Clear choices for personal skincare data.

1. Scope and who we are

Connie's Skin is a skincare routine companion operated by Charles Gao (“Connie's Skin,” “we,” “us,” or “our”). This policy applies to the Connie's Skin mobile application, this website, and related support and checkout services.

The app provides educational cosmetic routine organization and ingredient guidance. It does not provide medical diagnosis or treatment.

2. Information we collect

We collect information you provide, information created as you use app features, and limited technical information required to deliver the service.

Account and contact information

• Email address and optional display name.
• Email address if you join the beta waitlist on our website.
• Authentication records. Passwords are handled by Supabase Auth and are not visible to us in plain text.
• Messages and contact information you send when requesting support.

Skin profile, routine, and progress information

• Skin type, concern, sensitivity, budget, routine-size preference, onboarding selections, and product recommendations.
• Products, brands, ingredient tags, purchase links, routines, ordered steps, weekly schedules, reminder preferences, and completion history.
• Bundle-access status and a normalized redemption code when one is accepted.

Photos and scan results

• Product photos you explicitly choose to upload.
• If you use the optional AI skin scan, a face photo you capture or select for that scan request.
• AI scan output such as overall and category scores, advice, model identifier, and scan date.

Purchase and order information

• Items selected, totals, discount, order status, shipping contact details, and Stripe Checkout or PaymentIntent identifiers.
• Stripe handles payment-card information. If you choose Apple Pay or Google Pay, that wallet provider and Stripe process tokenized payment credentials. Connie's Skin does not receive or store your full card number.

Technical information

Our hosting, authentication, database, Edge Function, and payment providers may process IP address, request timing, device/browser details, and security or diagnostic logs as needed to operate and protect their services. Connie's Skin does not currently include a third-party advertising or behavioral analytics SDK.

3. How we use information

• Provide accounts, synchronize app data, and restore your routine across supported devices.
• Build personalized product and routine suggestions from quiz answers.
• Evaluate the routine rules you configure and show ingredient cautions.
• Track completion, adherence, milestones, and scan history.
• Process product images and optional AI skin scans.
• Create, fulfill, and support routine-kit orders.
• Schedule reminders you enable on your device.
• Protect the service, prevent abuse, troubleshoot failures, and respond to support requests.
• Comply with legal obligations and enforce our terms.

We do not use routine, scan, or account data to build an advertising profile.

4. Product photos and the optional AI skin scan

When AI analysis is enabled, the face image is sent through a Supabase Edge Function to Google's Gemini API. Google processes the image and response under its applicable API terms and privacy/data-retention rules. Depending on the API service tier, Google may retain request data for a limited period for abuse monitoring. Do not submit an image if you do not want it processed by these providers.

Product photos are different: when you choose to attach one to a product, it is stored in your account's Supabase Storage area so the app can display it later. You can replace or remove it in the app, and account deletion is designed to remove user-owned storage objects.

The scan is cosmetic and educational. Scores are estimates from a model and may be inaccurate. They are not a diagnosis, medical record, or treatment recommendation.

5. Service providers

We use service providers to operate specific parts of Connie's Skin:

These providers process information under their own terms and as needed to provide services to us. We expect service providers with access to personal information to protect it appropriately.

6. When we share information

We share information only as described in this policy:

• With the service providers above to deliver the features you request.
• When you direct us to share or export information.
• To comply with law, legal process, or a valid government request.
• To protect users, the public, our rights, or the security of the service.
• As part of a business transaction, subject to appropriate notice and protection.

We do not sell personal information or share it for cross-context behavioral advertising.

7. Data retention and deletion

Account, routine, product, quiz, progress, and scan-result data is generally kept while your account is active so the app can provide history and synchronization.

You can start account deletion from Settings → Delete Account. The application is designed to delete the authentication account, active user-owned database rows, and user-owned product/progress photo objects. You can contact us if you cannot access the app.

Some information may remain for a limited period in encrypted backups, security logs, fraud-prevention records, or records we must retain for legal, tax, accounting, dispute, or payment obligations. Stripe independently retains payment information according to its policies and legal obligations. We may retain information that has been irreversibly de-identified.

Deleting the cloud account does not automatically erase a data export you previously saved or information remaining in your device's operating-system backups. You control those copies.

8. Your choices and privacy rights

• Photos: choose whether to grant camera/photo access and which image to select. Revoke OS permissions in device Settings.
• Notifications: enable or disable reminders in the app and in device Settings.
• Export: export a JSON copy of app data from Settings.
• Correction: edit products, routines, profile choices, and other app information.
• Deletion: delete individual product photos/items or start full account deletion.
• Support requests: contact us to request access, correction, deletion, restriction, or portability where applicable.

Rights vary by location. We may need to verify your identity before fulfilling a request. You may also have the right to appeal or complain to a local data-protection authority.

9. Security

We use technical and organizational safeguards appropriate to the service, including authenticated access, database and storage access controls, encrypted network transport, per-user data scoping, and restricted server credentials. No internet service can guarantee absolute security.

Protect your device and account credentials, and contact us if you believe your account has been compromised.

10. Children

Connie's Skin is not directed to children under 13 or the minimum digital-consent age that applies where they live. We do not knowingly collect personal information from a child without required consent. Contact us if you believe a child has provided information so we can investigate and delete it.

11. International processing

Our service providers may process information in the United States and other countries. Those locations may have privacy laws different from your home country. Where required, providers and we rely on recognized safeguards for international transfers.

12. Changes to this policy

We may update this policy as Connie's Skin changes. We will post the new date here and provide additional notice in the app when a change is material. Continued use after the effective date is subject to the updated policy.

13. Contact

Questions, requests, or concerns can be sent to: