Privacy Policy

This policy describes what Glow does with your information. It is written to describe the app as it actually behaves, not as we intend it to behave later.

1. Who we are and how to reach us#

Glow is operated by Dharmarajsinh Jethva and Asiqur Rahman, trading as DA App Ventures. Both are joint data controllers for the information described here.

• Email: help@daappventures.com

Glow is distributed through Apple's App Store and may be available outside the United States. We are established in the United States, so wherever you use the app from, your information is handled there. See section 7.

2. You must be 18 or older#

Glow is for adults. You must be at least 18 years old to create an account or use the app.

Before you can scan, the app asks for the month and year you were born. It uses them only to work out whether you are 18 or older, and then discards them. What we keep is that you said you are 18 or older, and when. This is a declaration you make yourself: we do not check documents or ask anyone else.

If your answer shows you are under 18, the app does not let you continue and offers to let you correct a mistyped answer. Nothing about an under-18 answer is stored.

We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it and everything in it. If you believe a minor has created an account, contact us at the email address above.

---

3. What we collect, and why#

3.1 Your account#

You can create an account in one of three ways:

• Email and password. Passwords are handled by Google Firebase Authentication and are never visible to us.
• Sign in with Apple. Apple gives us an email address, which can be a private relay address if you choose to hide yours, and, the first time you sign in, your name.
• Continue with Google. Google gives us your email address, your name and a link to your Google profile picture, which Firebase Authentication keeps with your sign-in.

If you forget your password, Firebase Authentication emails you a link to reset it.

We keep an account record holding your email address, your name if we have one, and when the account was created. In Settings, tapping your name at the top opens Profile, where you can change your name and add a profile photo, taken with your camera or chosen from your photo library. The app asks for access to your camera or your photos the first time you do this, and uses only the photo you take or pick. The photo is resized to 512 by 512 pixels and stored in Google Cloud Storage, and its link is saved in your account record and your sign-in profile. When you change or remove it, the app deletes the old file; if that fails, the file is removed when you delete your account. Your profile photo is not analysed and is never sent to an AI model.

3.2 Your age answer and your consent#

We store that you said you are 18 or older, the time your phone recorded, and the time our server received it. It can be written once and not changed afterwards.

We also store your consent to the processing described in section 5: which version of the consent screen you agreed to and when. Alongside it we keep a history of every time you agreed or withdrew, with the version, the time, and where in the app it happened (during sign-up, at a later prompt, or in Settings). The app can add to that history but cannot change or delete an entry. Before every scan our server reads it to check that your most recent choice was to agree.

The age question and the consent screen come before you create an account. Until you do, your answers wait on your phone for at most an hour, and they are attached only to an account created after you gave them. Once they are saved to your account, the copy on your phone is cleared.

3.3 Your skin profile#

During sign-up, or later in Settings > Skin profile, we ask four questions and store your answers:

• your skin type (oily, dry, combination, balanced, or not sure)
• how often your skin reacts to new products
• your goals, such as hydration, a smoother-looking texture, or a simple routine
• how your skin usually responds to the sun, which you can answer "not sure"

Our routine rules use these answers to choose ingredient types and how often to use them. The sun-response answer is only what you tell us. We never estimate it from your photo, and we never show it to you as your skin tone. You can change any answer in Settings > Skin profile, which rebuilds your current routine.

Your answers themselves are not sent to Google's AI. The routine built from them is, as section 4 explains.

3.4 Your selfies#

This is the most sensitive thing the app handles.

You take a selfie with your phone's front camera inside the app, or choose one from your photos through the system photo picker, which gives Glow only the photo you pick. The app does not use your microphone and does not ask for your location.

Before uploading, the app re-encodes the photo as a JPEG no larger than 1600 pixels on its longest side. It is then uploaded to Google Cloud Storage, in a location only your account can read or write. From there it is analysed by Google's Gemini AI (section 4) and then deleted (section 8).

On your phone, the copies the app makes live in its temporary cache. The resized copy is deleted after every upload attempt. The original is deleted once the upload succeeds, when you retake, or when you close the camera; if an upload fails, it is kept so you can retry. A photo you chose from your library stays in your library: Glow never changes or deletes it.

Progress photos. Versions of the app before 1.0.0 (7) mentioned an option to keep progress photos on the consent screen. That option has never existed, so every selfie is deleted after its scan. If we add it, we will update this policy first, and no selfie will be kept unless you turn the option on.

Only your own face. See section 9.

