Privacy Policy
Draft for legal review. Placeholders in yellow are completed before publication.
- Your face photos never reach our servers. Scans are analysed on your device. We never receive your photos, and nor does any company we work with. They stay on your phone, and in your own iCloud Backup only if you turn that on (section 2).
- Nothing about your face is sent to us — not the photos and not the points used to line up your next scan.
- Your account holds your subscription. Storing your skin data in it is optional: you can keep all of it on your phone only.
- If you choose to save it to your account, we store your skin scores, routine and the things you log on servers in the EU — only after you agree to it on a separate screen.
- Scores are worked out on your phone. AI never sets your score.
- No ads, no tracking, no selling or sharing for advertising. We don't use your data to train AI models.
- You're in control: export your data or delete everything from the app (Profile → Privacy & data).
- Otilie is a cosmetic skincare coach, not a medical service. It doesn't diagnose or treat anything.
1. Who we are
Otilie is provided by Miguel Ridruejo Mendoza, Calle de Elisa 24, 08023 Barcelona, Spain (tax ID 02585581J) — “Otilie”, “we”, “us”. We are the controller of your personal data.
Questions or requests: privacy@otilie.app. [Data protection officer: name and contact, or "We have assessed that we are not currently required to appoint a DPO."]
You can also complain to the Spanish Data Protection Agency (AEPD), aepd.es, or the authority in your country.
2. What stays on your phone
- Face photos. Taken by the camera, analysed on your iPhone, and stored in Otilie's private storage on your phone. They're left out of iCloud and device backups unless you turn on Keep a copy in iCloud Backup (below). You can delete them at any time (Profile → Privacy & data → Delete all scan photos) or turn off keeping them.
- Face outline. A set of points that helps you line up the next scan the same way. It's created and kept on your phone (and in your own iCloud Backup only if you turn that on). It isn't used to identify you and is never sent to us.
- Product photos. When you snap a product's label, a small square copy of that photo is kept as the product's picture, in Otilie's private storage on your phone, left out of backups unless you turn on Keep a copy in iCloud Backup. It's never uploaded to us, synced to your account or included in your data export. It's deleted with the product and when you delete your data. A product found by its barcode or by search may instead show its photo from Open Beauty Facts (see section 6), kept the same way.
- The analysis. Your skin scores are computed on your phone by our own software. No photo or face data is sent anywhere to produce them.
- Reminders. Scheduled on your phone; no server is involved.
Keep a copy in iCloud Backup (optional, off unless you turn it on). In Profile → Privacy & data, or when the app asks once after your third scan, you can include everything Otilie keeps on your phone — your scans and face photos, the face outline, skin profile, products and product photos, routine log, the events you log, experiments and coach conversations — in your own iCloud Backup, so it comes back if you restore an iPhone from that backup. It only works if iCloud Backup is turned on for your iPhone. The backup belongs to your Apple account: Apple stores and protects it under its own terms, and it never reaches our servers — we never receive it or have access to it. To stop, turn the switch off: your next iCloud Backup leaves Otilie's data out. Earlier backups are Apple's to keep or replace as your iCloud settings say, and you can delete them there. Delete all my data also turns the switch off.
If you don't agree to save your skin data to your account, everything Otilie stores about your skin stays on your phone (and in your own iCloud Backup, if you turned that on) and is deleted from the phone when you delete the app; your account then only holds your sign-in and subscription.
3. Data we process, why, and on what basis
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account: email address; your Apple or Google account identifier and, if you share it, your name | When you create your account | Sign you in, link your subscription, send sign-in codes | Contract (Art. 6(1)(b)) |
| Skin and health-related data: skin scores per measure, the light conditions of each scan, your skin profile (goals, skin type, how often your skin reacts, ingredients you avoid, age range), the products you use and your routine log, experiments, and life events you choose to log (for example stress, poor sleep, travel, sun, a breakout or your period) | Stored on our servers only if you give the separate consent below | Back up your progress and restore it on your devices | Explicit consent (Art. 9(2)(a)) |
| Subscription status: whether you have a trial or subscription, product, price, store country, expiry and renewal dates, and whether it renews (never your card details — Apple handles payment) | If you subscribe | Unlock premium features, keep access across devices, and email you the notice the law requires at least 15 days before an automatic renewal | Contract; legal obligations for financial records and renewal notices (Spanish consumer law; Art. 6(1)(c)) |
| AI coach conversations: your messages and the coach's replies, plus your skin profile, scores, products, events and experiments, which the coach uses to answer (never your name, photos or face data). Stored on your phone; passed through our server to Anthropic and not stored by us | Only if you use the coach and give its separate consent | Answer your questions about your routine and progress | Explicit consent (Art. 9(2)(a)) |
| Product lookups: a barcode or product name you search, and the request for that product's photo | When you check a product | Find the product's ingredients and its photo | Contract |
| Support emails: what you write to us | If you contact us | Help you | Contract / legitimate interest (Art. 6(1)(f)) |
| Security logs: IP address, device and request data on our servers | When the app talks to our servers | Keep the service secure and prevent abuse | Legitimate interest (Art. 6(1)(f)) |
| Anonymous setup counts: weekly totals of how many people reached each setup step (started, questions answered, first scan, routine ready, signed in, plans shown, plan started) and a second scan, per app version. Each step adds one to a total, once per install; nothing that identifies you or your device is sent with it, and we keep only the totals. To count each step once, your phone remembers which steps it has already counted; that never leaves the phone | The first time you reach each step | See where people stop during setup, to improve it | Legitimate interest (Art. 6(1)(f)) |
We don't collect your location, contacts or advertising identifier, and nothing about how you use the app beyond the anonymous setup counts above.
