not written to our database.

What we store

We may store the resulting score, visible-signal notes, routine steps, language, timestamps, your account identifier, and limited quota records (for example, whether you have used your free AI check-in, or how many AI coach messages you have sent this month). Your account: AI check-ins require an account. We store the email address and sign-in method you choose (Sign in with Apple, Google, or email and password). With Sign in with Apple we may receive your name the first time you sign in, and Apple may give us a private relay address instead of your real email; we also keep a token from Apple solely so that we can revoke it when you delete your account. Passwords are stored only as salted hashes by our identity provider. Subscriptions: if you buy Cilt Rota Premium, the purchase is handled by Apple or Google; we receive the subscription status, product, and renewal dates, never your payment card details. Daily skin-feel, sleep, water, stress and SPF context, private journal entries, and ingredient favorites are stored locally on your device. Raw photos and base64 image payloads are not written to our database.

AI coach

The AI coach is optional and requires an account. When you send a message, the app sends to our Supabase Edge Function: your message, up to the last 12 messages of the current conversation, your app language, and a short summary of your in-app context — your goals, the scores of your latest check-in, today's routine progress, how many days you logged this week with your average water and sunscreen days, the product categories or ingredients you keep, and how many patch tests you have running. Your photos, journal notes, sleep and stress entries are never sent. The edge function checks the text with OpenAI's moderation service and forwards it to OpenAI to write the reply. We do not store your coach messages or the conversation on our servers and do not log their content; we keep only a counter of how many coach messages you have used (per month on the free plan, per day on Premium) to apply the limits. Coach replies are general cosmetic guidance, not medical advice.

Purpose and legal basis

We process check-in data to provide the feature you request, prevent abuse, maintain security, and improve reliability.

Crash and performance diagnostics

The app includes Sentry for crash and performance diagnostics. When the app crashes or a request fails, Sentry receives a technical report: error type and stack trace, app version, operating system, device model and a generated installation identifier. This is required for the app to run and cannot be switched off in-app; we declare it as such on Google Play. Sentry is configured not to attach personal data to reports — your photos, scores, journal entries and notes are never sent. Reports are stored in the EU. Product analytics (PostHog) is not enabled in this release; no product-interaction events are collected.

Sharing and retention

We do not sell your data or share it with third parties for their own purposes. We use processors acting on our instructions: Supabase (infrastructure and account identity), RevenueCat (subscription status and purchase validation), Apple and Google (sign-in and in-app purchases, under their own terms), OpenAI (the AI processor that analyses the photo and writes AI coach replies), and Sentry (diagnostics). Photos and coach messages sent to OpenAI are processed to return your result or reply; OpenAI may retain API inputs for a limited period for abuse monitoring under its own policy. Derived results are retained until you delete them, subject to limited security records and legal obligations. Local data can be reset from the app.

Your choices

You may use the labelled local demos without a backend, avoid submitting a photo, skip any daily field, delete journal entries, remove favorites, or reset all local data. Inside the app, Profile → Your data rights lets you download everything we hold for your account as JSON (GDPR Art. 15) and permanently delete all of your data in this app from our servers and this device — including your subscription record with RevenueCat and, for Sign in with Apple, the Apple token for Cilt Rota (GDPR Art. 17). Your sign-in identity is deleted as well, unless you use the same Google, Apple or email account in another of our apps: then only your Cilt Rota data is deleted and your account there is not affected. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account settings. If you have already uninstalled the app, see Delete your data.

Reporting AI results

Every result screen has a Report this result action. Reports reach our team and are reviewed within 24 hours; offensive or unsafe output is removed and abuse is acted on. Your photo is never included in a report — only the result identifier. You can also write to [email protected].

Children and medical data

Cilt Rota is not intended for children under 13. It is a cosmetic wellness tool and does not diagnose or treat health conditions.

Contact

Questions or privacy requests: [email protected].