3.5 Your scan results and your routine#

For each scan we store:

• its progress and outcome, and, if the photo could not be used, what was wrong with it (for example, too dark, more than one face, or a filter)
• your Monk Skin Tone value, from 1 to 10, with how confident the analysis was
• your undertone (cool, neutral, warm, olive, or hard to tell), with how confident the analysis was
• a colour season, which is style guidance only, with how confident the analysis was
• how visible each of ten cosmetic signs looks, from none to noticeable: visible redness, uneven-looking tone, the look of dark spots, visible blemishes, visible pores, the look of fine lines, under-eye darkness, dryness, oiliness (shown in the app as "Shine"), and uneven texture
• a summary of up to two sentences, written by the AI
• your routine: morning and night steps naming ingredient types, how often to use them, why, and general notes
• the photo's width and height, when the scan was made and analysed, and which AI model analysed it

Your account record also notes which scan is your latest. The app shows only that one, but earlier scans stay stored in your account. See section 8.

3.6 Subscription information#

If you subscribe, purchases are processed by Apple. We never see your payment card. We use RevenueCat to manage subscriptions. We identify you to RevenueCat by your account ID only, not by your name or email address.

We store your current plan (whether you have Pro, which plan, whether it is a trial, when it ends and whether it renews), a count of how many scans you have completed today, which enforces the limit of 10 a day, and a log of the subscription events RevenueCat sends us (the type of event and when it happened).

3.7 Notifications and reminders#

Notifications. The app asks to send you notifications in two places only: when you tap "Notify me" while a scan is running, and when you turn on routine reminders (below). If notifications are allowed, opening a scan's progress screen stores a device token in your account so we can tell you when a scan is ready. Signing out removes the token from your account.

The notification says only "Your skin scan is ready" and "Tap to see your results and routine." It deliberately carries no skin tone, no concern and no numbers, because it is displayed on your lock screen, where anyone near your phone can read it, and it travels through Google's Firebase Cloud Messaging and Apple's Push Notification service to get there. It also carries the scan's ID, so that tapping it opens the right scan.

Routine reminders are optional and stay on your phone. If you turn them on, your phone schedules them itself, and the times you choose are stored only on your phone. Each one only says which routine it is, for example "Time for your morning routine". Nothing about them is sent to us, and signing out cancels them.

3.8 Crash reports and server logs#

We use Firebase Crashlytics to record crashes and errors: the device model, operating system version, where in the app the failure happened, the error message, and a random identifier that Firebase creates for this installation of the app. We do not tag crash reports with your account ID, and we do not put your photos, your results or your skin profile into them.

We do not use analytics. The Firebase Analytics library is part of the app but is switched off in its configuration, and the app records no analytics events. In-App Messaging data collection is switched off too. We do not track you across other apps or websites. The app shows no ads and never asks for permission to track you, so it cannot read your device's advertising identifier.

Our server logs record your account ID, and sometimes a scan's ID, for some events, such as an account deletion, a routine rebuild, a subscription update (with whether you have Pro), or a notification that could not be delivered, and how long each step of a scan took. They never contain your photo or your results.

3.9 What stays on your phone#

Besides the reminders above, the app keeps a few small notes on your phone: whether you have finished sign-up, whether it has shown you the subscription offer and offered reminders, which sign-in methods have been used on this phone (so it can warn you before you create a second account by mistake), and, for five minutes after you start a scan, that scan's ID so the Home screen can show it is running. None of them contains anything about your skin.

The database library the app uses also keeps an offline copy on your phone of the account information it has shown you, including your skin profile and your latest results, so the app works without a connection. The app does not clear that copy when you sign out or delete your account; deleting the app from your phone removes it.

---

4. How the AI analysis works, and what Google receives#

When you take a scan:

1. The app uploads your selfie. Before any AI runs, our server checks your consent history and your age answer (section 3.2), then your subscription and your daily limit. If any of these is missing, the scan stops and the selfie is deleted.
2. Google's Gemini model, running on Google Cloud's Vertex AI in its United States multi-region, reads the selfie directly from our storage. It first checks only whether the photo is usable: one face, in frame, evenly lit, with no filter. If it is not, the app asks you to retake it.
3. The model then assesses your skin tone (three times, keeping the middle answer), your undertone, a colour season, and the cosmetic signs and summary listed in section 3.5.
4. Fixed rules we wrote, not AI, choose every step of your routine from those results and your skin profile. They suggest over-the-counter ingredient types, never brands.
5. Your selfie is deleted.
6. A second request to Gemini, which does not include your photo, rewords your routine in plain language. It receives each step's ingredient type, how often to use it, and short codes saying why, such as which visible sign it addresses or that it matches one of your goals. If that request fails, the app uses its own fixed wording.

If you change your skin profile, step 6 runs again for your latest scan, with no photo.