4. The consents we ask for
We ask for these on separate screens, worded exactly as below, with nothing pre-selected, and never as a condition of using the rest of the app. Each can be withdrawn at any time in Profile → Privacy & data; withdrawing doesn't affect what was done before.
5. The AI coach
The coach is clearly labelled as an AI — not a person and not a dermatologist. It uses Anthropic's Claude models through our server. We send only what's needed to answer (your message, skin profile, recent scores, products, logged events and experiments), never your name, photos or face data. Under Anthropic's commercial terms, your data isn't used to train their models. Your skin scores are never produced or changed by AI. If you describe symptoms that need medical attention, the coach tells you to see a doctor instead of answering.
6. Who processes your data
We use a small number of service providers who process data only on our instructions, under data processing agreements.
| Provider | What for | Data | Where / transfer safeguard |
|---|---|---|---|
| Supabase | Database and sign-in | Account, synced data | EU (Ireland). Supabase Inc. is US-based: Standard Contractual Clauses |
| Postmark (ActiveCampaign) | Sign-in code emails and renewal notices | Email address, the email sent | US: EU-US Data Privacy Framework |
| RevenueCat | Subscription status | Anonymous app user ID linked to your account, purchase records | US: Standard Contractual Clauses |
| Apple | App Store payments, Sign in with Apple | Handled under Apple's own privacy policy | Apple is a separate controller |
| Sign in with Google (if you choose it) | Handled under Google's own privacy policy | Google is a separate controller | |
| Anthropic (coach, when available) | AI replies | Coach messages and the context in section 5 | US: Standard Contractual Clauses [confirm at coach launch] |
| Open Beauty Facts | Product ingredient database and product photos | The barcode or product name you search, and your IP address as for any website (also when a product's photo is downloaded, only after your own scan or search) | France (EU). An open database, not given any account data |
| Cloudflare | Hosting this website | Standard web request data | Data Privacy Framework |
We may disclose data if the law requires it. We'll challenge requests that aren't lawful and, where allowed, tell you.
7. What we never do
- Sell your data, or share it for advertising or tracking.
- Use your data, photos or conversations to train AI models.
- Use health-related data for marketing.
- Store your health-related data in iCloud ourselves, or receive your iCloud Backup. A copy in your own iCloud Backup exists only if you turn it on (section 2).
- Infer your ethnicity or other sensitive traits from your face.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account and synced data | Until you delete your account or withdraw sync consent. Removed from live systems within 30 days and from backups within 90 days. |
| Inactive accounts | Deleted after 3 years without signing in, after an email reminder. |
| AI coach conversations | On your phone until you delete them (Coach › Past conversations, or Delete all my data). Our server doesn't store them; it keeps only a daily count of coach requests, to apply the daily limit. Anthropic deletes what it receives within 30 days, unless it is flagged by its safety systems (then up to 2 years) or the law requires otherwise, and never uses it to train models. |
| Sign-in code emails and renewal notices | Delivery records up to 45 days at Postmark. |
| Subscription records | For as long as the law requires for financial records (in Spain, up to 6 years), then deleted. |
| Security logs | Up to 90 days. |
| Anonymous setup counts | Kept as weekly totals, which contain nothing about any one person. |
| Support emails | 2 years after the conversation ends. |
9. Your rights
You can ask to access, correct, delete or receive a copy of your data, restrict or object to processing, and withdraw consent at any time. Most of this is built into the app: Export my data, Delete all my data (from this phone and, if you save your skin data to your account, from your account and your other phones too) and Delete account in Profile → Privacy & data. For anything else, email privacy@otilie.app; we reply within one month. We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
10. Security
Data is encrypted in transit and at rest. Each account can only access its own data, enforced in the database itself. Photos on your phone are stored with iOS file protection. If a breach puts your data at risk, we'll notify the authority within 72 hours and tell you without undue delay.
11. Age
Otilie is for people aged 16 and over. We don't knowingly collect data from younger people; if you believe we have, contact us and we'll delete it.
12. United States residents
Our Consumer Health Data Privacy Policy explains how we handle consumer health data under Washington, Nevada and Connecticut law. We don't sell personal information or share it for cross-context behavioural advertising.
13. Changes
We'll tell you in the app before material changes take effect. Previous versions are kept at [otilie.app/privacy/versions].