Last updated: 2026-08-10
SkinArc ("we", "us") is a skin-tracking mobile application operated by Keyao Zhu, an individual (not a company), based in Vancouver, British Columbia, Canada. This policy covers the SkinArc app and the backend services it talks to. Contact: worldtab.app@gmail.com.
| Data | What it is | Where it lives by default |
|---|---|---|
| Face photos | The photos you take in the guided capture flow | On your device only. Never uploaded unless you turn on cross-device sync in Settings → Privacy. |
| Skin scores | Numbers our on-device algorithm computes from each photo (redness, pore, wrinkle, dark-circle, spot, oiliness, skin-tone-evenness, roughness, broken-capillary, dullness, breakout, and blackhead measurements) | On your device; synced to our servers automatically once you create an account, so your history isn't lost if you reinstall |
| Routine-change labels | Free-text notes you add ("started retinol", etc.) | Same as skin scores |
| Account info | Email address, or your Google/Apple account identifier if you sign in that way | Our servers (Supabase, see §5) |
| Approximate location | Used only to look up local weather/UV/air-quality for the environmental-correlation feature | Your device's location is rounded to roughly city-level precision (~11km) before it ever leaves your device, then sent directly to our weather-data provider, OpenWeatherMap (see §5) — not routed through our own servers first. We do not store the coordinates ourselves; only the resulting temperature/UV/air-quality/humidity/wind values are saved, and only if you enable this optional feature |
| Purchase data | Subscription status, verified through Apple/Google | Our servers, written only by an automated server process — never directly by the app |
We do not collect: your name (unless you type it into the nickname field), contacts, photos other than what you capture in-app, or any data when you use the app as a guest without an account.
Your face photos and the skin measurements we derive from them may be considered biometric identifiers or biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA) and similar statutes in Texas, Washington, and other jurisdictions.
| Provider | What they handle | Why |
|---|---|---|
| Supabase | Account auth, database (scores, routine changes, purchase status), and — only if you enable cross-device photo sync — encrypted photo storage | Our backend infrastructure |
| Apple / Google | Subscription payment and receipt data | Required for in-app purchases; we never see your payment card details |
| Anthropic (Claude API) | The text summary of your monthly/weekly report and daily tip — see §6 for exactly what's sent | Generates the VIP report's written narrative and the VIP daily tip |
| Resend | The text of feedback you submit (Settings → Feedback), and your email address if you provide one for a reply | Delivers your feedback to us by email — only used if you actually submit feedback |
| OpenWeatherMap | Your approximate location (rounded to city-level before it leaves your device), sent directly from the app — not via our servers | Looks up local temperature/UV/air-quality for the optional environmental-correlation feature — only called if you enable that feature |
This matters enough that we want to be precise rather than vague:
SkinArc provides personal tracking and statistical observations about your own data over time. It is not a medical device, does not diagnose any condition, and the "attribution" feature shows correlation in your own logged data, not a clinically validated cause-and-effect finding. Consult a dermatologist for any medical concern. See the in-app disclaimer shown on every attribution result for the exact wording.
Location access is optional and used only to look up local weather/UV/air-quality for the environmental-correlation feature. If you deny or later revoke location permission, that feature simply doesn't show data — nothing else in the app is affected.
SkinArc is not directed at children under 13. We do not knowingly collect data from children under that age.
Photos default to on-device storage. Account credentials are never stored in plaintext — sessions are AES-256 encrypted with the key held in the device's secure hardware storage. Server-side data is protected by row-level security policies scoping every user to their own rows only.
If we make a material change to this policy, we'll show an in-app notice the next time you open SkinArc and update the "Last updated" date above. Continued use of the app after that notice means you accept the revised policy.