What the model is told. Every request that assesses your skin, and the request that words your routine, instructs the model never to mention or infer race, ethnicity, nationality, age, gender or identity, and never to name a medical condition or give medical advice. The check in step 2 is told to judge capture quality only, and not to describe or assess your skin, skin tone, age, gender, ethnicity, identity or appearance. We also check the AI's written summary and routine wording against a list of words our rules do not allow; a summary that uses one is written again once and otherwise dropped, and routine wording that uses one is replaced by the app's fixed wording.

What Google does with it. We use Gemini through Vertex AI, Google Cloud's paid service, never the free Gemini tier, whose terms allow prompts to be used for training. Google processes what we send as our service provider, and under its terms for this service it does not use it to train its models.

There is nowhere to type freely. Nothing you type in Glow is sent to the AI.

5. Why we process your information#

We process your information to create and run your account, to analyse your selfies and give you your results and routine, to manage your subscription, to keep the app working and secure, to send you notifications if you allow them, and to meet our legal obligations.

If you are in the UK or the EEA#

These are the legal bases we rely on under the UK GDPR and the EU GDPR.

The consent you give before your first scan#

A photo of your face, and what is drawn from it about your skin, is information we treat with the highest care. The consent screen calls it biometric and health data, and we ask for your explicit consent before any of it is collected or analysed.

On a screen titled "Before you start", the app tells you that:

• each selfie you take is sent to Google's Gemini AI, processed in the US, to assess your skin tone, undertone and visible skin concerns, and to write your routine
• your face photos and skin results are used only to give you your results, and are never sold or used for ads
• each selfie is deleted after its scan, and your results stay in your account until you delete your account (versions before 1.0.0 (7) also mentioned progress photos, an option the app has never had; see section 3.4)
• results are assessed by AI and can be wrong, especially in poor lighting, and are cosmetic guidance only, not a medical assessment

The screen links to this policy. You agree by ticking a box that starts unticked and tapping "Agree and continue". Your agreement is recorded as described in section 3.2, so we can tell you later exactly what you agreed to. If you do not agree, you cannot scan, but you can still use Settings, including deleting your account.

You can withdraw it in the app. Go to Settings > Legal > Withdraw consent. From then on Glow does not analyse new selfies, and our server refuses any scan until you agree again. The app asks you again before it shows your skin screens. Withdrawing does not delete results you already have: they stay in your account until you delete your account or ask us to delete them (section 8). Withdrawing does not affect what we did before you withdrew.

If we change what the consent screen asks you to agree to, the app asks you to agree again before your next scan.

6. Who receives your information#

We do not sell your information. We do not share it for advertising, and we have no advertising or affiliate partners. We have never done either and have no plans to.

Each of these services also receives what any connection to it carries, such as your IP address and the app's and your phone's software versions.

No recipient other than Google, which hosts and produces them, receives your selfies or skin results. We may also disclose information if we are legally required to, or to protect someone's safety.

7. Where your information is processed#

Your account, skin profile, consent records, selfies, results and routines are stored and processed in the United States: our database and our file storage each use a US multi-region, our server functions run in us-central1, and Gemini runs in Vertex AI's US multi-region. We never use Google's global AI endpoint, which may process requests outside the United States.

We have not chosen where Firebase Authentication, Crashlytics, Firebase Cloud Messaging, Google Cloud Logging (our server logs), RevenueCat or Apple process the information they receive, and they may process it outside the United States. Google, Apple and RevenueCat are United States companies.

If you are in the UK, the EEA, or anywhere else outside the United States, using Glow means your information is transferred to the United States and handled under United States law, which does not give it the same protection your own law does. Where the law requires a basis for that transfer, we rely on its being necessary to provide the service you ask for (Article 49(1)(b)) and, for your selfies and skin data, on your explicit consent given after being told of that risk (Article 49(1)(a)).

8. How long we keep things, and how to delete them#

Selfies are deleted after every scan, whether it completes, needs a retake, is stopped or fails. If a scan is cut off before it can clean up, an hourly clean-up deletes any selfie more than an hour old, so a selfie left behind is gone within about two hours.

Results and routines are kept until you delete your account. This includes earlier scans: the app shows only your latest scan, and a new scan replaces what you see, but it does not delete the earlier ones. There is not yet a control in the app to delete a single scan. Email us and we will delete your earlier scans, or all of your results, without closing your account.

Your skin profile is kept until you change it or delete your account. Your age answer and consent history are kept until you delete your account; withdrawing adds an entry to the history rather than erasing it. Your profile photo is kept until you change or remove it, or delete your account. Your subscription records are kept until you delete your account. Notification tokens are kept until you sign out or delete your account.

Deleting your account is done in the app, in Settings > Danger zone > Delete account — see how to delete your account. It removes: every scan with its results and routine; every file we hold for you, including any selfie not yet deleted and your profile photo; your skin profile, age answer, consent and consent history; your subscription status, daily count and subscription event records; your notification tokens; your account record; and your sign-in itself. If you use Sign in with Apple, the app first asks Apple to withdraw Glow's access to your Apple ID. On your phone, the app then signs you out, cancels its reminders and clears any sign-up answers it still holds. The offline copy described in section 3.9 stays until you delete the app.

Deleting your account does not cancel your subscription. Cancel it in your Apple ID settings.

What deletion does not reach. Apple keeps its own record of your purchases under its own policies, and we cannot delete it. RevenueCat keeps its record of your account ID and purchase history under its own retention schedule; email us and we will ask for it to be deleted. Crash reports already sent to Crashlytics are kept under Google's schedule. Server log entries containing your account ID are kept for our logging service's retention period and then deleted automatically. If you used Continue with Google, Glow stays listed in your Google Account's connected apps until you remove it there.

9. Only your own face#

Scan only your own face. The photo check asks for a retake when it sees more than one face, but it is not perfect. If someone else's face is in a selfie you submit, it is stored and sent to Google exactly as yours is, and that person has not agreed to this policy. Please do not submit a photo of anyone else, and never of a child.

10. Face analysis, skin tone and identification#

Glow analyses how your skin looks, not who you are. We do not use your selfies to identify you, to match you against any database, or to recognise you elsewhere. We do not create or store a face template, a faceprint, or measurements of your face's geometry. From each selfie we keep only the results listed in section 3.5, and the selfie itself is deleted.

Skin tone is described on the Monk Skin Tone Scale (by Google, CC BY 4.0), from 1 to 10. Every tone on it is equally valid; it is a description, not a ranking. We use it only to match products and shades in your routine, such as which sunscreen to suggest. It is never something to change or even out, and we never use it for advertising or targeting.

We do not infer your race or ethnicity, and nothing we store records either. The model is instructed never to mention or infer them (section 4).

11. Your rights#

Depending on where you live, you may have the right to access, correct, delete, port, object to, or restrict our use of your information, and to withdraw consent. You also have the right to complain to your local data protection authority.

Several of these are in the app: deletion (section 8), withdrawing consent (section 5), and correcting your skin profile, name and profile photo in Settings. For anything else, email us at help@daappventures.com and we will respond within one month. Access and portability requests are handled manually.

If you are in California, you may request disclosure, deletion, and correction, and may limit the use of sensitive personal information. We use your selfies and skin data only to provide the service you asked for. We do not sell or share personal information as those terms are defined under the CCPA. We will not discriminate against you for exercising these rights.

If you are in another US state with a consumer privacy law, you may have similar rights to access, correct, delete and receive a copy of your information. We do not sell it, use it for targeted advertising, or profile you in ways that produce legal or similarly significant effects, and we ask for your consent before processing sensitive data. If we refuse a request, you can appeal by replying to our response; if we deny the appeal, you can contact your state's Attorney General.

If you are in the UK or the EEA, you have the right to ask us for a copy of what we hold about you, to have it corrected, to have it deleted, to receive it in a portable form, to object to or restrict what we do with it, and to withdraw any consent you have given. Withdrawing consent does not affect what we did before you withdrew it.

You can also complain to your data protection authority. In the UK that is the Information Commissioner's Office. In the EEA it is the supervisory authority for the country you live in.

If you are in Washington or Nevada, a separate Consumer Health Data Privacy Policy describes how we handle consumer health data and the additional rights you have.

12. How we protect your information#

Your selfies and profile photo are stored where only your own account can read or write them, enforced at the storage layer. Your results, routine, subscription status and daily count can only be written by our servers, never by the app. Your consent history can be added to but not changed. Data is encrypted in transit and at rest by our hosting providers.

Your profile photo is served through a long, unguessable web link. The link is kept in your account record, but anyone who obtained it could open the photo.

No system is perfectly secure, and we do not claim otherwise.

13. If something goes wrong#

If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay.

14. Automated analysis#

Your results are produced automatically by an AI model, without human review. Every result carries the note: "Assessed by AI. Cosmetic guidance only, not a medical assessment. Results can vary with lighting." Your routine is chosen by fixed rules, and only its wording is written by AI. None of this has legal or similarly significant effects on you. Results can be wrong, especially in poor lighting — see our Terms of Service.

15. Changes to this policy#

If we change this policy materially, we will tell you in the app before the change takes effect. If a change affects what you agreed to on the consent screen, we will ask for your consent again before your next scan. Continuing to use Glow after that means you accept the updated policy.

16. Contact#

Dharmarajsinh Jethva and Asiqur Rahman, trading as DA App Ventures

help@daappventures.com